How to properly deal with *.php script attacks?

[BBM]

My server is getting hammered with these *.php script attacks.
I have ofcourse CSF/LFD and BFM, and also installed ModSecurity as some last resort. But ModSecurity seems to give issues with phpBB forums.
But these don't seem to block much or especially not quickly enough as my CPU-load is constantly high.

For instance:

20.92.239.62 - - [13/Oct/2026:20:21:40 +0200] "GET /Spow_CtH.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:40 +0200] "GET /lumina_257.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /xhornoeu.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /sdds.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:41 +0200] "GET /rawr.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /addslashes.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /bom.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:42 +0200] "GET /wp-firewall.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /lumina_721.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /7PJtpMJsF9B.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:43 +0200] "GET /c.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /4tiny.php?p= HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /nots.php HTTP/1.1" 404 248 "-" "-" 
20.92.239.62 - - [13/Oct/2026:20:21:44 +0200] "GET /f6.php HTTP/1.1" 404 248 "-" "-"
185.73.23.162 - - [13/Oct/2026:20:35:00 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:35:06 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:36:21 +0200] "GET / HTTP/1.1" 200 4964 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)" 
185.73.23.162 - - [13/Oct/2026:20:38:18 +0200] "GET / HTTP/1.1" 200 4963 "-" "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)"
...

Would also like to know how these kind of attacks are called officially so I can search more directly for solutions.

 

[Ohm J]

It's just random scan/spam and trying to find the vul script, I'm sure even nginx ratelimits can't prevent this, cause it's rotate immediately

imagine, you have 10IP, spam using each IP with concurrent 50req, stop 10sec to prevent your anti-ddos, now you get 500req/10sec , 100IP=5000req/10s

 

[ericosman]

Hi,

I use Opsshield to secure my server against these attacks, till know *knocks on wood* it works like a charm.

Groeten, van iets hoger dan "the Dutch mountains"

 

[zEitEr]

20.92.239.62

You might follow a radical way and completely block Microsoft hosting and Google Cloud IPs and as suggested here in other threads, e.g.:

- https://forum.directadmin.com/threa...-traffic-from-bc-googleusercontent-com.82607/

If you want a more elegant way, then you might configure a webserver to report HTTP/403 error in case if somebody tries a non-existant file with .php extension. This way you will reduce impact of bot scanners on your CPU/RAM.

 

[BBM]

Thanks for the tips. I would into them.

Lessen the load on the CPU would be my first goal, as it's slowing down a website/forum to a crawl sometimes, causing users having to wait sometimes 30-60 seconds for a server-response.

Ideally I would like to block an IP if it generates 2 or more 403/404's within 1-5 seconds, provided it doesn't block legitimate IP's.