We have two load balancers running HAProxy which serve requests to an application server. We've recently been getting spikes of traffic from script kiddies running vulnerability checks against our infrastructure. It's just a bunch of GET requests for files that don't exist (/phpMyAdmin). They only result in 15-20 requests/sec for our application server, but CPU load spikes to 100%. What's interesting is that we normally have 10-15 requests/sec, which we have no problem with. So, I'm a bit confused as to how these requests are causing so much damage.
The load balancers happily pass the traffic along, but the application server chokes and load and CPU usage skyrocket. We're hoping for some advice -- should we start looking at the Apache config, or could there something unique about these requests that we can block at the load balancer level? I find it odd that our normal requests come in at almost the same rate, but they don't cause any additional CPU load.
Any help is appreciated.