1

This question already has an answer here:

Below is my apache access log.

175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/mysql/admin/ HTTP/1.1" 301 -
...
175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/phpMyadmin/ HTTP/1.1" 301 -

Is this logs indicates any dos attack to my server? If yes or any other attack, how to prevent from that?

My Web Apps Stack : Apache, Laravel & Postgres

marked as duplicate by Steffen Ullrich, Tobi Nary, Bacon Brad, Steve, Teun Vink Sep 8 '17 at 4:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    What makes you think that it is DOS attack? – Mirsad Sep 7 '17 at 3:56
1

That's something what you have to expect when you run own server. Those logs are normal in a way that attackers are trying to find those directories and furtherly gain access to the server or running web application.

If your server is properly configured & secured, you don't need to worry about those logs.

0

Welcome to the internet ahmfikr.

No, it's not someone trying to DOS your server. It's someone trying to probe another server for vulnerabilities. Note the full URL in the request, the client is trying to get your server to proxy the request to 'xx.xxx.xx.xxx', hiding their own IP address. Or if 'xx.xxx.xx.xxx' is thename of your server, then they are using an unusual client to probe your site for vulnerabilities.

What is rather odd, is that your server is responding with a 301 rather than a 4xx or 5xx response. If I were you I'd be checking why and where it is redirecting the user.

Not the answer you're looking for? Browse other questions tagged or ask your own question.