Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently investigating an instability problem in my customer's web site. While looking through the access log I noticed a sudden burst of activity from one particular IP. It started off requesting normal URLs but at a high rate - 8 hits/sec. For most of the time the same URL (actually a directory) was requested but interspersed with these were URLs which started off as valid but always ended with a random 11-character value like this:

93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/0g2exjxspky.html HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -
93.133.234.xxx - - [25/Jul/2010:13:49:57 +0200] "GET /com/COM/de/ HTTP/1.1" 302 -

Has anyone seen this kind of behaviour before? I can't figure out what might lie behind this. I'd be interested to hear anyone's opinion on this.

Paul

share|improve this question

4 Answers 4

Not sure, but many spambots etc. are behaving like that, so it might be just another zombie Windows client bombing your server.

share|improve this answer

It is usually not a problem, if your server and any of its possible server-based applications are responding correctly to the bogus calls (ignore or error).

share|improve this answer
    
I'm not saying that it's a problem. We're coping with these requests. What puzzles me is the intent. Why add a bogus section to a valid URL? What is the point? They're not whacking the site hard - just 8 hits/sec. They're not trying to guess hidden page names. So why do it? –  paul Aug 2 '10 at 9:26
    
As identified by Janne Pikkarainen, it could be malware either in testing or actually looking to signal its counterpart. –  user48838 Aug 2 '10 at 12:37

I see that kind of thing pretty much every day, along with numerous requests for pages which don't exist on our sites. As far as I've been able to determine it's bots looking for specific vulnerabilities. I just accept it as part and parcel of being on the Internet and haven't taken the time to determine just what holes they're looking for.

share|improve this answer

You run into some zobies / bots / whatever trying to explore various problems in various programs used on various systems. Some web servers (older, unpatched) or some software may react by installing softawre etc.

Those worms basically try to exploit a security issue X on random IP addresses.

Some are ancient, but still around - supposedly there are infected Windows 2000 systems still around, unpatched, on the internet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.