10

I'm getting logs like (using Apache server):

119.131.152.148 - - [20/Apr/2016:18:17:47 +0900] "HEAD /?MDY0MDc5OTQ5NTE4MDY3OTY0MzcwNDMxODU2ODUxMTkwNzEyMjY5OTA0MDI4MTQ0ODYxNDE3NTAyODYyMjEwMzU5MzcxMDIwMzY2ODM2OTQwODk0MjI5NTk1MTk0Mzc2NjI2NjE4NDg2MzQ0MzkwODg3OTA0NzE5MTA0Njc3ODQxMzA2NjA5ODY0NTExNTQxMDUwMzM0MTgxOTQxNzIxNjEwMzA0NTk4MTQwODQ0MzQ3NzkwMDY1NzExMjM4NzEwMTQ0MjM4NTYwNTUwMDY4MTU2MDEyMjkwNTYxOTEwMDU1ODAwNTMwNTc3OTc2NjQ3MTkzMDA3NDQ2MDE3MzY4NDAzMTExMzU0OTc2NzYwMTkwMTU1NzAwNTE5MTQ1NjY2MzYxNjIzODQ2NDMzMDA4NTE0ODc2NzE3ODgyNzkwMTYxODQzNTI0MjkxMTg0ODUwNDg1MjE2NjU0MTQyNDYxMTI5NzQ4MjAyMDcwNzMzMTIzNTE5MzI0NzU3NjExMzQwOTUyNTg5MjA2MTEzMTM1MTA0NzIxNDA5NTUxMDg1NjA1NzQzMDYyNjg4MDYxMDEzMjIxMzU2NzEyMDk4NDA1MzYyMTg0MjY5OTQ5ODA5MTIzNDYwNjAxNjA0MTYyODE0MTkwMTQyMTMyODA2NTQyNDI1MTQxMTQ0MTI4ODMxMDU5MTU1ODc1MDE1MjEyMDA3NjYxNDcxMzYzNDgwMTQwMTk2MjUwNjA1MTc4OTM4NzYwODAxMjE2Mzg0MjAwMTM2Mzg1MTIxMjQ1MzE4ODYwODEzNDU3ODIyMDA2MjUyNjEwMjAyMDIwMzY3MDUwMTIyMTE3MDU4MTQxNzg2NjgwOTE4NTg2MTc0OTkwMDYwMzU1NDIzMTE5MTg2NDA3NTEzNDU3NTcyMDgxMTQzMDU1ODUyMDQxMTMwMjEzMjExMTIwODU5ODExMjQ1NDY3NzAwMTY1MDg3ODg0ODA3NDM0NjQ2ODMwNTQyMjgyOTAxMTYxMTk0NjA2MDE2NDM1MDg2NTYxODMwOTI4MDI5MDYyNzA1NDkzMjAwODczNzQ5NjIwODI0NDk0MjUxMTg5ODI5NzU5MzAwMDAxMzU2NzcxMjYwMzI0MTIyMDQ3OTcxNzYwMjE2NDEwNzM2NjQwMjY3MDc4MjUwMDM3MjE2MDgxMTA0NDY1NDIzNDYxMTQ3NTIwMzcwMDMyODUzMTgxODA4NTM0NTEwMzExOTU1NDI3NTIyMDUyNzQ5NDc2NzE5OTg2MDUyNDkwMjcwMTA0MjUwMDk2MzQ4ODY4NTEzNTY0OTc0NDgxNjExMDAxODE5MjAzODA0OTkzOTA2NTA4MzU0MjMxNzE0MDcyNDk5MDQ2MTEwNjk2MjE0OTAxMTkxOTYxNjg5NjQwMTgwMjA0NjE0NDc3ODEwODgxNjM1NDkwNzc3NzM2MDgzMDkyOTA4MDU3OTE5Mzc1MDAwOTMxMDIxODY4ODY3MTExNzc3MjAwMjEzNzQzMDg5MTkyMDM3MTU2OTI0MjEzNjQ0NzIxODAzMTE3MTIxNTYwMjAxOTAxMDI4MTAwOTI3NjU4MzA5MzgxNDkyMDcwMjE3NTQzODM1MTk0MDc2MDgyMDA4MTk3MDMyNjQwODk5MjE0ODYyMjE0MzAxOTEyOTAwODI3NzAzMTQwMjU4NjM0OTUwMTQzNzUyMzgyNTExMjMzODQwODEwODkyMzQzMDgxMDI3MjE3ODY1MTA2NDg0NTczNzUwMjg3MDExMjA4MDIxOTkyNjIxMDA3MzY0ODg2NDAxNTg0MDIzMTg2MTI1NzkwNTM5OTE0MzcxOTA2MzEwNjU3NTAwMTI4MTcxODE2NzU4OTA1ODEwNTY0NzEwNTUyOTEwMTE1MTYzNjgyNTgxNDE1OTA1NjM4NzkwNjU2NTI1OTAwMDEyNTY1MTUwMzEzNTgyNDM0NjMxNjI2NjI1NzU5MjA2NTc1NDI0NTA1Mzg1MzExOTYxNjg2ODkzMDkz HTTP/1.1" 200 6014 "-" "-"
106.39.78.2 - - [21/Apr/2016:19:35:47 +0900] "HEAD /?MTM2MzI5ODYxMTA3Nzk1NzU3ODAwNzk1MjI3MTE4MTk2MDk4NzE0ODAxMzQ0NTQxNzIxODQyMjUyNjM1MDI4NzYyOTI5NTA1OTUyNjY2MzAxMDg1NzU5OTkyMDgyNzYzNzM4ODAwNDM0ODc0MjYwNTU3MDI5MTQyMTA5MjY5NzAwMDA4ODQ5MDcwNzYwNDIwNzU2MDI2MDg0NTM0ODc2ODEyNTMyNjQ1MTEwMTQyNjYzNzczMTIyNTY0MDQzMzA5MDMzNjY5MTgyMDEzNDQ5MTE4MDAzNDc1NjYyODA1MTU0NzU5MjkwOTg4NDYzNTEzMTk2NzEzNjcwODIwMDg2NzM1NDYwNjAzMzU2MDk4MTQxMzc4NjcxMDAzOTQ4NDI0ODAxNTM4NDE3Mzc0MTA4NTYyOTMxNTAyMTI0NzQxODAxNDQ2MzAzMDA4MTg4NjQxMDkwNzA1MzAwMjM0OTIwMDY3OTIwOTM2MTQ5NjgxNjk0MTA1NzY1OTEzMDcxODc3NDgxNDA5MDA5MzU3ODM0MDA4Mjk1NDk5NzUwODM1NDE0OTc0MTM0NDE1ODExMzEzMTg0NTM2MjgxOTYxOTY1NTU4MTU1MTIyMTkyMTE5Nzg1ODQ2MzkyMDQ5NDI3Mzc4MDI0MjcxNzY4ODA3MjI1ODc1MTgyMDc5NzQ2MzIzMTQzNDU4NTEwNTA5NzY4OTI3NjYwMDkzOTUxMjUzMjA4OTI4Njc5MTEzMjg1NDE5ODMwMjY0MDk5ODUxMTk1NDI0NzI1MjIxNDEzMzQwODcwMjczMjY0MjczMTIzODg5NjUzNzEwMjEzMjYyMzIwMjAwNDI0MTUwMTY5NDgyNjI2NTE4ODk0OTE3MjAxOTc4NDk2ODkzMTI1ODIwOTc4MTEzNTM3Njk3NDAwMzU0ODgzNTg0MDM1MjgzNTA5MDE0OTYwMTU0NzQwNjc2NjczMjA0MDQxMjY2NjAxMTExMzIwNjIwOTMwMDczODE2OTQzMTE3ODAzNDE0NDA4MzgwODIxNjIxMzQ0NTA1OTQ4MTE3Mzk4MTYwMjA0MTU5MTQ3ODcwMDMwMDg4OTA3MDcwMTQxMjM2NzExNzEwNjkwMjIxODE5NzM4NjA5MTYwNjE1NDY5ODE3OTg1Mjc4NTcxMzgzMDY1MDYxMTM1MjM1MTc1NTE5NDQ2MDc3NjMxMzQ4OTY1MTU2MTk1MTMwNDczMjE2OTAwNTMzMzYwNTgyNzQwODY3MTYwNDIxNzEzNjEwMDIxNjU0NTAxOTU1NzA3MzkwMDYzNDk5MDgyNDE3OTY4MTU0OTUxNTc2NDQ1NTU1MjEzMDk1MjMxMjAyOTMwMTIxNDAwNjI0ODE0ODk5MTY5NDU0Mzc5NDIwMzczNjYyNDUxMzc0MDU1NjkxMTQwMzA3MzExOTEwMjE5MTkwOTQxOTkyMzE0MzIwMDAyMDEzNDMxMDA5MTEyNTI2NDcwNDkwNDU5ODIxMTA2NzA3NzU1MDA3ODAyNjU2NTAxNzI1NDE5MzAwMDI0MzE3NTM2NjA1Mzc0ODQxNzAxOTk3NzQwODU3MDUyODE2OTE4ODAwODg2NzE1NjcwMDkwOTYzODYzMDU5NTQzMTgzMjIwNTMzNDE2NzMxNTU2NjQ1NjI0MTE1MzQwMjA3NTA1NDkwMTQwMDUxOTUzNDQ1Nzg1MDA5MzkzMjMzNzA5NTU5MzI1MjIwMTI5ODk2NjQzMDI2NTU5MzIwMDA1NDMwNDMzMjAxMTg4NzUwMzE0MTkxNTU0NDA0MDExOTA1MTI5MzcwMTIyOTAyNjQ3MTU1Mjc1NzY1NTExNTQzNTIyMjAxMjgxMTg2NDI0MDQ0NTY4MjkxODAyMDMwODE1NzkwNzc2NjA4NzYzMTUzODIzNDM4ODEzMzIyMTc0NDUxMDMzMzU1MTE2MDg1ODUwNTMzNTA4ODQyMjcxODIwOTA5Nzg3Njg2MTAwNDgwNTIxNDEzNjEwNDE3NzAwNDY0NjgxMjgw HTTP/1.1" 200 6043 "-" "-"
112.5.236.7 - - [21/Apr/2016:23:30:15 +0900] "HEAD /?MDE5NjIzNzMwNDA4ODEwMzU1MTEwMjU3ODQ2NTE1MDEwNDMzMzAwMDAxODI2MDA3NTYxOTkzNTM1OTczMDQzOTY0Mzk2ODAyMzc4MjIwMjQwODMyNjcyMTAzMTI2NTExOTk3MTE5NDg1MDc0OTYxODMxNzM0MDQ1MDM1ODMzNDQ4MDA0MTA5NjIyNjkxODA2MTcxNjEyMDM2NDM2MTA1ODAwOTUwMDQ0ODkxMTQ3NTA2ODUyMDE5ODUyMjg1MjA0NTA1MjM0MzcxNzYzMjkxNTgxMTQzMjY4MjQ4MzA3MjUyNDEyNzAxMTE4MDUxMTQ0MDc3MDAxMDU0NTA3MzkyMTg0MjkxNjg1NDg3MDg0MTI0MTgwNzY2MjE3MDEzOTI3NzcxMDU1MzM1OTM0MjEzMDMyOTk1ODEyNTA2NTk5ODAwODUyMDIxNzMwMDM3NTEyOTk3MDA0MTg5NzkzMTkxOTE0MTE0NTkyMTczMTI2MjE4MTAxNjU4NjI0OTUwNjM5NTQ1NTE2MTIzMTI1NDEzNTE4ODI0NTI5OTkxMjQ1NDI2MjYyMDQ4ODEyOTU1NTAyMjc0MzcyNDgyMDg5MjgzNzQ1MDk3NDMwNTk0MTAwMDUwNzAyNTAxNjE4MTM0MTU4MTIzNjc0OTUwMDAzNDM0MjQzNTIxNTU1NjU3Mzk0MTQwMzQzMjExNTIxNDI5MzgwOTYxNTAzMjg0MjQ2MDA5ODk2OTYzNDA5MTEwMzg0NjgwMTU1Nzk0MjQxMTI4NzI3OTAxODE0ODE4MDYxMDIxNTkwODY1OTc0MDMwODA0ODg4OTEzNDUzMTk5NTMwNjgzOTEyODk0MTkyNDgxOTgxNjEyODIyNzM2NjAwNjk3ODQ3NTE2MDk3OTcxMjMxNTIxMzA2ODgxNTcyMTM5NDY2NTk3MjAzOTU0MDY2NzA3ODA1ODI1MjQyMDc2NjI1NjQxMDUwNzk2MTMzNjExMTQ3NTIzNjQwNzE1NTU0MDg1MDUxNzg2NTMxOTA5NDQ1NTI5MjgwNDk3ODA0MDIyMTE3NjI1MTA0NjE5NDMxODgyNTEwNzM0MTQ4MTc5MDA2NzM1MjkyNjAwMDUwNTgxNjIxMzU3OTY4NDI1MTY0NzE2MjE4NzA3MjY4OTc4NDMxMjU1MjA1NTMxMTQ5NjIyMTEzMTAyNzYxNjAzMzYxNjU1NDI0NDk4MTc1ODMyMDM1MTA0NDM5ODMxNjMwODMxNTQwMDQwMTE5NjE2MzE4OTA5MjMyMDUyNDYwNTM3MTMzMDQ2MDU2MTUxMzM2ODA3MTA3OTMzODYxMDkyNjQ3MjM1MTM5MTQzNjIyOTIxNDIwNzcyNzMwMDIxODY1NzQwMTYyNjE1MTIwODEzNDQ2OTI0ODAxNzEwMzI1NDc1MTYyNjUxNTQwMDA4OTU0NzA3NzkxMDI4MTg1NzMyMDc4NzczMDE2MTE3Mjg1ODc5NjIyMTEzOTY5MTg3MTgwNTQ3Mzg2NjAxMTEwMjc5NzIxNjg2MTAxNDk4MDg1NjcxNzc5NTAyNDA2OTU5NjMxMzQwMjYxNzkxMTQ3MzQyODExNjAyNzc2NTc2MjkwNTU1Mzc1ODE3MTU5MDEyNTYzMjE2MzA5NzQ4MzExODU0NTI3ODIxMDQ4NDA0MjA5OTAyODEyMjAzMTYwMzM2NTk5MzYxMTI0NTA4NTYwMTE0NTkyODE3OTQwMTkxNTQ3MTE4MDE3ODQyMTAzOTIxMDM4MzU1OTgwMjMzNzU5NTQyMTU1MjY0MDQzNDE5MzIyOTg0NjQxOTQ4NTk0NjI1MDcxMjI4MjQzOTA1ODg2ODUzNjUwODA3ODQ5MzI5MTc5NTEyNjU5NzAwMjA2NDY3ODcxOTc4OTEwNzExMDIyNzAxOTc5OTA3MDg0OTA5NzAwNjk1MDU2MDIxMTY4ODkzODk1ODIxMDAzMzAxMzIwMzMyOTU1MTkxMTI5MjkyMjE4OTAzMzk0NDUzOTQwNjgyNTA5Mjgz HTTP/1.1" 200 6043 "-" "-"
124.89.33.132 - - [22/Apr/2016:08:14:46 +0900] "HEAD /?MDQ2MDAxOTU1NzE3OTk3NDM2NTIxNTU0MDAwNDI4MTY0MzI4MzMxNzA2OTkzOTkxMzYyMDQ0MDI4OTM4MTA0MTE4NTU0OTE3NDM1MDc5MzkxODE3ODgwNjM0MDIzODYxMjk5NDAzNTA5Mjc3NzUwMTQ1Mjc0Nzk3MDUzNzgzMDA5NjA1OTc4OTg4NTQxNTMyOTcyMzkwMTQzMzg2MzUzMDAxNTY1Mjg4MjMwNjk2MDEyNTQ3MDk0MjkyNTgwMTAwMjQ1MTg2MzUwNzU2NjI2NDE5MTE5NzQxMzk4NTA4NDE4ODIyNjAwODg0NzQxMDU1MTM1MDY2NzE5MjA1NjQ3NDg3ODIxNDk5NTI1MjQ1MTE4MjA0NjMxMjE2MTgxNzE1MjUwMTgyMDg0Nzc4MDM0NzYwMzE3MDAxMTA0MjYyMTAwMTcwMTM4NzY0MDY1MDU3OTE5ODE0NDczMzY2NDQxOTE2Njc0NDkxMDg0OTY0Nzg5NjAwOTAyNjI2MTMwNDU3MDgyMzk4MTYyNjEyMDY0MzAxNzA0MDI1ODgxNzgxMjAzNjQzMDYwNTU1MDk5NDAwODk0ODk5MTIxNjUyNzUxNzkzMDA0ODI2ODY3NzEzNTg4NDA5MjEwNzA3MjA3MDIwMDk4ODkyNzE3NDAzOTYzODE5OTcxNDI4NjY3NjIyMTUyMTQ0Nzc2NjA1NzA5MzU4NzcxOTI5OTYwNDUwMTI1NTI2MDA1NDE0MTAwODkyMTkwOTU3ODYxMzkyMDY2OTI1OTM3MzAyOTI2MTYxMjUwMTM0NjUwMzU0MDU0NDUwMzY5MzIwMDY2MjI4ODQwMTI1MzM2NDE0MTYzNTc5NTg1NjIwMzg0OTM0NzEwMjQwNTAxNTY1MjEyMjYxOTY4MDIwMzQ3MzQ1NDUxMjk4MDQ1ODU3MTc2Mzc4MTU0NjA1ODQyMTU2MzQwMDY2MjY2MjEwMDIzODkzMDE0OTE0NjQyODg4MDUyMDAxNTk5Njk0MTEyMjkwNjQyMzA1OTE4NjI5OTEwNzUyMzkyMzQ4MTM3OTQ3MjkwOTEzMDIzOTg1MTUxMzUzMzkxNTA4MDc5MjMxODIyNTAxOTMxMTkxMzgxMjIxNzg5NTI4MDkwMDkwMDgwMzA5NzM2MzkwNTExNjg2OTczOTgwMDM4NzY2MTk2MTE1NDI4MDI3OTEwMDM3MjQ3NDI1MDk1ODgxMzA5OTAxODAzODg1MjMxOTQ1MTMwMTM1MDMyMjQzMjA0NDEwODE2MTY5NTAwMzExMjYzMzUxMTY1NTg2NzIyOTExMTcyMzg3ODUwMTk4NDgwMDg4MTQxMjI1MDIyODAwNzMxMzI2NDQxNDcxNTkwMDIzMTU1NjY0NDgxMDEzNzI2MjkyNzUxOTU5NjUwMDEwMTM2MjQwMTQxMjEyODI1MTc2MTcxMjU0MTMwNzE5MjA3NTg0NDQwMzAxMzIzNTM2MzEwODE4MjI2MjI4MDIwNTQ2OTA0NDE0MzcyNzAxMTExMTM3NzAxMjU3MDkyODc0MjQ5MzE4OTk2NjkxMTUxODEzNTAzNzQ2MTA1MTAzMDUzMzA3MzQ4OTUwNTMxMDY0ODU0NDIwMDcwMTAxMTIzMjE3MzQ5NTc3MTkwNDkxOTMxNzU0MTI2MDc5ODQzMjA4MDQ5Njg0NDcwNDAzODI3MTExMDI2ODYxOTcyMjIwNjM5ODE3NTIwMzgyNjcxODU1MTY5MDMzNjM0MzE2MTQ1MjI4NDExNjIyMTA3ODUzMDU1MzkxMjI2MDIxMTQ3MDYzMjgxMjI5MjY1ODcxMjAyOTI4NTEzMjEzODMxNTcwNjIwOTY3OTczNTEwMTQwOTYyMzE2NTE2ODU5ODMwMzgxODM4NjA1MDgxMDQzMjg0MzI2MTA0NTkzMDEyMDUxNDEwNDQ5MTYwMTM2NjUwNDg0NDA3NTMzNDQwNTUwODkwNjAyMDU5MDgwNzQyODg3ODE1NDExNzMxOTgxMzI5NDMxNDgy HTTP/1.1" 200 6222 "-" "-"

From many different IPs, all from China.

What do they want to achieve? It doesn't look like a DOS attack as they are not so frequent and they are not timed in any apparent way.

My first thought was that they may be trying to exploit a buffer-overflow bug, but its not long enough to even reach the default apache limit of 8190 characters.

Any thoughts?

UPDATE

Now I'm starting to think that the parameter is just to prevent caching? But then, why is that long? (time stamp is enough).

UPDATE (April 24th)

I analyzed my other logs and found out that not all came from China. From a sample of 1913 different IP addresses, 98% where originated in China. Other countries where: USA, Italy, Japan, Russia, Taiwan and Netherlands.

As the logs above, all of them contains no further information except for this one (which could bring a little of light to this case):

107.178.194.119 - - [03/Mar/2016: 09: 44: 20 +0900] "HEAD /?MDQ1ODE1MDMzMjE2NTk2MzEyNTUwNTc1ODg0MDE2MDk2NzM4OTM0MzE5MDY5OTg3NzgwNTkwMTQ4MTg1MjA5MzgyMTQ3MTAyNDkxOTU2MDIxODk0NjkzNzQ0MTUyNzA0NTg0ODIwODk1NzM3NTcxNzE0ODI5MTA4MDgyODAzMTQyNjEzNzEzNTQzMjAwMTY1NDEwNzMxMTU4MjE4NjYyMjExMjE5MDk4MjgwNDM5NjE5NTA3MTYyOTg3MTg3NjAxMjkwNzU1MjAwMjA2ODkwNDM4MTM4NDI5OTcwOTA2NjYyOTg4MjQwODUwMDgzODYzMTkyNjQ0NTIzOTEzNzI0MDQ0NDExNDcyNjM5NjE5MjAyNjI1MzA1MzA1MjA2OTg3OTAwNjI1ODk2MTI2MTgxNTEyMTYxMDE4NzAzMzA1NDEyMDYyNjEwOTYzMDk5NDQyNjk3ODE2NzQ2Nzg2MzgxMDU2MjgzMDEwMTQ3NDE4NzI4NDA2MzE0NzI0MjkwNjYxNzA2MzU1MDMxNjYzODU0NjAyOTA5MTQ5MTgwODU2MTkxNjQ4MTAxNTU5MTMyNjA0NDY3NDY2NzMxODAxMTc2NDk0MTk3NzU2Nzg5NzE0NzYxNDMwMTAxOTQyNjI2MzA2MDU4ODM3MTczMTEzNzYzNjM2MzExMjg5MzQ2OTEyMTc1MDI5ODc3MjEzNDIxMDQzNjYwNDQ3MjQ2NTY3MDQ3MTEzMzE1MTEyMjEzMzQyNzAwOTkzMzMyNDMxMTg3MzI4MzgwMDExODg0Mjc3NTEwNTM0NTk0MzM3MTI2NDk5MjIxMzAwNjc1Njg0MTgxODc1OTgwNDU5MTI2ODc5NzYxODE4NTk0MDc4ODUwMjE5MjQzMjE2MTc5OTcwMTc5MjE5ODEwODgwOTUxODQ0MTU5MzI5MTI1NjYxMTM2ODAxMDc5OTkzMzgwNDkwNDM3Mzk5MTkyNTM5Njc5OTEzMTMyMzMzMzAxOTg1NjQ0MjQ5MTQ5ODE4MjQzNzAzNjg3MDgzODMwMjE5NTUyMTUxMTE5NjM5MTAxNjIwOTYzNjA5ODkyMDQzNzQ1MDc4MTY3NzQ5Njk2MDE0Mzc4ODEzMjIxMjkxODE4ODA2MTQ4NDAzMjg2MTAwNjQ4MjI4MzgwNTI4MjI2MTc1MTYxNTM2NDM5NjA1MjMyOTM4MjcwNDUzMzQ0MzY4MDA2Mjk1MDU3OTE3NDgzODcxMzExNTkwNTI4MzI1MDEyNzExMjAxODExOTkxMjk5ODAwMjIzMzQ2NTAwMTEyNzY5NDgzNjE4OTQyNzczNTUwNzM0ODIyNDM1MTU4MTkzMzI3ODAxNzc4NjYxMDUxNjQyNTM4NTYyMDA5ODQ2Njk3NzE0NzkyNDQwMTAxMjY4MzY0MjkzMDc5ODkwOTUxMzE5NzIzODU2MjAwMDI4ODcxMDM2MDYwOTA4NTk2NTExMjA0MzQzNjEwODUyNjI1ODg3MDc3Mzc4MDI4MDA2NzY4OTI3ODQxMjM5NTUwNDA5MDYzODMzMjkwNjE3MzQ5Nzg5MDAwNzc3MTcwNzQzMDU4NDE2MTY1MzE5MzIyNDg0MDQxNzk0NTg1MDQ3MTgzODUwMDY4ODAxODQzMzczOTYxNDU3Nzk0MjY4MTM5MDgxNDk2MTExOTM2NjA3ODkwNTA3MDk1ODU0MTA0NzM5MjcyMTE3OTgyODQ3ODEwMTE0MTAzMzUwMTc2MjI5Nzc0OTAzNzA0ODc2MDEwNjIxOTE0Njc1MTYzMjIxMzM2MzE3NjE5NDEzODUxOTE4NDk0ODg0MDQwMTIwNjUxNjE1NzkwMjk5ODMyMTA2MTIwOTU5MDAyMzQ1NDUxMzA2ODUxMjMzNDgwMjM5OTIwODY1MDQ5OTM1NTEzOTEwMDYyNzg0MzExNTUwMzQzMTEzMTc0ODIwMjEyODE0MzY2NTM5NDYxMDcxNDk0MzQ3MDM1MDk3NzkxNjE2MzYyNjI3NTkxNjExNjM0NzI3 HTTP/1.1" 200 6274 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) AppEngine-Google; (+http: //code.google.com/appengine; appid:  s~chensabinb3f2f1)"

The main difference is:

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) AppEngine-Google; (+http: //code.google.com/appengine; appid: s~chensabinb3f2f1)

Specially the last part that points to some application with some username.

Compare that log with others containing "AppEngine-Google", like this one:

107.178.195.235 - - [13/Oct/2015:22:36:39 +0900] "GET /book-introduction/ HTTP/1.1" 301 545 "-" "AppEngine-Google; (+http://code.google.com/appengine; appid: s~tuxjamz)"

Not sure if its important, but it seems that the "normal" AppEngine-Google requests are GET (instead of HEAD) and the url does not contains an space after "http:" like the "s~chensabinb3f2f1" log. Both AppEngine-Google IPs indicate they are owned by google. For example (hostname):

119.194.178.107.gae.googleusercontent.com

235.195.178.107.gae.googleusercontent.com

  • 1
    The URL parameters seem to be base64 encoded strings containing only digits. Probably just random garbage to reach the length restriction, but still a bit weird. – Anders Apr 22 '16 at 10:27
  • Yea, I noticed that, but somehow it didn't call my attention until you mentioned it. Why would they encode 1500 digits into base64? That's so strange... – lepe Apr 22 '16 at 13:32
  • I searched in all my server's logs and I found nothing else coming from those IPs. It must be used for something really specific. – lepe Apr 22 '16 at 13:37
7

Sending URLs beyond the 2000 [see note] character limit should produce a HTTP 414 error. Common error codes like 404, 401, 403, etc. are often given custom error pages, but less common ones (like 414) are often not. Default error pages often leak server version information, so it's a common trick to get the server to produce a 414 response in order to fingerprint it.

These URLs are just over 2000 characters, so that seems like a likely reason.

You might notice I put a note next to the number 2000. The actual limit is variable across implementations (2083, 8000, etc.), but many common Google results say 2000 for various reasons. The reason to keep your URLs below 2000 characters for normal operation is that some browsers servers handle things in different ways.

Amusingly, since these URLs are just over 2000 characters long, your server responded with a 200 since the default path / exists and the long part is a URL parameter, and it didn't reach Apache's length limit. I suspect whoever wrote the bots that send these requests Googled for "URL maximum length" and chose the number based on the first result, without looking any further into it.

  • I always like your answers. These parameters are 2001 characters long (yea, its strange) so it seems to fit your theory. I will give a little bit more time before accepting your answer (you never know). – lepe Apr 22 '16 at 13:28
  • Let's put this matter aside and see if in the future I can get more information about it. For now, I will accept this answer. – lepe May 13 '16 at 1:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.