It looks more like an attempt at spamming, but without the full log entries (containing the referrer and the destination URL) it's impossible to be sure. In the

It looks more like an attempt at spamming, but without the full log entries (containing the referrer and the destination URL) it's impossible to be sure. In the end it doesn't really matter though. Anyway, you have identified the main issue: some more code cleanup is in order. If you want to do this yourself: keep in mind that elegance in code is not the primary goal, runtime behavior is. Make sure you cache your results as much as possible, eliminate unnecessary DB calls. On the sysadmin side, assuming your app is PHP the following is mandatory: make sure you're using PHP-FPM, and enable APC or Opcache. Optionally, consider installing Memcached and start using it from the app to cache data that is expensive to generate. If you're running on Apache, switch to Nginx. Finally: reverse proxy service. They'll filter out most malicious requests for you. When the day comes where you experience a real attack, you'll have no chance of keeping the server up without using such a service.