This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than a single hit and it should only be accessed via a link from one page which contains
rel="nofollow". The URL calls a PHP page whose sole purpose is to redirect to other websites based on the
id= query parameter. The page's URL is
The above link has also shown up in the logs in other forms:
/linkredirect.php?site=www.ausetute.com.au&id=266%25%27/**/aND/**/%278%25%27%3D%273 .. there were about 50 different iterations of this - which is attempting sql injection - but I can't figure out the purpose of it. /linkredirect.php?id=434&site=www.premieresurgical.com ... this is an invalid link - the id=434 is valid but the "site=" query is invalid
I participate in Project Honeypot and some of the requests are Suspicious & Comment Spammer.
The user agent appears to always be:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/536.28.10 (KHTML, like Gecko) Version/6.0.3 Safari/536.28.10 ... or something similar
Perhaps unrelated, my error log shows two attempts at what appears a hack attempt at accessing one of my directories
[Tue Mar 04 21:32:12 2014] [error] [client 220.127.116.11] Directory index forbidden by Options directive: /home/myusername/public_html/
What kind of attack is this and what is the purpose? Why bother with repeated attempts to the same link? Is my use of
id= as a query parameter an invitation for malicious code to attempt to exploit?