I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like this: Ð£Ñ‚Ñ€Ð¾Ð¼ ÑÐ...) The URL that was reported was URL encoded, I had to decode it twice and this is the (anonymized version of the) result:
http://www.example.com/?param1=value1 [PLM=0] GET http:///?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com//?param1=value1 [PLM=0] GET http://www.example.com/?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com/?param1=value1 [0,0,25521] 0
I have tried searching Google, but all I find are others asking basically the same thing going back to 2008. What is this?
value1ever being used in an attack, perhaps these are overly anonimized? I don't see enough information here to answer your question.