Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I found an increased access to my website on www.mydomain.tld/imaginaryTeachingToolUrl.

This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this specific title isn't something common - but could this be some kind of approach to hack my site?

A snippet from the Apache logs. Actually this looks like a regular request. But this requests are for two reasons kind of odd:

  • requester: from SA
  • request on: non English, European page
  • high number of requests (for three days now)
  • unique ip (seems not to be a bot network or sth. like that)

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../style-custom.css HTTP/1.1" 200 1489 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../css/responsive.css HTTP/1.1" 200 3584 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/jquery.hoverIntent.js HTTP/1.1" 200 470 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/jquery.omslider.min.js HTTP/1.1" 200 1008 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/libraries.js HTTP/1.1" 200 870 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

share|improve this question
    
check your server logs, it will tell you the ip addresses of the traffic and possibly the user agents. Its most likely bots if you get an unexpectedly high spike, either spambots or searchbots –  Eeji May 3 at 15:47
    
I did a quick bit of research. There is little information on this, however, it does appear to be used as a referrer URL at least in one case. The URL was www.google.com/imaginaryTeachingToolUrl which does not exist. If you can give us an anonymous log sample, we may be able to tell you something. You can edit your question and add the log data. –  closetnoc May 3 at 16:37
    
@closetnoc added a extract from the apache logs, I don't know why I didn't added it myself. –  Lucas May 3 at 16:55

1 Answer 1

up vote 1 down vote accepted

Okay. It appears that not all the access are here, but that does not matter. It looks like these are valid requests with an invalid referrer URL. I am not sure why since these are Google IP addresses. I looked into my abuse database and I only see valid accesses for this IP address range except for one bot trap access so I don't think you have anything to worry about. If you try and access the URL, you will get a 404. This may be a new feature/algorithm testing by Google. Congratulations! You are on the bleeding-edge of technology!

share|improve this answer
    
Hmm.. these accesses appear in my analytics tools. usually [random search engine] bots don't appear there (well you'll know that). Should I still don't worry? –  Lucas May 3 at 17:35
    
No. It is Google. I have been aggressively tracking all abuse accesses to my sites for 6 years. Google has only just a very small number of mistakes none more serious than falling into a bot trap. That means that it has accessed a portion of my site that is restricted by robots.txt less than a handful of times. Google has made errors, but no hacks or bad behaviors to concern ourself with. –  closetnoc May 3 at 17:41
    
thanks for explanation + sharing your experience. –  Lucas May 3 at 17:43
    
Any time. I just happen to research hacker activity and the processes of detecting and mitigating the attacks as well as predicting attack sources. This is a work in process and rather interesting. I look at patterns and indications more than anything and how to automate abuse research with processes that can be used in analysis tools. –  closetnoc May 3 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.