Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have noticed that a small number of requests come through my application with ?sfgdataq appended to them, I probably wouldn't have ever noticed it if it didn't cause an error on some requests.

I have seen requests come through with a mix of user agents, (Firefox, IE 7, IE 8) so I don't think it is a bot.

I looked around and I can't find any information on what is doing this, I found a couple people with similar questions on message boards (so I don't think it is isolated to my application) but no good answers.

edit: I also noticed that the User Agents have some sort of large random value appended: +sfgRmluamFuX1R5cGU9amF2YV9zY3JpcHQmRmluamFuX0xhbmc9dGV4dC9qY is a sample - searching for that on google turns it up in other logs as well.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

It appears to be from a Finjan (now part of M86 Security) security appliance.

I found an old forum post here (in Estonian) asking why it was adding "?sfgdata=4" to URLs.

There's also an old set of release notes that has a few references to "sfgdata".

share|improve this answer
    
Ah, perfect. That makes sense that is is a web gateway adding the URLs. –  James Avery Aug 18 '10 at 14:19
add comment

Sounds like a bot looking for some kind of vulnerability. It's hard to say but I would guess there's a flaw in some software somewhere and that query string either exposes it so the hacker know where to find a vulnerable site or maybe it even begins an attack. Or it may be checking to see if your software gives an error message because of that query string and they can then try to exploit your code.

I would recommend logging the IPs of the visitors who are doing this in case it is malicious. Then you can ban them if necessary. I would also keep researching it as someone may figure out what this is and post it online for others to see.

share|improve this answer
add comment

More and more I find add-ons toolbars and plugins to be adding modifications to my user's behavior. Looks like it may be something like that, or a proxy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.