I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this:
What on earth are those
& supposed to do? I can't imagine that that would say anything effectively malicious to a server, unless this is exploiting some egregious server bug or the intended victim is not the server at all.
There seem to be a wide spread of environments for these bots -- some of them are XP, some are Vista, some are Windows 7. I've seen IE7, 8, and 9, as well as Chrome and Safari. I even saw an LG feature phone that said it was running Windows NT 5.1 and IE8. None of them have any referrer URLs, so I can't figure out what page they previously viewed on our site.
/js/bundles is where we keep our bundled assets, by the way.)
My question is: does anyone know what (server, browser, etc) these attacks are meant to exploit? They seem to be attempts at XSS exploits, but they're not very well-formed. ASP.NET seems to be catching them, though, so I'm not too worried.
(Another possibility is that they're just a really buggy spider doing its thing.)