2

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries:

65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET /calendar/caldetail/id/281/num/1328144400 HTTP/1.1" 404 439 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

66.220.158.115 - - [05/Apr/2014:06:19:08 +0000] "GET /media/u1485/album/pic_1485_3218_original.jpg HTTP/1.1" 404 443 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"

There were numerous other entries similar to these.

The strange thing is that it looks like they originated either from Facebook or Microsoft servers. Both provide identifying information as well as IP addresses that appear to belong to the aforementioned organizations.

I do not have any URLs that look even close to those found in the GET requests. To give some background, I bought the domain something like a month ago and AFAIK it was not used before.

Can anyone shed some light on the possible causes of these requests?

Improve this question
4
  • Do you record the value of the Host: header? It may simply be a different domain pointing at your IP address.
    – Ladadadada
    Commented May 14, 2014 at 8:17
  • @Ladadadada can you please tell me where can I check this value? I have some doubts that someone would point his domain to my IP address. My project is pretty new and is not really known.
    – Salvador Dali
    Commented May 14, 2014 at 8:21
  • You can use %{Host}i in your LogFormat directive. The headers are also included in any forensic logs you have. If your project is new, you probably only recently acquired your IP address. Who had it before you? What was their domain name and is it still pointing at that address? I suspect it is.
    – Ladadadada
    Commented May 14, 2014 at 8:28
  • @Ladadadada thanks I add info about domain in my question.
    – Salvador Dali
    Commented May 14, 2014 at 8:35

1 Answer 1

Reset to default
0

As stated at the page linked in the user-agent string, the page is "crawled" because someone tried to share it on Facebook.

Facebook allows its users to send links to interesting web content to other Facebook users. Part of how this works on the Facebook system involves the temporary display of certain images or details related to the web content, such as the title of the webpage or the embed tag of a video. Our system retrieves this information only after a user provides us with a link. You may have found this page because a Facebook user sent a link from your website to other Facebook users. If you have any questions or concerns about any links or content sent by one of our users, please contact us at [email protected].

Maybe someone made a typo in an URL while trying to post something on their wall? Alternately, it is possible that those URLs were valid before you bought the domain (it may have been previously owned by someone else).

Improve this answer
6
  • I am aware that the log from FB can be due to sharing. But as I mentioned there is no URL that are even close to the URL that I see (basically it is completely different). Also there is something strange with Microsoft bing as well.
    – Salvador Dali
    Commented May 14, 2014 at 8:25
  • Well, your URL doesn't have to exist for me to share it. As I said, maybe a typo in the domain. Another idea: did you just buy the domain? Maybe those URLs used to be valid before it expired.
    – executifs
    Commented May 14, 2014 at 8:29
  • I bought my domain recently so it is completely new and it was not used before.
    – Salvador Dali
    Commented May 14, 2014 at 8:33
  • 1
    Or the IP address was previously used.
    – deed02392
    Commented May 14, 2014 at 11:38
  • 1
    I do not have enough reputation here to comment on an answer inline... As said before by others, you should verify which host they are using in their request. Maybe you can use iplist.net/<yourip> to find out if other domains point to your IP address. To be sure your domain has not been used in the past, try to see the history at various whois sites.
    – Filipe Spencer
    Commented Jul 13, 2014 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .