Skip to main content
Webmasters

Return to Question

Tweeted twitter.com/StackWebmasters/status/907595266521538560
more specific title
Link
Stephen Ostermiller ♦
Stephen Ostermiller ♦
  • 99.4k
  • 18
  • 141
  • 364

Many Requests What are these many requests referred from Facebook with a changing s= parameter?

Formatting, grammar, removed signature and "thanks".
Source Link
MrWhite
MrWhite
  • 43.1k
  • 4
  • 50
  • 90

i just recognised a peak in our access logs and i'm curious how to explain this or if my suggestion how to explain is right.

I just recognised a peak in our access logs and I'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

The number in the s=s= parameter within the u=u= parameter, in this case 2384266021705053723842660217050537, is changing every request. (The s= Parameters= parameter has no function on the website).

My guess is that somebody is posting many urlsURLs with the changing ss parameter in a facebookFacebook chat or post window to make thisthese requests. Maybe to crawl something or maybe DDoS the Websitewebsite. BUT the request on our site even executes the JavaScript and gets tracked by GoogleAnalyticsGoogle Analytics, in addition to this the useragentuser-agent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?
Is

Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?

Best withes and thanks in advance
Jared


i just recognised a peak in our access logs and i'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

The number in the s= parameter within the u= parameter, in this case 23842660217050537, is changing every request. (The s= Parameter has no function on the website).

My guess is that somebody is posting many urls with the changing s parameter in a facebook chat or post window to make this requests. Maybe to crawl something or maybe DDoS the Website. BUT the request on our site even executes the JavaScript and gets tracked by GoogleAnalytics, in addition to this the useragent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?
Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?

Best withes and thanks in advance
Jared

I just recognised a peak in our access logs and I'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

The number in the s= parameter within the u= parameter, in this case 23842660217050537, is changing every request. (The s= parameter has no function on the website).

My guess is that somebody is posting many URLs with the changing s parameter in a Facebook chat or post window to make these requests. Maybe to crawl something or maybe DDoS the website. BUT the request on our site even executes the JavaScript and gets tracked by Google Analytics, in addition to this the user-agent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?

Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?

Source Link
jar3d
jar3d
  • 31
  • 1

Many Requests from Facebook


i just recognised a peak in our access logs and i'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

The number in the s= parameter within the u= parameter, in this case 23842660217050537, is changing every request. (The s= Parameter has no function on the website).

My guess is that somebody is posting many urls with the changing s parameter in a facebook chat or post window to make this requests. Maybe to crawl something or maybe DDoS the Website. BUT the request on our site even executes the JavaScript and gets tracked by GoogleAnalytics, in addition to this the useragent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?
Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?

Best withes and thanks in advance
Jared