I recently noticed some strange traffic in my nginx access logs. I'm not sure if these indicate an attack, a mistake, or something else. I've started sending these to HTTP 444, so these logs will indicate that.
1) I noticed an increase in traffic, and in checking the logs I saw request after request like this:
22.214.171.124 - - [28/Nov/2015:06:27:00 +0000] "GET / HTTP/1.1" 444 0
"http://vp.f8bet.com/wf360.html""Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36" "-"
They come from different IPs and different user agents. Lots of them. The weird part is that the referring page has my TLD as the src for a script tag. My site isn't returning any JS from that URL, so it just hits the site's index. If I was less nice I could start returning some mean JS there. I think this may just be referrer spam, but am not sure.
2) I'm also getting a lot of requests like this:
126.96.36.199 - - [28/Nov/2015:06:07:16 +0000] "GET / HTTP/1.1" 302 97 "-" "WhatsApp" "-"
They also come from various IPs and have WhatsApp as the user agent. The interesting part here is that they're various subdomains (seemingly random Spanish words), which resolve because of a wildcard. I removed the wildcard to kill some of these, and ended up just blocking all WhatsApp user agent traffic as well.
I'm getting some under a Spanish subdomain with "MJ12bot" as the referer as well. "MJ12bot" appears semi-legit, but if it's a real crawler, the subdomain is never something that existed specifically.
Like anyone I get random attacks all day, but the first one is very specific, and I find the second one interesting due to the subdomains. Both have been hitting me continously over the last week or so.
Does anyone have thoughts on the purpose of these requests and if I should do anything more than just send them to 444 and be on my way?