up vote 4 down vote favorite
1
share [g+] share [fb]

Anyone seen these before? Not sure if this is related to Google Analytics or UserFly running on our site or indicative of automated attacks from user machines.

The requests come from users with all user-agent strings, and from users who make legitimate requests and from trusted users. I've matched the string in a mod_rewrite rule to return "forbidden" but I would like to know where these are coming from. They come in waves, nothing for a week or more, than many many requests in one day.

The requests are for many random pages on the site and then have this odd query string appended, which varies but always looks something like: 

"GET /&data=%7C%23ujnftubnq%23%3B2392714553497-%23fwfout%23%3B%5C%5E-%23efubjmt%23%3B%5C%5E-%23ujnft%23%3B%5C%5E~ HTTP/1.1"
link|improve this question
The IP addresses are coming from what kind of blocks? Home users? Private? Asia/Russia? – Bart Silverstrim Aug 13 '10 at 15:48
If it were Google or something like that, I doubt they'd be spoofing user-agent strings. – Bart Silverstrim Aug 13 '10 at 15:49
I haven't seen something quite like that, but that first character of data is "%7C"; that's a pipe "|", and that makes me very, very suspicious. – Chris S♦ Aug 13 '10 at 15:50
home, corporate, etc, almost all in US. Mostly from customers of this client and corporate partners of this client (this is a client site). As I said, trusted users' IP's are showing up in the logs with these requests. – Devin Ceartas Aug 13 '10 at 15:51
Yes, I totally agree that the pipe character seems suspicious; that's one of the things that made me take this one seriously and try to track it, understand it. – Devin Ceartas Aug 13 '10 at 15:52
show 1 more comment
feedback

3 Answers

up vote 1 down vote

This is (at this point) somewhat of an educated speculation (er, Scientific Wild @SS Guess), but here goes:

Something's looking for or targeting PDF's

Here is the URL Decoded query string from your example above:

/&data=|#ujnftubnq#;2392714553497-#fwfout#;\^-#efubjmt#;\^-#ujnft#;\^~

Googling around for "fwfout", "efubjmt" or "ujnft" the only results that came back were PDF's.

It's hard to say if that "something" is malicious or not without knowing more about your environment. It could be something trying to search within PDF conent on your site. It could be something trying to find something to exploit, given the recent Acrobat vulnerabilities.

I also agree about pipe suspicion, that character always makes me twitch unless I type it in myself.

link|improve this answer
Hm. Could be. If it were legitimate, you might think it would be making such requests for resources which actually existed and were PDF files. – Devin Ceartas Aug 13 '10 at 16:07
@Devin: yes, agreed. Random crap like that showing up in my logs always raises my threat-con level. – squillman Aug 13 '10 at 16:12
feedback
up vote 0 down vote

What kind of things do you have on your server ?

for #ujnftubnq# #efubjmt# google returned me some chinese things about resource reservation on some routers. No idea if it's relevant or not :> Just a notice.

link|improve this answer
It's a US-based client's E-Commerce website. – Devin Ceartas Aug 17 '10 at 12:05
feedback
up vote 0 down vote

This sounds a bit like it could be a botnet attempting to contact you for command & control, especially with the waves. Either that or infection attempts from a botnet. If you know one of the clients well enough, it'd be nice to try to gather more info from one of the sources of the URL. Packet dumps to see if it's contacting other sites, plus just a check to see what process is doing the contacting.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.