I've been seeing a lot of these in my Apache 2
logs recently:
Invalid URI in request \xff\x97\x9f\xfe;J\xe8K$J\x1b\xef\xebr?6\xac\x1aG,\xc6\x81\x0eW{G\xf0\xdf\x82\x9a\xfb\xd0\t\v\xf1\xdf\xbc"\xec|\xd8A\x1a\x87\x98\xa2\xa0\x89\xf1\\\xa3\xce\xca\xbap\xce\xcd\xc8\xdd\x7f\xffJ
Invalid method in request \x89\x84<?q8mz\x8ek\xcb6\xf1\xb8\xd2\xf61G\x86\x9e0\xd2\x91\xdd]/f\xda\x06\xc6\xed\xd3\xdb0\xf5\xd2`\xee\\C\x03\x18\xcd\x8e0\xfdI
Invalid URI in request US\xaa\xb1\xc4\xf2,\xe6\xcaw\xf6tQ\x0cy\xc1\xb2\xaf\xf9\xa1f\xf3
I imagine these are hex encoded strings, but looking on the net I couldn't find much info about this kind of attack, also due to Google making it very hard (or should I say impossible) to exactly match strings like \x
(and this is a real bug IMHO).
How should i interpret these hack attempts?