8

On my Drupal site I'm getting strange requests for url paths that I have never had and have nothing to do with my site. Could some one explain why people (or bots) are looking for the following urls?

  • resource-center/news/surgery-office-pays-for-hipaa-violation
  • resource-center/news/state-officials-stake-out-positions-on-implementing-health-law
  • business-insurance/commercial-insurance/commercial-general-insurance/hotels-and-other-accommodations
  • resource-center/news/faq-the-obama-administration's-compromise-on-contraception-benefits
  • /resource-center/news/55-billion-reasons-for-consumer-driven-care

My site is for my business where we build themes for Drupal and have nothing to do with the following urls. Why am I seeing this in my Drupal reports? (our server is setup as a multi site with out clients sites. but they don't get as much traffic as our site) The client sites also have nothing to do with any of the following links and have never had url paths of that type.

Should I block the IP address that are making the requests?

looking at the data from one of the requests:

TYPE    page not found
DATE    Thursday, October 1, 2015 - 09:20
USER    Anonymous (not verified)
LOCATION    http://www.mcmahonllc.com/resource-center/news/the-white-house-fact-sheet-on-the-contraception-compromise
REFERRER    
MESSAGE resource-center/news/the-white-house-fact-sheet-on-the-contraception-compromise
SEVERITY    warning
HOSTNAME    66.249.73.183
OPERATIONS

This is all the data I have.

Improve this question
6
  • 1
    Is a HTTP-Referer [sic] header being sent with these requests? Of course, it isn't reliable, but it might give some clue as to the source.
    – Ben Voigt
    Commented Oct 13, 2015 at 17:32
  • I updated my question with a print out of one of the requests
    – Patrick W. McMahon
    Commented Oct 13, 2015 at 17:39
  • Should I block them? What are they trying to do to my server?
    – Patrick W. McMahon
    Commented Oct 13, 2015 at 17:41
  • 1
    is it a way to spam your logs, like the referer links we now get for "seo something or other", from Russia?
    – Manu
    Commented Oct 13, 2015 at 17:43
  • 1
    My guess is that it's some sort of malicious SEO, maybe there's some search engine that gives them credit for linking to your site. Unless there's some form field payload or funny URL (like use of parent paths ..) it's probably not an attack against you.
    – Ben Voigt
    Commented Oct 13, 2015 at 17:43

1 Answer 1

Reset to default
6

There's nothing malicious about this. It could simply be that someone is hitting your machines because they have an out-of-date IP address for a completely different host, maybe because it was hard-coded into a hosts file by someone or a DNS somewhere down the line isn't functioning correctly.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .