Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height%7c%7c1%3ba=e( HTTP/1.1" 403 222

access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-ui/js/?a.aspectRatio:this.originalSize.width/this.originalSize.height||1;a=e( HTTP/1.1" 301 333

Note that the requests different, and one of them responds with a 403, and the other a 301. There are actually a number of jQuery related scans from the same IP addresses. Almost always they respond with a 403.

The addresses all happen to be from countries that never use the website, and are definitely "unsolicited users".

I'm very frequently seeing this sort of entry. I couldn't find any reference to this attack in google.

My question really has two parts:

• What is this attack attempting to do? Is there a compromise in jQuery, or websites setup to use jQuery?
• Is there any particular worry? I'm guessing the answer here is "no", given that the requests are mostly 400 level, with the occasional 300 level. However, are there security measures I should look into to make sure that this sort of attack cannot succeed?

IP Addresses: They come from a variety of IPs. I've included a sample here. Because of the variety, I assumed they were compromised machines (i.e., a botnet) but I'm not sure.

133.50.201.25 (Japan, University domain)

89.29.175.68 (Trinidad and Tobago, root domain seems to be for a non-profit)

190.156.227.11 (Colombia, not sure what type of domain).

78.250.250.243 (France, no host info appears to be available)

I've seen others from Italy, Spain, etc