We're looking for help/advice from website security experts. Our company develops web-based process management software and hosts it for our customers. The software sends emails to users when they have new tasks in the system, or reminder emails when those tasks become overdue.

We've recently started seeing probes in the web server logs that indicate something is taking one of the URLs from those emails, partially obfuscating the parameters using a ROT-13 approach, and sending it to our server. Then it takes the response page (usually a sign-in or error page) extracts the page contents, constructs a postback URL with those contents included as parameters, and sends it to the server. Then the sequence ends. This usually happens within seconds of the email being sent, and independent of whether or not the user's email client is active, indicating that it's being intercepted and processed somewhere in between.

There's no apparent danger from this behavior, and at first we thought it might be some kind of anti-malware agent deployed inside one of our customer's environments. The "attacks" would come from one of two datacenters (one in New York and one in the UK), even though the user wasn't in either of those locations, and would rotate through a variety of IPs on specific subnets. However, we just took a new customer live, and we're seeing it happen for a lot of their users, and with the same behavior: probing "attacks" on our servers from one of two datacenters within seconds of sending an email to those users.

Here are the datacenter IP addresses we're seeing the attacks from:

  • - above.net
  • - as29017.net

We've looked but haven't found any reports of similar behavior, and we're hoping that the StackExchange community might be able to give us some suggestions on where to look, or how to proceed with our investigation.

  • Is this explanation of the problem clear?
  • Has anyone else seen something like this?
  • Is it some kind of "innocent" anti-malware behavior, or indicative of an actual attack?

Thanks ahead of time for any suggestions, and let us know if there's any additional information we can provide that would help.

UPDATE: Thanks munkeyoto. We'll look into contacting AboveNet.

With regards to your suggestion, the e-mail is actually successfully delivered to the customer unchanged. We believe something is just searching the emails for URLs to attempt an attack. Once it finds a target URL, in this case our web application, it modifies the URL before using it to contact our application.

Our server sends out large numbers of email each day to many different customers, and this behavior only occurs with two specific sites. Because of that, we believe that the emails are being scanned after they've left our network, somewhere along the SMTP chain. We also don't believe it's in the user's specific email client because it happens even when their machine isn't turned on. And since the probing attacks are coming consistently from two specific subnets inside data centers, even though the emails were sent to completely different customer companies, we think that points to something inside those data centers.

Anyway, we'll follow up with AboveNet and see if they can offer advice.

UPDATE: In response to the question about PHP/WordPress: Neither. It's an ASP.NET application suite written entirely in C#.

UPDATE: In response to the question about how the URLs are modified and probed.

Here's what a normal sequence might look like for our application when someone would normally click one of these URLs from an email (simplified for demonstration purposes):

2013-11-13 22:14:53 XXX.XXX.XXX.XXX GET /ExampleApplication/TaskList.aspx

2013-11-13 22:14:53 XXX.XXX.XXX.XXX GET /ExampleApplication/SignIn.aspx ReturnUrl=%2fExampleApplication%2fTaskList.aspx

And instead here's what we're seeing when the probes occur:

2013-11-13 22:10:23 XXX.XXX.XXX.XXX GET /ExampleApplication/TaskList.aspx

2013-11-13 22:10:23 XXX.XXX.XXX.XXX GET /ExampleApplication/SignIn.aspx ReturnUrl=%2sRknzcyrNccyvpngvba%2sGnfxYvfg.nfck

2013-11-13 22:10:24 XXX.XXX.XXX.XXX GET /ExampleApplication/SignIn.aspx ReturnUrl=%2fExampleApplication%2fTaskList.aspx/FvtaVa.nfck?ErgheaHey&ctl18=Cevagre%20Sevraqyl%20Irefvba&ctl28$SignIn_PageOperationButton0=Fvta%20Va&gas_detectJavaScriptField=ahyy&__SCROLLPOSITIONX=0&%252sRknzcyrNccyvpngvba%252sGnfxYvfg.nfck?ctl10_HiddenField=&ctl28$SignInTransform_UserID=ahyy&__EVENTTARGET=& [truncated for brevity...]

So in both cases a request to the TaskList.aspx page is made. The server responds with a redirect to a SignIn.aspx page (because the user hasn't authenticated yet). In the normal case, the browser agent simply does a GET on that redirect page. In the probe case, the agent modifies the ReturnUrl argument by ROT-13'ing the text before executing the GET. Then it does a second GET with a mostly correct ReturnUrl, but with additional concatenated parameters containing the names of HTML fields from the SignIn page. It almost looks as if it's attempting to use potentially hidden fields on that page to hack into the system via the parameters (there aren't any, and it wouldn't work).

Let me know if this is the kind of information you're looking for. Thanks.


It took a few calls with AboveNet (now part of Zayo), but we were finally able to determine that one of their customers is an anti-malware firm based in the UK, providing services to two of our common customers. They were scanning all incoming emails and probing any hyperlinks to identify potential hazards and/or vulnerabilities in the destinations. They've added our application servers to a whitelist and the probes are no longer occurring. Thanks to @munkeyoto for the suggestion to contact them.

  • 2
    You're a professional business, get some professional help. This is something which should be investigated by an incident response team. Don't get me wrong, there are tons of specialists on here, but this isn't a simple Q&A question. – Lucas Kauffman Jan 14 '14 at 19:09
  • Thanks for your valuable feedback, Lucas. To be clear, we're not looking for advice on how to design our application or protect it from an attack. If our server was explicitly being targeted or we were concerned about a vulnerability, we'd deal with it professionally.We're concerned about the larger problem, that there might be public datacenters potentially infested with something that intercepts emails and scans them for web-application hyperlinks and probes them for vulnerabilities. If you still feel that there's a better forum for this kind of question, let us know. – Grand Avenue Software Jan 14 '14 at 19:16
  • probably some kind of anti-malware/anti-spam-protection. try to contact the dc-owners and ask for explanation – that guy from over there Jan 14 '14 at 20:57
  • Could you give more detail on the "constructs a postback URL with those contents included as parameters and sends it to the server" part? That is, you send /link/to/url123456, the other probes HTTP GET /link/to/url987654, the server replies "No such page", what happens then? – LSerni Jan 14 '14 at 22:55
  • 2
    Have observed identical behaviour from those IP ranges, whole team of us were scratching our heads until I found this excellent question. My thanks to you! And my commiserations for getting the most idiotic "closed as too broad" in the history of Stack Exchange. – Carson63000 Dec 10 '14 at 0:26

If it were me, I would get in touch with Above.net's staff, and if possible

Gyron Admin Team
Gyron Internet Ltd
3 Centro
Boundary Way
Hemel Hempstead
United Kingdom
+44 (0) 845 888 6900
+44 (0) 845 888 6910

AboveNet Abuse

AboveNet actually has a responsive abuse team.

Now to your question. It is a bit difficult to understand what is going on here, via way of understanding the relationship between those two addresses, and your application. This is because no one here can determine whether or not you are in the same network. Technically, no one should be able to sniff out what is going on in your network however, this is worded as if someone is sniffing.

Pseudocode as I understand your problem:

if [ message ]

sent from GrandAveSoftware


grep URL | rot13 | send_to_recipient


If this is the case, this can ONLY occur but 1) someone sniffing traffic on the work or 2) someone injected something into your code (XSS, CSRF, etc). In the first (sniffing), it is network issue that need be looked at from someone able to determine how your network works. (Network engineer, NOC, etc) In the second case, a system administrator (logs, etc.) and a developer needs to audit code and find the faults to fix them.

In any event, I am sure many would love to help, but at best, we are playing a guessing game with the information you're providing.


Curiosity... Are you using PHP, and/or Wordpress?


This is an issue most likely in your datacenter, since that seems to be the common theme (only happens in this one particular place/server/NOC). In that event, I would contact the datacenter with your concerns as there is a huge risk here. (data leakage via way of possible sniffing. In fact skip possible, the only mechanism to do this (sniff an email) would be to either way for traffic on the wire, or have an application sift through directories, look for things associated with email, and intercept).

You may be able to resolve this by using SSL/TLS for email if it is a network issue. If it is a host/systems issue, you would need control (administrator) to determine what application is causing an intercept. If you DO have control (admin privs) you could run Process Explorer, Mandiant's Redline, etc., force an email out, and see the process intercepting mail, or hooking into another application to sniff out mail.

| improve this answer | |
  • See update. Neither. It's an ASP.NET application suite written entirely in C#. Let me know if you have any other questions. – Grand Avenue Software Jan 14 '14 at 23:48
  • @GrandAvenueSoftware Absolutely you should contact the other ISP. Skip the email and pick up the phone. – Michael Hampton Jan 15 '14 at 5:05

I suspect Hanlon's razor.

The behaviour you described is odd, a competent attacker would neither be so obvious as to immediately, traceably and loudly announce their presence, nor would they probe your webserver so incompetently. Like you said, this behaviour won't lead to a compromise.

Maybe there are downstream AV / anti malware systems examining your URLs for signs of spamming / domain farming.

Of course: I am guessing wildly so take these utterances with due caution.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.