5

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching for op69okl seems like a username of a porn account.

To clarify my interest in this question: I am software developer, but I started doing reverse engineering and learning more about malware recently. So I am still too noob to approach this systematically.

Requests comes from IP addresses in China, almost all IPs are different and rarely repeat. Since IP are so different it leads me to believe they are bots. I suppose they could be probing for a vulnerability and expecting a certain response. In my case my server (which is not running any common framework) is not returning 404 to this request, but rather reroutes to a default page. I wonder if that's why the bot keeps trying my IP?

I am curios how to investigate this further. I am currently learning how to catch malware, I am thinking as a first step to map out IP addresses of the incoming requests and get more insight where they come from and how often (it started 3 days ago; not very frequent). Then I want to setup a new server and see if I can "catch" the same request again. WordPress or another common framework would work OK for this, I think.

What else can I do to investigate this? I am taking this as a real life learning opportunity.

P.S. I am very curious why the bot is passing the ?name= like this. Would love to find out.

  • There is not much to investigate on your end if there isn't a vulnerability. The attacker is testing for something. What that is is not obvious. – schroeder Mar 22 '18 at 16:50
  • At first glance it seems that someone is testing for RFI, but I can't tell why he is trying with this particular path and param ("/op69okl?name=") since it doesn't exist on your side? Are all the requests in this form? – game0ver Mar 22 '18 at 17:35
  • @game0ver Yeah, all requests I've seen so far are in this form. At schroeder: I saw this page and the answer, but it's nothing substantial I think. – Serge Poele Mar 22 '18 at 17:46
  • @game0ver Would it mean that those sites like http://www.ntdtv.com are potentially in control of the botnet owner? – Serge Poele Mar 22 '18 at 17:55
6

This answer:

https://stackoverflow.com/questions/48512927/apache-random-ips-in-access-log-trying-to-execute-scripts

suggests it's a probe from the great firewall of china, looking for gateways that allow folks to get out to blocked sites. I can't verify empirically but it seems plausible for those domains to fit that category.

It could be interesting to try to return the contents of those domains and see what the robot does in response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.