0

I'm getting a lot of such requests, i was wondering what they are trying to hack or whether the system was compromized?!

80.137.206.13 - - [21/May/2013:15:59:38 +0200] "LW\x96\x92\xa5Fg\xa9\xa21\xb4/;\xb6\xef\x1e\xe6\x175l\xa9\x85\xa8\x91\x9c\x98V\x1e\r\xb1o\xd6L\x07\xc3\x9cv\xaaw\x8ak\xddw" 400 316 "-" "-"
84.176.243.124 - - [21/May/2013:16:02:37 +0200] "\x0fAy\xcb\x99|" 302 0 "-" "-"
68.34.99.222 - - [21/May/2013:16:03:46 +0200] "\x8ee\x88\xc1t\xe3\x84W\x89M\x12\xbf\xf0\x11\x84\x1e\x18" 302 0 "-" "-"
31.16.203.34 - - [21/May/2013:16:05:46 +0200] "-" 408 0 "-" "-"
81.109.229.103 - - [21/May/2013:16:07:36 +0200] "-" 408 0 "-" "-"
92.145.3.106 - - [21/May/2013:16:09:36 +0200] "-" 408 0 "-" "-"
78.94.199.112 - - [21/May/2013:16:18:32 +0200] "-" 408 0 "-" "-"
62.53.164.158 - - [21/May/2013:16:22:56 +0200] "J\xf2LY\x0e4\x18D\x0f\xc0\xa0\xef\xa2" 302 0 "-" "-"
85.67.38.79 - - [21/May/2013:16:35:46 +0200] "\x01\x85\xe4" 302 0 "-" "-"
79.236.201.21 - - [21/May/2013:16:51:12 +0200] "\xacd\x83" 302 0 "-" "-"

1 Answer 1

2

These appear to be unicode-encoded URI paths.

If you serve unicode-encoded URLs this sort of stuff in your logs is normal, otherwise it's possible someone is looking for a server with unicode-parsing vulnerabilities to exploit.
Beyond ensuring that your server is patched up to date no special action is required unless you see some evidence that your system has actually been compromised.

See this other question for more information.

1
  • Presumably, it also indicates that the User Agent has not percent-encoded the path. Aug 28, 2014 at 9:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .