Apache crash after what appears to be some DoS attach

[clawwd]

All,

I am not sure what has recently changed but I am getting slammed with some type of script or something trying to run the below. It happens in such frequency that Apache HTTP Server crashes several times a day.

I found an article last week about enabling a module called mod_evasive.so which sounded like it monitors bogus spam connections and blacklists them. I dont think its actually working.

Below is just a small sample of what I am seeing in the error logs but there are approx 9800 entries in the last week. Is there anything I can do?

BTW, the below shows hitting webalizer on c:/xampp but there isn't anything there or even in off the htdocs folder. I have two websites going with their own folders and 3 sub-folders off of the htdocs folder that I have been running for a while with no issue until recently. The logs also show tons of entries trying to access various php files in the htdocs folders. again there are none there.

Any help is greatly appreciated

Code: Select all

[authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/index.html
[Tue Nov 05 11:43:20.917407 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/index.htm
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.php
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.pl
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.cgi
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.asp
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.shtml
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.html
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/default.htm
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/home.php
[Tue Nov 05 11:43:20.928545 2019] [authz_core:error] [pid 5956:tid 1720] [client 80.241.221.67:61000] AH01630: client denied by server configuration: C:/xampp/webalizer/home.pl

[Nobbie]

but there are approx 9800 entries in the last week. Is there anything I can do?[/code]

Yes, you can go to bed and sleep. Same for your server. 9800 in a week is NOTHING. NOTHING. NOTHING. There is ONE request PER MINUTE. Are you kidding? Do you know, what DoS means? One Million per second or so. Sorry, but that is hilarious.

[clawwd]

Easy man. I am just trying to troubleshoot.

I bought a VM out of Dallas. Its horribly low performance but it was all I could afford.

Maybe it isn't a true DOS attack but tom me, it only makes sense...at least on my server hardware. At least that all I could come up with since the sites have been up for quiet sometime and it just started crashing and showing all that in logs which I have seen before.

[Altrea]

Don't use XAMPP in public accessible environments. It is not designed for that.

That is all I can say.