Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:
/warning.php++++++++++++++++++++++++++++++++++Result:+chosen+nickname+%22doudounemonclerfemmez.webs.comoV%22;+success;
The Requester IP-address and the quoted chosen nickname is different in each request, otherwise the pattern is the same.
The page requested (warning.php) is a real page on my site that mentions a specific hacker group (not "anonymous" btw.) in non-flattering terms. The fact that this specific page is targeted may indicate that they may be irritated - or it may just be a coincidence.
The hacker group in question is (IMHO) an obnoxious bunch of criminals, but they are also quite good at what they do. However, I don't see this as a compentent attack. To me, it looks more like a script-kiddie thing than something a real hacker would try. I really don't understand what padding a legitimate page request with a lot of spaces and some random "chosen nickname" is supposed to accomplish. To me, it does not look like an injection attack. The requests are persistent, but only 40-60 per day - so it is not even some sort of DoS attack.
I've googled for this pattern, but only found this: http://en.forums.wordpress.com/topic/hacked-by-f34rl355-i-guess - which suggests that this is script-kiddie work. However, the fact that whoever doing this has at his disposal at vast number of IP-addresses points in the opposite direction. I've discounted the theory of multiple script-kiddies, since I know of no "script" that have this "thing" as a component, and since all requests are for the same specific page.
What make me a bit concerned is that 1) whoever is doing this is persistant; 2) it targets a specific page on my site.
My specific questions here are:
- Can anyone see what the person doing this is trying to accomplish?
- Should I be concerned?