Re: Server Traffic - Anybody know the name of this type attack?

On Wed, 2026-08-26 at 13:36 +0200, Andreas Stieger via openSUSE Users
wrote:
> On 2026-08-26 07:00, David C Rankin wrote:
> > [...] hammered by rotating IP addresses [...] trying random .php
> > pages.
> These are not random, but names of known previously vulnerable PHP
> scripts.

We have a long-ish list of these which we filter out at the nginx
front-end, or previously in the Apache config.   It is easy to do,
these are very repetative, you just return HTTP/418 TEAPOT to all these
paths.

Otherwise you will have a lot of noise in your logs.

Also, never code anything which matches these paths

> > So this looks like some type of attack.
> No, this is just "welcome to the internet". You are not special.
> >  The only annoying part is those generated over a megabyte of
> > http/php 
> > error log entries in that period.
> Look into logrotate and compression.