I've recently been going through our 404 logs and we have a number of urls which look like this turning up:-


It contains the actual url, which is:-


This blog post relates to a recently redirected url (standard redirect 301) hence the concern - can anyone shed any light on this kind of thing?

  • 1
    I found a couple of links to people reporting similar URLs in their logs, but no definitive answer. One seemingly plausible suggestion is a broken spambot. Commented Apr 15, 2012 at 5:02

2 Answers 2


This is some sort of comment-spam or possibly a hack attempt, but it's rather difficult to find out what it's trying to do. If it's a hack attempt, it could be a probe in which many thousands of sites are hit with the same type of attempted exploit, and only those that show promise are followed up.

To analyse this URL, here's a simple Perl one-liner:

perl -MURI::Escape -e '$line = <STDIN>; print uri_unescape(uri_unescape($line))'

Run this from the shell, then paste in your URL and hit Enter, then Ctrl/D to finish. The output is:


Here's a security site's comment - still doesn't really say anything useful: http://isc.sans.edu/diary.html?storyid=4003 (SANS is good on malware analysis generally).

This is a slightly more useful analysis - as ChrisWiegman said, it seems to be some sort of spam bot, given the POST command in the URL: http://rankexploits.com/musings/2011/sorry-bergen-norway/ - has some comments on mod_rewrite rules to block this sort of thing.

I would investigate your logs around the time of a couple of attempts to see if there are any other odd attempts. Unless you find something else going on, the risk of this hack attempt getting into your site is fairly low.

It's worth checking for any vulnerabilities announced in the web applications you run on that site, and updating to the latest version if there are any.


Most likely it is a bot looking for vulnerabilities in your site. Some plugins and themes could allow users to post commands like that to do bad things to your site...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.