I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP POST requests to the index / from middle eastern IP addresses (Afghanistan, Iran, Saudia Arabia and a few insignificant Asian countries). The acccess_log shows that every few minutes I'll receive a burst of HTTP POSTs from an IP address, such as - - [26/Jul/2016:04:54:43 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:44 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:45 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:45 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:46 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:47 +0000] "POST / HTTP/1.1" 200 147 "-" "-" - - [26/Jul/2016:04:54:47 +0000] "POST / HTTP/1.1" 200 147 "-" "-"

I was really curious what these servers were sending to me, so I thought to make a PHP script that would log the data sent in these requests. What I discovered is that there was no data contained inside the POST request. The only data present was a single cookie, which contained a cookie name (A random capital letter) but no data.

So for example in the request there will be a cookie named M for example, and nothing in it. The next cookie would be a different uppercase ASCII capital letter.

So, this is really strange I'm really interested what this is. Some of the IP addresses appear to belong to governments, while others don't. I don't know what to make of this, I don't think its any sort of scanner as these do not look like they're testing for anything. I simply don't get it, anyone have any idea what this could be?

  • 1
    Would the capital letters received make some sense when concatenated? May this be a text? Or some base64 Encoding? – Marcel Jul 26 '16 at 6:36
  • 3
    It's probably a status check and it won't send any more useful data after unless you return the expected value. Maybe check with some of the honeypot operators or the internet storm centre if it's something they've seen before. – wireghoul Jul 26 '16 at 7:05
  • What is your IP? Maybe your Linode VPS IP address is a known Command and Control IOC – user118547 Jul 26 '16 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.