/q873 /s106 /s833 etc. - I get these requests constantly generating a 404. They are from Google, Amazon, CERF and others. What are these people wanting? Is it a dos attack? It's useless to ban the IP as they have dozens if not 100s. Anyone else seen these sort of URLs? Thanks.
Check your access logs or mod security logs if you have POST requests before these requests /q873 /s106 /s833 etc. Usually hackers try to create directories in server to test and upload shell using website vulnerabilities. If POST requests are present and block those ips. Check POST data through mod security logs to be on the safer side.