I see some strange (suspicious?) http requests in my webserver.


192.161.x.x - - [14/Mar/2014:21:55:36 -0300] "GET /ce/c02i.html/RS=^ADAD3F3nOTvuESWLtAiP39aTQZiSRQ- HTTP/1.0" 404 881 "http://example.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" "-"

The common pattern seems to be:

  • A valid html page is requested, but with an extra /RS=^ADA.... string attached, which makes the request invalid
  • The string following ADA.... (seems to be some hash) varies
  • The referer seems faked, it's always the true domain (replaced here by 'example.com'), which actually doesn't have links to those html pages.
  • The requests come from different (unrelated) IPs. Normally this is the single request coming from that IP.
  • The user agent is always exactly the same as above - fake, I guess.

The only mention I found was not very informative. Is this some known exploit attempt?

  • I have found this running for the last month at about 20-50 requests per-day. Matches your common pattern perfectly (i.e. referer faked). I guess I'm going to do some mod_rewrite (URL Rewrite in IIS) and cause infinite redirects or drop a 500. Any luck on figuring this out?
    – MikeMurko
    Mar 23, 2014 at 14:39

1 Answer 1


It's a drive-by attack against some obscure CMS, and it appears your site doesn't run that CMS, so I wouldn't worry about it. Some bot is just trawling the web and blindly looking for pages that might be exploitable. This is likely why the Google search mentioned in the link you provided points to so many junk/spam pages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .