Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have recently launched a client’s site and for the last few days and with increasing frequency I am seeing strange entries into the access log.

[28/Feb/2014:06:26:53 +0800] "GET //RS=^ADAA6U_G38x_VuWqDIVQJpBbDUsUW0- HTTP/1.1" 302 630 "http://www.domain.com.au/" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36"]

and

[28/Feb/2014:06:26:54 +0800] "GET /RS=%5eADAA6U_G38x_VuWqDIVQJpBbDUsUW0- HTTP/1.1" 404 8291 "http://www.domain.com.au/" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.116 Safari/537.36"

The domain.com.au part is the actual address of the website. I have changed it for this post.

I cannot figure out what this is trying to archieve as it’s simply setting another get variable, which would not archieve anything, unless I am wrong.

  1. Do you think we should be concerned with these requests?
  2. What are these requests trying to archieve?
  3. Anything we can do to stop them?
share|improve this question
    
what is your site about? If it's not too sensitive to be disclosed. Plus do you have any CMS or package installed on that site? –  PatomaS Feb 28 at 6:29
    
@PatomaS The site is a little sensitive. The CMS system is customer built in house so should not be generating anything like this. As extra information have seen some more connections with the following RK=0/RS=N3luhChARYe3D3ZNSAkKO3L2gXE- So it doesn't follow the other logs. –  user3363066 Feb 28 at 8:18
    
Is rs, rk or rc a parameter that your system accepts/uses? Did you have any Microsoft product before facing Internet before? –  PatomaS Feb 28 at 8:21
    
@PatomaS No this is a Linux server that has never run anything MS related. As far as i can tell there is not anything that should be using those parameter, at least not from a web interface. –  user3363066 Feb 28 at 8:39
    
Then it should be fine. Still, try to block the access as recommended by Jhon –  PatomaS Feb 28 at 9:36

2 Answers 2

up vote 5 down vote accepted

I couldn't find anything related to that request so if it is anything malicious it hasn't come to light yet. I also don't see how it could be used to harm your site.

Having said that, the bad guys seem to be one step ahead of us so if this request doesn't serve any useful purpose on your site I would try to block it. Even if only to keep your logs from being polluted.

I would say you should attempt to block them if possible. The two consistent parts of those request are /RS= and ADAA6U_G38x_VuWqDIVQJpBbDUsUW0 so they can be what you focus on to block them.

share|improve this answer
    
just a little opinion. I think they trying to attack a specific software that is taking a parameter for a regex. May be just testing the existence. The idea came because the %5e is the encoded version of '^'. Plus having a '-' at the end of the string, can make it just generate a range on the regex. Of course, not knowing the regex, we don't know if that is relevant or not. –  PatomaS Feb 28 at 6:27
1  
Here it is another opinion. graphicline.co.za/articles/added-uri-string-rsada –  cayerdis Apr 29 at 15:07

They come from web scrapers incorrectly using Yahoo! Search result. This discovery was made by @tenants at XenForo forum. They explain more of the implications of receiving these requests and how they handle them.

1. Do you think we should be concerned with these requests?

You don’t have to be concerned with these requests. They are just hallmarks of dumb bots and dumb bots wander all over the Internet. These requests are not to be identified as malicious just based on the URL, they are probably innocent.

2. What are these requests trying to archieve?

They’re trying to get the contents of the page they’re requesting. They have no special effect, they are (undesired) products of a Yahoo! Search scraping.

3. Anything we can do to stop them?

Not really, anyone is free to post whatever requests they like on the net. (At least technically. Social and legal aspects put aside.)

  1. You can throw them away when generating reports from your logs. This is the option I chose.

  2. Or you can try to fix the requests to succeed and not generate log entries. This is probably what most do from what I saw on the web. I see a flaw in this approach. While making their visitor’s experience better, they forget who those visitors are. Dumb bots. I don’t want dumb bots on my sites so I won’t bother to improve their experience.

If you want to fix the requests, you can do it using , possibly called from , e.g. using the code from the XenForo forum post I mentioned above:

RewriteEngine On

# strange behaving bots, these are urls scraped from yahoo (botters scrapping for links, yahoo search link contain RK RS) tenants modification:
RewriteRule ^(.*)RK=0/RS= /$1 [L,NC,R=301]
RewriteRule ^(.*)RS=^ /$1 [L,NC,R=301]

You may have to fiddle with the regexes a bit, e.g. add an additional slash after the (.*) if your URLs don’t end with one.

 Related

Kudos to @dman’s answer on Stack Overflow and @webaware’s comment under this question for finding the XenForo forum post.

share|improve this answer

protected by Community Mar 13 at 7:19

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.