|Alert Message||Configured tresholds exceeded - Possible DoS attack|
hostname mod_evasive: Blacklisting address 188.8.131.52: possible DoS attack.
This rule detects when the thresholds you have configured for the mod_evasive module are exceeded. This may be a DOS attack, or this may mean that you need to increase the thresholds for your system. For example, faster systems can handle more connections than slower systems.
mod_evasive is a Denial Of Service detection module for apache, it detects when an IP address exceeds a connection threshold (Example: X connections in Y seconds, or X accesses for the same page from a single IP in Y seconds). These thresholds are configurable through ASL.
 False Positives
This rule can be falsely triggered if the configured thresholds for the system have been exceeded.
If you believe that the thresholds are too low for your system, please see the Solutions section below.
Please see the Mod_evasive wiki page for detailed guidance.
 Additional Information
 Similar Rules
 Knowledge Base Articles
 Outside References
This event does not produce an audit log entry, as it does not use mod_security.