The chinese want to use my server to view websites which are censored in there

rscalover

• January 05, 2021 01:56

Hello, I see allot of mod_proxy requests from chinese ip's that try to connect to certain websites voanews seems to be a populair one .The requests are being denied with a 403 forbidden by mod_security but i'm wondering why the Chinese are trying to steal my server resources for there crap and more precise what can i do about it ? recompile apache leaving out mod_proxy or what ? Request: CONNECT www.voanews.com:443 Action Description: Access denied with code 403 (phase 2). Justification: Matched phrase "/Proxy-Connection/" at TX:header_name.
[REDACTED FOR CONTENT]

• 

  cPRex Jurassic Moderator

  • January 05, 2021 13:53

  Hey there! If you don't have any dealings with China, the easiest thing to do would be to block the country with a country code block at the firewall level, which is possible in tools like CSF. That way the requests will not even reach the Apache system. You won't want to try and remove mod_proxy as that would break many of the cPanel tools on the system.

  0
• 

  keat63

  • January 05, 2021 16:54

  I'd also suggest CSF.

  0
• 

  rscalover

  • January 05, 2021 19:51

  Hello, Yes i already use csf and know about that option i just wonder why they even try such a thing .

  0
• 

  cPRex Jurassic Moderator

  • January 05, 2021 20:41

  I wonder that as well - I get random traffic on my personal machine from places where I know no one is looking at my sites, and just wonder why. Unfortunately, that's something we never really get to know the answer to.

  0

Please sign in to leave a comment.