access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th =F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th
=F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.

The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".

I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.

My question really has two parts:

• What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
• Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?

IP Addresses: They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.

133.50.201.25 (Japan, University domain)

89.29.175.68 (Trinidad and Tobago, root domain seems to be for a non-profit)

190.156.227.11 (Colombia, not sure what type of domain).

78.250.250.243 (France, no host info appears to be available)

I've seen others from Italy, Spain, etc

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /scripts/query-ui/js/]};F.optgroup=F.option;F.tbody=F.tfoot=F.colgroup=F.caption=F.thead;F.th =F.td;if(!c.support.htmlSerialize)F._default=[1, HTTP/1.1" 404 338

Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.

The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".

I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.

My question really has two parts:

• What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
• Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?

IP Addresses: They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.

133.50.201.25 (Japan, University domain)

89.29.175.68 (Trinidad and Tobago, root domain seems to be for a non-profit)

190.156.227.11 (Colombia, not sure what type of domain).

78.250.250.243 (France, no host info appears to be available)

I've seen others from Italy, Spain, etc