I've noticed some odd 404s which appear to be broken URL rewriting code. Our image viewer requests tiles using URLs like this:
I see some - well under <1% - requests for slightly altered URLs:
These requests come from IP addresses all over the world (US, Canada, China, Russia, India, Israel, etc.), desktop and mobile users with multiple user-agents (Chrome, IE, Firefox, Mobile Safari, etc.), and there is often normal activity within the same session from the same IP address so I'm assuming this is either malware or a broken proxy / filter. I have not seen them from anything other than images, which suggests that this may be some sort of content filter.
Has anyone else seen this? My CDN logs show the first request on June 8th ramping up from several dozen to several hundred per day.