POST request is being made every 60 seconds from IP address

  • Resolved kv1953

    (@kv1953)


    3 weeks, 4 days ago

    I have noticied a large jump in visits to website in March for website englishspringerdata.org which is a pedigree database.

    Analysed the access logs for the site in question and can see that the majority of requests look to have originated from the IP address 90.195.192.69, which belongs to Sky Broadband Whois reports as “RIPE Database query servic”e , so seems to be from a single user. This has accounted for around 15,000 hits. Due to how WP Cron works, each hit would also have generated a hit for WP Cron, which then accounts for the 15,000+ hits originating from the server IP address, 77.72.2.77.

    The logs show that a POST request is being made every 60 seconds from IP address. Therefore it looks like these requests are being generated by some kind of automated script. Resulted in massive increase in GB traffic . Does anybody have an idea as to what is going on. 

    90.195.192.69 - - [20/Mar/2026:13:50:46 +0000] "POST /wp-admin/admin-ajax.php?action=qnap_status&secret_key=r9LCNSkiK9ZrZSgB06PPihGCM27fKvHiH7UquFjj2mlBlAIKq5uDAnCxvsyRm54G HTTP/2" 200 0 "-" "go-resty/2.6.0 (https://github.com/go-resty/resty)"
90.195.192.69 - - [20/Mar/2026:13:51:46 +0000] "POST /wp-admin/admin-ajax.php?
Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter kv1953

    (@kv1953)

    3 weeks, 4 days ago

    Also noticied that the log references QNAP, I have a QNAP NAS which is used for offsite backup of website.

    Plugin Support dimitrycleantalk

    (@dimitrycleantalk)

    3 weeks, 4 days ago

    Hello @kv1953,

    Please contact your hosting support regarding this matter. Unfortunately, we don’t know why this is happening. I can only assume that your QNAP NAS is making these requests due to a configuration issue. In any case, your hosting provider should be able to assist you with this.

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.