I see some strange (suspicious?) http requests in my webserver.
192.161.x.x - - [14/Mar/2014:21:55:36 -0300] "GET /ce/c02i.html/RS=^ADAD3F3nOTvuESWLtAiP39aTQZiSRQ- HTTP/1.0" 404 881 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" "-"
The common pattern seems to be:
- A valid html page is requested, but with an extra
/RS=^ADA....string attached, which makes the request invalid
- The string following ADA.... (seems to be some hash) varies
- The referer seems faked, it's always the true domain (replaced here by 'example.com'), which actually doesn't have links to those html pages.
- The requests come from different (unrelated) IPs. Normally this is the single request coming from that IP.
- The user agent is always exactly the same as above - fake, I guess.
The only mention I found was not very informative. Is this some known exploit attempt?