Suspicious Apache Status requests

globcom

• October 27, 2018 09:25

Hello, on new server I see lot of requests in "Server status" > "Apache status" with : GET /logos/NEW%20LOGOS/usa%20cmt%20hd.png HTTP/1.1 on my.nameserver.com:80 (vhost) What is it ? and how can I block these queries if there illegimate traffic ? Thank you for you replies. Eric

• 

  GOT

  • October 27, 2018 14:54

  What HTTP code is it returning? I presume either a 5xx or a 404?

  0
• 

  globcom

  • October 27, 2018 15:06

  Thank you GOT It's return 404

  0
• 

  GOT

  • October 27, 2018 15:12

  Then its typically not an issue unless they are hammering you so hard that its causing a load issue. You can install and configure CSF firewall and enable 404 blocking if you want to block IPs that hit numerous 404 pages.

  0
• 

  globcom

  • October 27, 2018 15:32

  Thank you Got. I will try your solution. Eric

  0
• 

  globcom

  • October 28, 2018 15:03

  The solution with CSF doesn't work directly. I created a modsecurity rule based on this : SecRule REQUEST_URI "/logos/NEW%20LOGOS/" "deny,id:18478,phase:1,status:411,msg:'logos'" The IPs are blocked in CSF denylist and I have hundred IP in list and is growing up... I don't know what is better : - try to block this traffic or - nothing ? Eric

  0
• 

  cPanelMichael

  • October 29, 2018 17:24

  Hello Eric, I don't see the harm in blocking the traffic if it's not legitimate. Try searching the path that's being hit in the website files of the accounts you host to make sure it's not a poorly coded script that's leading to users making a connection attempt to the wrong path. Thank you.

  0
• 

  globcom

  • October 30, 2018 08:11

  Hello Michael and thank you for your reply ! The trouble (for me) is this traffic come to my.servername.com There isn't script, website, on it. cPanel recommendation (if I'm not mistaken) is that the subdomain should not be created for the name server on the server. Exemple of request : http/1.1 my.nameserver.com:80 GET /logos/NEW%20LOGOS/usa%20el%20ray%20network%20hd.png HTTP/1 All this traffic come from USA (and I can't block US country in CSF) At this time I have 3020 IPs in my CSF denylist. I don't know how much IPs is possible to block with CSF (server with 128 Go of ram) With the modsecurity rule, I don't have load issue. I hope this will stop by itself ! Eric

  0
• 

  cPanelMichael

  • October 30, 2018 15:35

  Hi Eric, One option to consider if RAM usage becomes an issue is to lower the DENY_IP_LIMIT value in the csf.conf file. If the same IP addresses are consistent in their attack on your server, then an abuse report to the data center/network provider that controls those IP addresses is a good idea as well. Thank you.

  0
• 

  globcom

  • October 30, 2018 15:43

  Hi Michael, it's always different IP addresses. Exemples : - Removed no need here - Thank you

  0
• 

  cPanelMichael

  • October 30, 2018 15:52

  Hi @globcom, If the IP addresses are different, then the DENY_IP_LIMIT value in the csf.conf file should allow you to avoid excessive RAM usage on the system. There's no need to keep the IP addresses blocked permanently if it's new IP addresses hitting your server each time. Thank you.

  0

Please sign in to leave a comment.