Apache exploding every few hours

Marcin M

• September 02, 2026 20:02

Hi, 

I don't understand what is happening but my apache since yesterday started to die constantly. 

First thought that is DDoS but it looks like it is not. 

I see tons requests that are getting filtered by mod security 

Im lost here

[Wed Sep 02 21:50:13.270339 2026] [:error] [pid 611486:tid 611518] [client 45.148.10.12:52522] client denied by server configuration: proxy:http://127.0.0.1/cgi-sys/autoconfig.cgi
[Wed Sep 02 21:50:13.272057 2026] [security2:error] [pid 649545:tid 649670] [client 127.0.0.1:41824] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "5155"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "aph99c3ya2GuPnN_9a7W1wAAAEg"]
[Wed Sep 02 21:50:13.382786 2026] [:error] [pid 611486:tid 611518] [client 45.148.10.12:52522] client denied by server configuration: proxy:http://127.0.0.1/cgi-sys/autoconfig.cgi
[Wed Sep 02 21:50:13.384239 2026] [security2:error] [pid 611486:tid 611514] [client 127.0.0.1:41840] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "143"] [id "920170"] [rev "1"] [msg "GET or HEAD Request with Body Content."] [data "5155"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "aph99Y9n2_T-SEj2415kbgAAAUE"]
[Wed Sep 02 21:50:13.407803 2026] [:error] [pid 611486:tid 611518] [client 45.148.10.12:52522] client denied by server configuration: proxy:http://127.0.0.1/cgi-sys/autoconfig.cgi

Some are strange like that and do not understand how they can do proxy calls. 

• 

  cPRex Jurassic Moderator

  • September 03, 2026 13:56

  Hey there!  Have you worked through the details here to confirm if there is a DoS attack?

  https://support.cpanel.net/hc/en-us/articles/360052130134-How-can-I-tell-if-Apache-is-experiencing-a-DDoS-attack

  That's where I would start to confirm if there is too much activity heading to your server.

  Checking the "apachectl status" command would also give you the scoreboard so you can see if Apache is running out of resources there.  You can also view this data in WHM directly: https://docs.cpanel.net/whm/server-status/apache-status/

  0
• 

  Marcin M

  • September 03, 2026 21:36

  Thx for the links, that is not the issue on one IP attack got tons of mod security errors - connections comes to open .git .env and other paths with .something. Do not understand why it started yesterday

  0
• 

  Marcin M

  • September 03, 2026 21:52
  • Edited

  I had to use fail2ban and create filters to detect modsecurity errors and then temporary ban IP but that is just a pil for the whole problem. Do not understand why there is such a huge movement since yesterday. CSF modsecurity is not working so I really am lost here.

  0
• 

  cPRex Jurassic Moderator

  • September 04, 2026 14:35

  It still could be a DoS, just a different type of attack.  It might be best to create a ticket so someone could examine the system directly.

  0

Please sign in to leave a comment.