Random five character string added to URLs?
Christopher J. Pilkington
cjp at 0x1.net
Tue Nov 1 19:51:04 UTC 2011
This might be off-topic, my apologies if so.
I seeing requests against a server with initial GET requests in the form:
GET /[a-zA-Z]{5}/pagename.html
pagename.html being optional. The 5 character string seems to be
random. This GET always results in a 404, as our servers don't have
these paths. The second request seems to always the same without the
modified path, which results in a 20.
I initially suspected this was something from an attack or DOS tool,
but the traffic doesn't fit such a pattern.
Is anyone familiar with what device/service behaves in this fashion?
Clearly something layer 7 is between the clients and the server.
Provider is without clue regarding this. Google results in many
GoDaddy users complaining of same; the server in question is not
hosted with them, but I suspect they may be doing something similar.
Thanks,
-cjp
More information about the NANOG
mailing list