Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been getting a steady stream of requests for the same logo file from random IP addresses, many of which indicate they're mobile when I look them up. I'm at a loss to explain this. Anyone seen anything like this? Too slow to be DDoS - getting one or two requests per second. See log excerpt below:

2013-07-13T22:27:34.153340+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="176.26.196.239" dyno=web.2 connect=0ms service=3ms status=200 bytes=4949
2013-07-13T22:27:36.717976+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="120.148.213.86" dyno=web.1 connect=2ms service=6ms status=200 bytes=4949
2013-07-13T22:27:39.974051+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="83.93.35.236" dyno=web.2 connect=1ms service=4ms status=200 bytes=4949
2013-07-13T22:27:40.391736+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="71.215.117.46" dyno=web.2 connect=4ms service=4ms status=200 bytes=4949
2013-07-13T22:27:45.237967+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="83.86.71.32" dyno=web.1 connect=0ms service=4ms status=200 bytes=4949
2013-07-13T22:27:46.923376+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="114.77.113.151" dyno=web.2 connect=1ms service=3ms status=200 bytes=4949
2013-07-13T22:27:47.970334+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="96.42.78.113" dyno=web.1 connect=1ms service=5ms status=200 bytes=4949
2013-07-13T22:27:51.132715+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="70.208.140.92" dyno=web.2 connect=2ms service=6ms status=200 bytes=4949
2013-07-13T22:27:51.324829+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="65.28.230.123" dyno=web.2 connect=2ms service=4ms status=200 bytes=4949
2013-07-13T22:27:51.210556+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="174.71.114.24" dyno=web.2 connect=2ms service=5ms status=200 bytes=4949
2013-07-13T22:27:53.535628+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="222.152.223.110" dyno=web.2 connect=0ms service=3ms status=304 bytes=0
2013-07-13T22:27:54.369126+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="166.147.88.34" dyno=web.1 connect=1ms service=6ms status=200 bytes=4949
2013-07-13T22:27:54.977515+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="174.71.99.45" dyno=web.2 connect=2ms service=5ms status=200 bytes=4949
2013-07-13T22:25:34.035891+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="71.181.83.155" dyno=web.1 connect=1ms service=4ms status=200 bytes=4949
2013-07-13T22:27:55.170514+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="76.6.73.109" dyno=web.2 connect=2ms service=6ms status=200 bytes=4949
2013-07-13T22:27:57.140610+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="90.214.0.244" dyno=web.2 connect=0ms service=3ms status=304 bytes=0
2013-07-13T22:28:00.910315+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="213.118.129.224" dyno=web.1 connect=0ms service=30ms status=200 bytes=4949
2013-07-13T22:28:01.379740+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="37.24.152.69" dyno=web.2 connect=2ms service=5ms status=200 bytes=4949
2013-07-13T22:28:02.590955+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="67.242.66.252" dyno=web.1 connect=1ms service=10ms status=200 bytes=4949
2013-07-13T22:28:02.991276+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="64.68.249.30" dyno=web.1 connect=0ms service=11ms status=200 bytes=4949
2013-07-13T22:28:04.767034+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="121.217.137.134" dyno=web.1 connect=2ms service=11ms status=200 bytes=4949
2013-07-13T22:28:06.445685+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="37.3.166.229" dyno=web.2 connect=0ms service=4ms status=200 bytes=4949
2013-07-13T22:28:14.310282+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="188.238.197.62" dyno=web.2 connect=2ms service=4ms status=200 bytes=4949
2013-07-13T22:28:20.500325+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="82.47.13.186" dyno=web.1 connect=1ms service=5ms status=200 bytes=4949
2013-07-13T22:28:24.990172+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="166.216.162.174" dyno=web.1 connect=0ms service=4ms status=200 bytes=4949
2013-07-13T22:28:27.185422+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="86.40.204.160" dyno=web.1 connect=1ms service=4ms status=200 bytes=4949
2013-07-13T22:28:32.374602+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="99.224.243.79" dyno=web.2 connect=2ms service=7ms status=200 bytes=4949
2013-07-13T22:28:41.325011+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="60.224.53.248" dyno=web.2 connect=1ms service=3ms status=200 bytes=4949
2013-07-13T22:28:41.663832+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="108.228.201.226" dyno=web.1 connect=0ms service=5ms status=200 bytes=4949
2013-07-13T22:28:45.171388+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="69.35.195.247" dyno=web.1 connect=1ms service=6ms status=200 bytes=4949
2013-07-13T22:28:54.834042+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="91.21.26.161" dyno=web.1 connect=1ms service=4ms status=200 bytes=4949
2013-07-13T22:28:54.939980+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="50.80.146.205" dyno=web.1 connect=1ms service=6ms status=200 bytes=4949
2013-07-13T22:29:01.512479+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="68.146.6.169" dyno=web.2 connect=2ms service=4ms status=200 bytes=4949
2013-07-13T22:29:05.899432+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="27.55.138.82" dyno=web.2 connect=1ms service=4ms status=200 bytes=4949
2013-07-13T22:29:06.491171+00:00 heroku[router]: at=info method=GET path=/assets/logo-dca34700af452ed9d05db6bb431f067b.png host=diverxity.herokuapp.com fwd="101.169.42.170" dyno=web.2 connect=0ms service=3ms status=200 bytes=4949

Thoughts?

share|improve this question

closed as too broad by Xander, NULLZ, tylerl, TildalWave, Lucas Kauffman Jul 24 '13 at 9:02

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Could be just requests from other web pages linking the mentioned image's src to where you host it on your web server. It doesn't look suspicious to me, but you might want to enable logging of referer to see what pages these requests are made from. Are you sure you haven't posted this logo as an external resource in some third-party web pages like Facebook, Twitter,... yourself? –  TildalWave Jul 13 '13 at 22:55
1  
By the way, that image you're mentioning looks like of suitable size for some link exchange programs. Those rarely come with their own CDN to host images remotely (sometimes intentionally, so web admins can track demographics accessing banner exchange pages) and will accept your remotely hosted URL as an image source. Does any of this sound familiar? ;) –  TildalWave Jul 13 '13 at 23:07
1  
Sounds plausible. I don't currently have a link exchange going, but I have one partner who may have done something to this effect. Will ask him. Thanks much for the responses! –  lou-diverxity Jul 13 '13 at 23:18
1  
This question appears to be off-topic because it about network traffic unrelated to security. –  Xander Jul 24 '13 at 0:12

1 Answer 1

up vote 1 down vote accepted

I would tend to believe that someone is referencing one of your images from your site. You might want to dig a bit deeper and see what the referrer (misspelled as referer in the headers and standard) is. This may give you more insight into who is pointing people at your images. :)

share|improve this answer
1  
Thanks for the guidance. Appreciate it! Helped me solve the mystery. One of our partners had indeed linked to our logo image without giving me a heads up. –  lou-diverxity Jul 13 '13 at 23:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.