1

I host some simple services for my own use on a commercial shared hosting server. These URLs are cryptic and not easily guessed, and the query strings tend to be long and cryptic. The web services are hit automatically (sometimes manually) numerous times per day, from either my premises or from cron jobs on the host (I mention this mainly illustrate that there would be a potentially large volume of encrypted queries to analyze). I switched my hosting to HTTPS-only about two years ago, so all website paths and queries should be end-to-end encrypted, with only the domain name leaking.

Sometimes these URLs are sent in the body of email to me, invoked from within the service script and using an email account at the hosting company (using the same domain as the script for the email address, fwiw), sent using secure email.

My incoming email provider (a large tech company that offers email accounts) is also using secure email in transit to me.

Email is often not encrypted at rest on mail servers from what I understand, so could potentially be available to employees at either my sender (hosting / email) provider, or my receiving email provider.

Recently, I have seen a small number of hits to my web services from unknown IP addresses, and client HTTP characteristics that aren't me. The odd thing is that they use the correct full path of the URL, but the queries are oddly distorted: they have the correct number of terms, key lengths, and value lengths, but the key names and key values are gibberish.

For example, if my correct URL for a query is: https://example.com/obscurepathname/obscurescriptname.html?qwerty=3141&a=STACKEXCHANGE&qqw=poiuyt

...the probing URL could be: https://example.com/obscurepathname/obscurescriptname.html?dvorak=5926&y=MNBVCXZASDFGH&cvb=sdfgh

I've checked all the permissions on my shared server. I don't believe another user on that server can be accessing my files. A hosting company support employee could however, or someone who has infiltrated the hosting company at some level, either hosting or email. I've seen no other indication of breach at my premises or at the hosting or email providers.

Given that the URLs originate from a couple of different locations, but pass through the same email path would favor the breach being email and not hosting or my premises.

It seems to me that either someone can partially sniff my full URLs, and determine query structure but not content. Or that they can sniff the full URL with query but choose to probe with alternate query keys and values. I don't see any 404s that would indicate probing of other non-existent pathnames or incorrect query structures.

Two questions:

  1. Is this pattern of probing my web site something others have seen, and if so, what is the purpose of mangling the queries or what is the limitation in fully observing the query terms if the full path can be observed?

  2. What seems like the most likely avenue for the breach, from among those I've outlined above, or from another I haven't thought of?

P.S. This question seems more like security than webmaster to me, and includes elements of hosting and email, but please advise.

  • 1
    What do you mean by “secure email”? And some email providers will automatically scan links in your emails for advertising/tracking/antivirus/etc purposes. I doubt anyone is personally targeting your emails. – Steve Nov 12 '18 at 1:59
  • ssl:// port 465 for outgoing. This could well be automated sniffing, but for an email provider at either end to sniff URLs from the body, mangle them, and then hit those URLs would be quite egregious. Somewhere there is a bad actor, perhaps in one of the SMTP relays. – pseudon Nov 12 '18 at 2:09
  • My receiving email provider could be sniffing email bodies for fraud, but to then mangle the URLs and hit them? That seems bizarre. My receiving email provider is based in California. The unwanted hits are from different hosts in France. It seems to me that the responsible and respectable thing to do would be to put a reason and/or link in the User-Agent if the probing is legit. – pseudon Nov 12 '18 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.