Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I see some strange (suspicious?) http requests in my webserver.

Example:

192.161.x.x - - [14/Mar/2014:21:55:36 -0300] "GET /ce/c02i.html/RS=^ADAD3F3nOTvuESWLtAiP39aTQZiSRQ- HTTP/1.0" 404 881 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" "-"

The common pattern seems to be:

  • A valid html page is requested, but with an extra /RS=^ADA.... string attached, which makes the request invalid
  • The string following ADA.... (seems to be some hash) varies
  • The referer seems faked, it's always the true domain (replaced here by 'example.com'), which actually doesn't have links to those html pages.
  • The requests come from different (unrelated) IPs. Normally this is the single request coming from that IP.
  • The user agent is always exactly the same as above - fake, I guess.

The only mention I found was not very informative. Is this some known exploit attempt?

share|improve this question
    
I have found this running for the last month at about 20-50 requests per-day. Matches your common pattern perfectly (i.e. referer faked). I guess I'm going to do some mod_rewrite (URL Rewrite in IIS) and cause infinite redirects or drop a 500. Any luck on figuring this out? –  MikeMurko Mar 23 at 14:39

1 Answer 1

It's a drive-by attack against some obscure CMS, and it appears your site doesn't run that CMS, so I wouldn't worry about it. Some bot is just trawling the web and blindly looking for pages that might be exploitable. This is likely why the Google search mentioned in the link you provided points to so many junk/spam pages.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.