EDIT:
It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all.
Rather, this particular URL string indicates a cookieless session.
It seems that this was nothing more than one (or multiple) of our users hitting our site with cookies disabled, and our app wasn't set up to properly handle this being inserted into the URL string.
I suppose it is still possible that someone was trying to manipulate this effect (the timestamps and frequency were of interest), but I believe this was more likely a case of us jumping on the "we're being attacked!" train a bit too early. It was surprisingly difficult to find information on this!
Ultimately, we figured this out when I encountered this exact URL pattern in our (isolated) test environment and decided to do some additional research on the issue.
Thanks everyone for your help with this, and sorry for any confusion! I'm leaving the initial question intact to avoid invalidating the answers that are already present.
Original Text:
I work for a company that has a public facing website for our customers. In the past several weeks, we have been seeing a series of log entries that look like this:
The controller for path '/(x(1)s(mpwcjessdyhikng0a1kyud1z))/' was not found or does not implement IController.
These entries are typically about 1 second apart and always start with x(1)s
followed by a random string of characters, followed by various paths to different pages, especially /account or /account/recoverpasswordrequest/
. This tends to go on for 10-30 minutes, and then we don't typically see it again until the next day, although it does happen pretty much every day.
We've blacklisted several IPs that this has happened from, but this person(s) is obviously using many different IPs to run whatever script is doing this.
Can anyone help me understand what is going on here, especially with what x(1)s
is, or what kind of information this person might be trying to obtain? The attack happens to be failing because we don't have a randomly named controller that will accept this information, but it would be wonderful to be able to put a stop to this or at least have a better understanding of what's happening.
EDIT: This "request" always follows the same (x(1)s(random))
pattern. There are 3 URLs primarily being hit:
The controller for path '/(x(1)s(31k5il1as0vxxnbfnnsrzm3b))/' was not found or does not implement IController.
The controller for path '/(x(1)s(31k5il1as0vxxnbfnnsrzm3b))/account/register' was not found or does not implement IController.
The controller for path '/(x(1)s(31k5il1as0vxxnbfnnsrzm3b))/account/recoverpasswordrequest' was not found or does not implement IController.
The full URL would be: https://example.com/(these requests)
The site uses MVC, so these particular error messages are due to us not having a controller named (x(1)s(blah))
that this URL can resolve to. The log entries show the same random string being used for all 3 URLs, then a new random string is generated and the same pattern is tried again.
These log entries are from this request failing and causing an exception in our application logic. Therefore, they are bypassing the firewall and actually failing inside our code.