Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've noticed some odd 404s which appear to be broken URL rewriting code. Our image viewer requests tiles using URLs like this:

/media/204/service/dzi/1/1_files/7/0_0.jpg

I see some - well under <1% - requests for slightly altered URLs:

/media/204/s/rvice/d/i/1/1_files/7/0_0.jpg

These requests come from IP addresses all over the world (US, Canada, China, Russia, India, Israel, etc.), desktop and mobile users with multiple user-agents (Chrome, IE, Firefox, Mobile Safari, etc.), and there is often normal activity within the same session from the same IP address so I'm assuming this is either malware or a broken proxy / filter. I have not seen them from anything other than images, which suggests that this may be some sort of content filter.

Has anyone else seen this? My CDN logs show the first request on June 8th ramping up from several dozen to several hundred per day.

share|improve this question
1  
Interestingly, this appears to have changed in the wild. I'm now seeing things like /se/vice/zi/ or /s/rvice/zi/ more commonly than the /s/rvice/d/i/ above. –  Chris Adams Nov 23 '12 at 19:43
2  
Whats the URL of the site? and what does your htaccess look like. –  bybe Dec 24 '12 at 13:27
    
An example page would be wdl.org/en/item/204/zoom - in any normal browser, those hard-coded paths are passed in correctly. An example which just happened shows that this is also not limited by user agent - I've seen everything from IE to Chrome and, now, the Kindle Silk Browser: ""/media/4395/ervice/dz/1/1_files/12/8_4.jpg HTTP/1.1" 404 3091 "wdl.org/en/item/4395/zoom/"; "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us; Silk/1.0.22.153_10033210) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 Silk-Accelerated=true" –  Chris Adams Dec 27 '12 at 16:36
    
@ChrisAdams What framework or language is your website built on? –  Anagio Dec 27 '12 at 23:49
1  
For what its worth, I've seen similarly garbled URLs. I don't have a solid answer but in my case, where I have been able to track it down, it has always been associated with what look like automatically generated "related posts from the web" links. –  s_ha_dum Jan 20 '13 at 23:36
show 3 more comments

2 Answers

I believe that those are DZI (Deep Zoom Image) requests. Does your app deal with maps? Most Likely Silverlight?

You are getting that because one of the collection images is missing or the DZI collection si not defined correctly.

http://msdn.microsoft.com/en-us/library/cc645022(v=vs.95).aspx

share|improve this answer
1  
They are DZI files but it's not because a file is missing - the filename being requested is actually wrong. In my example above, I showed the correct form which almost all clients request but in some cases a non-obvious failure causes a single character to be converted to a / –  Chris Adams Feb 26 '13 at 18:47
add comment

Sometimes people will change URLs to see how your site responds. I've done this with several sites where I needed high-resolution reference imagery and figured that the site was scaling the images based on the REQUEST_URI. Sometimes (depending on the library being used) you can change things like dimensions, directories, and aspect ratios to get error messages (to tell you what someone is running on their server) and you can get larger (unscaled images).

Most sites that use the image scaling software do it for increasing the page optimization, and most users tend to upload images that are not scaled [down] from their original digital camera (sometimes now up to 24 mega pixels).

Another (more likely) possibility

Since the IPs are from all over the world, there may be a known issue with the software you're using and they're (using a botnet) trying to execute an exploit for a non-patched version.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.