I have found various 404 errors in my web server log that look like this:


None of these URLs have ever existed (my website is not even PHP-based). It looks like someone is attempting to guess a URL for a page on my website which causes a browser redirect to pastebin.com.

What is this person trying to do? Is it some sort of attempted hack?

  • Apart from an awkward automated blind injection attack, I can not see something else.
    – user45139
    Commented Aug 11, 2015 at 8:41
  • Is this an attempted cross-site attack? NO Commented Jun 21, 2019 at 5:47

1 Answer 1


A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability.

The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is unlikely.

However, with Unvalidated Redirects and Forwards the attacker just needs to look for a redirect HTTP response such as 301 Permanent. If successful, they could then use your site in a phishing style attack using an obfuscated redirect domain (say percent encoded) in the hope their victim follows the link to your (trusted) domain.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .