For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of:
> 220.127.116.11 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-page-path/?bb=uNiX:AAAAA...AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA|http://freebsd-edgewall-com-ae4e4c5d20.a.paceunit.net HTTP/1.1" 502 150 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15"
All of them originated from the same IP address. I could easily block the IP from trashing my web server, but I am genuinely interested in the nature of these requests.
Which platform has a request format like this?