1

Below is my apache access log.

175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/mysql/admin/ HTTP/1.1" 301 -
...
175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/phpMyadmin/ HTTP/1.1" 301 -

Is this logs indicates any dos attack to my server? If yes or any other attack, how to prevent from that?

My Web Apps Stack : Apache, Laravel & Postgres

Mirsad
  • 10,005
  • 8
  • 33
  • 53
ahmfikr
  • 11
  • 1

2 Answers2

2

That's something what you have to expect when you run own server. Those logs are normal in a way that attackers are trying to find those directories and furtherly gain access to the server or running web application.

If your server is properly configured & secured, you don't need to worry about those logs.

Mirsad
  • 10,005
  • 8
  • 33
  • 53
0

Welcome to the internet ahmfikr.

No, it's not someone trying to DOS your server. It's someone trying to probe another server for vulnerabilities. Note the full URL in the request, the client is trying to get your server to proxy the request to 'xx.xxx.xx.xxx', hiding their own IP address. Or if 'xx.xxx.xx.xxx' is thename of your server, then they are using an unusual client to probe your site for vulnerabilities.

What is rather odd, is that your server is responding with a 301 rather than a 4xx or 5xx response. If I were you I'd be checking why and where it is redirecting the user.

symcbean
  • 18,278
  • 39
  • 73