5

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching for op69okl seems like a username of a porn account.

To clarify my interest in this question: I am software developer, but I started doing reverse engineering and learning more about malware recently. So I am still too noob to approach this systematically.

Requests comes from IP addresses in China, almost all IPs are different and rarely repeat. Since IP are so different it leads me to believe they are bots. I suppose they could be probing for a vulnerability and expecting a certain response. In my case my server (which is not running any common framework) is not returning 404 to this request, but rather reroutes to a default page. I wonder if that's why the bot keeps trying my IP?

I am curios how to investigate this further. I am currently learning how to catch malware, I am thinking as a first step to map out IP addresses of the incoming requests and get more insight where they come from and how often (it started 3 days ago; not very frequent). Then I want to setup a new server and see if I can "catch" the same request again. WordPress or another common framework would work OK for this, I think.

What else can I do to investigate this? I am taking this as a real life learning opportunity.

P.S. I am very curious why the bot is passing the ?name= like this. Would love to find out.

7
  • wordpress.org/support/topic/is-there-404-spam
    – schroeder
    Commented Mar 22, 2018 at 16:47
  • There is not much to investigate on your end if there isn't a vulnerability. The attacker is testing for something. What that is is not obvious.
    – schroeder
    Commented Mar 22, 2018 at 16:50
  • At first glance it seems that someone is testing for RFI, but I can't tell why he is trying with this particular path and param ("/op69okl?name=") since it doesn't exist on your side? Are all the requests in this form?
    – game0ver
    Commented Mar 22, 2018 at 17:35
  • @game0ver Yeah, all requests I've seen so far are in this form. At schroeder: I saw this page and the answer, but it's nothing substantial I think. Commented Mar 22, 2018 at 17:46
  • @game0ver Would it mean that those sites like http://www.ntdtv.com are potentially in control of the botnet owner? Commented Mar 22, 2018 at 17:55

2 Answers 2

6

This answer:

https://stackoverflow.com/questions/48512927/apache-random-ips-in-access-log-trying-to-execute-scripts

suggests it's a probe from the great firewall of china, looking for gateways that allow folks to get out to blocked sites. I can't verify empirically but it seems plausible for those domains to fit that category.

It could be interesting to try to return the contents of those domains and see what the robot does in response.

1
  • If this is some state sponsored effort, replying might get you identified as a site that can be used to connect to other sites and might get you blocked for Chinese users.
    – gnasher729
    Commented May 20 at 14:28
0

You could always set up rules for the server to always refuse incoming requests to your server, or, as you mentioned, you want to set up a honeypot you could use a proxy or some sort of application-level redirection to achieve it.

1
  • I think the attack is to possibly abuse open redirects Commented May 20 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .