Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

We recently moved some pages around on our site without bothering to put any redirects in place, and we started to notice something interesting. One of the pages we moved was receiving a surprising amount of strange traffic, which are now showing up in the broken link reports.

The traffic doesn't appear worrying (just normal page requests with no odd query strings now showing up as 404's), but:

  • It all originates from sketchy domains in Russia and China like you normally see doing port scans and other malicious activities.
  • It's all directed at this one particular page out of hundreds on the site.
  • 99% of the User-Agent strings indicate IE 6.0 on Windows Server 2003

Should we be worried? It doesn't seem like (especially now that we've moved the pages) any harm can come from this, as the amount of traffic certainly doesn't rise to the level of a DoS attack. However, the traffic does look like it's coming from infected computers. Why would this be happening at all? Thanks in advance.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

If the name of the page is a common name I would not be too concerned altough I would check my current patch levels as this might come from any number of vulnerability databases such as MetaSploit uses.

If it is a file which could only refer to something on your site, I would be slightly concerned, and I would set up a redirect to a separate server to see what the result is of this request on my site. It could be harmless, or it could indicate that you are or have been the target of something.

share|improve this answer
    
Thank you for the confirmation and the suggestion for how to further proceed. I had not thought of trying to catch and examine the request more closely like this. –  Two-Bit Alchemist Aug 20 '13 at 18:59
add comment

Yes, this is a cause for (mild) concern as someone, somewhere thought that page or the server was possibly vulnerable to something. Although traffic levels are not currently at DoS or DDoS levels that's merely a setting somewhere so ignoring the warning signs are probably not in your best interest.

As for why it is happening at all, it could be that a scan returned something that resulted in them doing a more thorough test of your defenses or it could be something else altogether more benign (an index-building bot) or less benign. There really isn't enough information to know at this time.

share|improve this answer
    
Thank you for your opinion. Glad to know I'm not worrying needlessly. Both answers were quite good and I only accepted the other because it also included how to get more information. I would like to upvote this but do not yet have the rep. –  Two-Bit Alchemist Aug 20 '13 at 19:00
    
@Two-BitAlchemist upvoted in your name. :) –  Daniël W. Crompton Aug 21 '13 at 6:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.