The chinese want to use my server to view websites which are censored in there

rscalover

Well-Known Member
Dec 16, 2010
99
11
58
cPanel Access Level
Root Administrator
Hello,

I see allot of mod_proxy requests from chinese ip's that try to connect to certain websites voanews seems to be a populair one .The requests are being denied with a 403 forbidden by mod_security but i'm wondering why the Chinese are trying to steal my server resources for there crap and more precise what can i do about it ? recompile apache leaving out mod_proxy or what ?

Code:
 Request:
CONNECT www.voanews.com:443
Action Description:
Access denied with code 403 (phase 2).
Justification:
Matched phrase "/Proxy-Connection/" at TX:header_name.
[REDACTED FOR CONTENT]
 
Last edited by a moderator:

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,418
1,000
313
cPanel Access Level
Root Administrator
Hey there! If you don't have any dealings with China, the easiest thing to do would be to block the country with a country code block at the firewall level, which is possible in tools like CSF. That way the requests will not even reach the Apache system.

You won't want to try and remove mod_proxy as that would break many of the cPanel tools on the system.
 

cPRex

Jurassic Moderator
Staff member
Oct 19, 2014
7,418
1,000
313
cPanel Access Level
Root Administrator
I wonder that as well - I get random traffic on my personal machine from places where I know no one is looking at my sites, and just wonder why. Unfortunately, that's something we never really get to know the answer to.