We have a dedicated server for our clients that run about 100 sites that we have build and maintain. It's decent server with CloudLinux. This particular sites sticks out in CPU usage compared to others.
I took a quick look at the server logs and noticed a lot of entries like this:
20.171.206.127 - - [11/Sep/2024:17:24:45 +0200] "GET /veldverkenningen/filter?onderwerpen[0]=36&onderwerpen[2]=17&onderwerpen[3]=26&onderwerpen[4]=20&onderwerpen[5]=28&onderwerpen[6]=33&onderwerpen[7]=40 HTTP/1.1" 200 11028 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://openai.com/gptbot)"
I blocked the IP range 20.171.206. and the CPU load went down a lot.
I think I need to ask our server company to help us figure out if and how we can stop this behaviour. Becauze I don;t think blocking IP's is the beste way to do it. But a least now I know where to look.
Thanks so far!