Home / server / Questions / 166192
In Process
paul
Asked: 2010-08-02 23:06:27 +0800 CST

Strange URLs in access log. What could it be?

  • 772

I am currently investigating an instability problem in my customer's web site. While looking through the access log I noticed a sudden burst of activity from one particular IP. It started off requesting normal URLs but at a high rate - 8 hits/sec. For most of the time the same URL (actually a directory) was requested but interspersed with these were URLs which started off as valid but always ended with a random 11-character value like this:

93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/0g2exjxspky.html HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -

Has anyone seen this kind of behaviour before? I can't figure out what might lie behind this. I'd be interested to hear anyone's opinion on this.

Paul

logging

4 Answers

  1. Not sure, but many spambots etc. are behaving like that, so it might be just another zombie Windows client bombing your server.

    • 1

  2. It is usually not a problem, if your server and any of its possible server-based applications are responding correctly to the bogus calls (ignore or error).

    • 0

  3. I see that kind of thing pretty much every day, along with numerous requests for pages which don't exist on our sites. As far as I've been able to determine it's bots looking for specific vulnerabilities. I just accept it as part and parcel of being on the Internet and haven't taken the time to determine just what holes they're looking for.

    • 0

  4. You run into some zobies / bots / whatever trying to explore various problems in various programs used on various systems. Some web servers (older, unpatched) or some software may react by installing softawre etc.

    Those worms basically try to exploit a security issue X on random IP addresses.

    Some are ancient, but still around - supposedly there are infected Windows 2000 systems still around, unpatched, on the internet.

    • 0