Server Traffic - Anybody know the name of this type attack?

All,

   My web server has been getting hammered by rotating IP addresses 
(most from Microsoft cloud, some from Saudi Arabia, that just seem to be 
trying random .php pages. None of which I have. The Apache error log 
looks like:

[Tue Aug 25 23:18:28.415538 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/one.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.509745 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/ano.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.605325 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/mac.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.702799 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/simple.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.796892 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/sallu.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.891538 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/biufile.php' not found or 
unable to stat
[Tue Aug 25 23:18:28.987806 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/abcd.php' not found or 
unable to stat
[Tue Aug 25 23:18:29.084630 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/33.php' not found or unable 
to stat
[Tue Aug 25 23:18:29.180121 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/xa.php' not found or unable 
to stat
[Tue Aug 25 23:18:29.275461 2026] [:error] [pid 96257:tid 96257] [client 
20.104.18.15:63463] script '/srv/http/htdocs/ccc.php' not found or 
unable to stat

   This makes no sense as a scrape -- why guess page names, instead of 
just a normal crawl? So this looks like some type of attack. This has 
been going on for a few days. Anybody know what it's called or have any 
details on this type attack?

   Seems pretty innocuous, and other than a few flurries, doesn't seem 
to be a DDOS attack, the IPs are try 1, then the next IP picks up, etc.. 
rather than all ganging up to generate traffic all at once. For example, 
on the August 23/24 the following were the unique IPs:

4.204.200.136
20.1.169.243
20.42.19.40
20.48.147.90
20.48.160.90
20.51.153.15
20.63.64.130
20.75.92.165
20.89.241.218
20.97.182.130
20.104.50.220
20.104.86.241
20.104.87.97
20.104.104.62
20.118.172.148
20.122.142.214
20.151.9.127
20.151.9.151
20.151.109.219
20.151.128.234
20.151.129.194
20.169.16.7
20.197.195.76
20.203.162.73
20.220.10.235
20.226.7.189
20.226.36.136
20.226.56.190
20.226.91.14
20.251.63.238

(all Microsoft cloud)

   The only annoying part is those generated over a megabyte of http/php 
error log entries in that period.

   Apologize for this only being Linux/server related and not a specific 
leap or TW problem, but I couldn't think of a better place to ask.

-- 
David C. Rankin, J.D.,P.E.