I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like this: Утром ÑÐ...) The URL that was reported was URL encoded, I had to decode it twice and this is the (anonymized version of the) result:

http://www.example.com/?param1=value1 [PLM=0] GET http:///?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com//?param1=value1 [PLM=0] GET http://www.example.com/?param1=value1 [0,9536,24405] -> [N] POST http://www.example.com/?param1=value1 [0,0,25521]   0 

I have tried searching Google, but all I find are others asking basically the same thing going back to 2008. What is this?

  • 1
    I don't see value1 ever being used in an attack, perhaps these are overly anonimized? I don't see enough information here to answer your question.
    – rook
    Commented Nov 5, 2013 at 16:33
  • That was part of what I anonymized. The part of the URL that looks like legitimate addresses would have been valid at our site. The things in square brackets and the litteral GET and POST are what I find strange. (plus the fact that the otherwise legitimate pieces are repeated.)
    – TecBrat
    Commented Nov 5, 2013 at 16:54
  • this question is currently unanswerable. The contents of the url they are trying to load maybe a key information. Voting to close.
    – rook
    Commented Nov 5, 2013 at 17:00

1 Answer 1


It looks like the attacker is trying to get your page to spit out some information, such as the full path of your webserver.

For example, if you start using multibyte data in most functions (in PHP at least) which don't start with mb_* then it will throw an error, something along the lines of:

Function does not accept Mutlibyte characters in "/var/www/site/script.php" on line 132

Which then gives the attacker a lot more information about your server, which you don't want them to know.

You can mitigate this by turning error reporting off, or have your own error capturing mechanism.

Not the answer you're looking for? Browse other questions tagged .