Strange escape codes in a GET request - is this a known attack?

Question

I recently came across some entries in nginx's access logs that resemble the following:

##.##.##.## - - [24/Sep/2014:01:21:51 -0400] "GET /767/browser-wars-side-show-ho
w-natty-handles-the-load/+++++++++[+%C0%EA%F2%E8%E2%E0%F6%E8%FF+]+Result:+%E8%F1
%EF%EE%EB%FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22azazalolxd%22;+%E2%EE%F8%EB
%E8;+%ED%E5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%E
A%E8; HTTP/1.0" 400 0 "http://2buntu.com/767/browser-wars-side-show-how-natty-ha
ndles-the-load/+++++++++[+%C0%EA%F2%E8%E2%E0%F6%E8%FF+]+Result:+%E8%F1%EF%EE%EB%
FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22azazalolxd%22;+%E2%EE%F8%EB%E8;+%ED%E
5+%ED%E0%F8%EB%EE%F1%FC+%F4%EE%F0%EC%FB+%E4%EB%FF+%EE%F2%EF%F0%E0%E2%EA%E8;" "Mo
zilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/
35.0.1916.153 YaBrowser/14.7.1916.15705 Safari/537.36"

There were about 10 of these requests within a span of about a minute. I noticed that the requests came from many different IP addresses, though the user-agent was identical.

Is this an attempt to exploit a known vulnerability? Nginx seems to be suspicious and returns an HTTP 400 response. One thing I noticed within the requested path is the string:

"azazalolxd"

That's pretty suspicious for a "random" sequence of characters.

Should I be concerned? The requests seem to have stopped for the time being.

---

Edit: I decided to try unescaping some of the entities and came up with the following:

%C0%EA%F2%E8%E2%E0%F6%E8%FF = Àêòèâàöèÿ
%E8%F1%EF%EE%EB%FC%E7%EE%E2%E0%ED+%ED%E8%EA%ED%E5%E9%EC+%22 = èñïîëüçîâàí
...

They seem to all be Latin-1 extended characters. Is this some form of Unicode attack?

Answer 1

The url encodes a Windows Codepage 1251 encoded string, containing (harmless) russian error messages. The transcoded url is:

/767/browser-wars-side-show-how-natty-handles-the-load/+++++++++[+Активация+]+Result: использован никнейм "azazalolxd"; вошли; не нашлось формы для отправки;

Google translator gives:

[ activation ] Result: used the nickname "azazalolxd"; included; can not find the form to send;

Its consistent with the usage of the russian Yandex browser that has this useragent. Also see this question.

Answer 2

If you have coded your application to properly sanitize user input, encode special characters before they get to the back-end, and reject data that is unexpected, you should have nothing to worry about.