How to properly deal with *.php script attacks?

[BBM]

My server is getting hammered with these *.php script attacks.
I have ofcourse CSF/LFD and BFM, and also installed ModSecurity as some last resort. But ModSecurity seems to give issues with phpBB forums.
But these don't seem to block much or especially not quickly enough as my CPU-load is constantly high.

For instance:

20.92.239.62 - - [13/Oct/2026:20:21:40 +0200] "GET /Spow_CtH.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:40 +0200] "GET /lumina_257.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /xhornoeu.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /sdds.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /rawr.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /addslashes.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /bom.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /wp-firewall.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /lumina_721.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /7PJtpMJsF9B.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /c.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /4tiny.php?p= HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /nots.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /f6.php HTTP/1.1" 404 248 "-" "-"
185.73.23.162 - - [13/Oct/2026:20:35:00 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:35:06 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:36:21 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:38:18 +0200] "GET / HTTP/1.1" 200 4963 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)"
...

Would also like to know how these kind of attacks are called officially so I can search more directly for solutions.

 

[Ohm J]

It's just random scan/spam and trying to find the vul script, I'm sure even nginx ratelimits can't prevent this, cause it's rotate immediately

imagine, you have 10IP, spam using each IP with concurrent 50req, stop 10sec to prevent your anti-ddos, now you get 500req/10sec , 100IP=5000req/10s

 

[ericosman]

Hi,

I use Opsshield to secure my server against these attacks, till know *knocks on wood* it works like a charm.

Groeten, van iets hoger dan "the Dutch mountains"