Have you added any scripts recently? It is a common problem both with home-made and with off-the-shelf scripts that "objects" to be included in a page are called incorrectly using a URL instead of by using a local filesystem path. In this case, the serve makes a request to itself using HTTP, and that request appears in your log file.
Of course, if you did not add any scripts, then possibly a hacker did.
It is unlikely that someone is spoofing your server's IP address, as this is a non-trivial thing to do, and if done, it is impossible for the attacker to ever receive any responses from your server (because the responses will be sent to your server in response to any request from your server) unless that attacker is injecting the requests inside your hosting company's data center and intercepting the responses there, inside your server's LAN.
Personally, I'd take the site off-line until you have the problem identified. You must balance the temporary risk of revenue loss while fixing the problem against the permanent loss of customers whose computers are infected by your machine if it is currently hosting malware -- and that could be what is causing these bogus requests as well.
The easiest way to take this site off-line would be to point the DNS to another one of your servers, and host a page there that briefly and simply explains why your site is not accessible. If the attacks do not follow to a server with none of your recent scripts in place, then that may tell you something as well... If they do, look at the IP address making those requests -- is it the old or new server?
If that isn't fast enough for you, consider disabling access using code like:
Order deny,allow
Deny from all
or
RewriteRule !^path-to-your-custom-403-error-page\.html$ - [F]
or on Apache 2.x only
RewriteRule !^path-to-your-custom-503-error-page\.html$ - [R=503]
You can of course also deny access by IP address, but these denials will all appear in your server logs -- only firewalling the server or pulling its ethernet cable will actually stop the requests.
The error-page exclusions in the above rules are intended to avoid creating a further self-inflicted DOS attack. Without the exclusions, each real error would trigger another error, then another, etc.
Also, you need a better host if they can't be bothered to help you in any way. In reality, cheap hosting is the most expensive hosting you can buy.
Jim
