Recently, I've been receiving request spikes from requests of the form

example.com/h/<randomNumber>.html

Each time the random number is consistent (per 24 hours). On Google analytics I'll suddenly have 300% of my usual entire site traffic directed to a URL that I've no idea what it's attempting to direct to. When I go manually it 404s.

My question is, is this a known hack that indicates that my server is compromised in some way, or otherwise is this something that crawling bots might do?

  • 1
    Looks like a random attack for a specific exploit which you are not vulnerable to – John Conde Sep 14 at 12:23
  • I'm seeing the same patterns of traffic towards /h/*.html i.e. /h/9092612.html in Google Analytics. This should lead to a 404 page on my site, a WordPress site with Wordfence. Wordfence does not block these requests with the default settings. I've updated the Wordfence settings to throttle 404 requests. – Pim Schaaf Nov 9 at 21:22

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.