11

I've noticed some odd 404s which appear to be broken URL rewriting code. Our image viewer requests tiles using URLs like this:

/media/204/service/dzi/1/1_files/7/0_0.jpg

I see some - well under <1% - requests for slightly altered URLs:

/media/204/s/rvice/d/i/1/1_files/7/0_0.jpg

These requests come from IP addresses all over the world (US, Canada, China, Russia, India, Israel, etc.), desktop and mobile users with multiple user-agents (Chrome, IE, Firefox, Mobile Safari, etc.), and there is often normal activity within the same session from the same IP address so I'm assuming this is either malware or a broken proxy / filter. I have not seen them from anything other than images, which suggests that this may be some sort of content filter.

Has anyone else seen this? My CDN logs show the first request on June 8th ramping up from several dozen to several hundred per day.

Improve this question
8
  • 1
    Interestingly, this appears to have changed in the wild. I'm now seeing things like /se/vice/zi/ or /s/rvice/zi/ more commonly than the /s/rvice/d/i/ above.
    – Chris Adams
    Commented Nov 23, 2012 at 19:43
  • 2
    Whats the URL of the site? and what does your htaccess look like.
    – Simon Hayter
    Commented Dec 24, 2012 at 13:27
  • An example page would be wdl.org/en/item/204/zoom - in any normal browser, those hard-coded paths are passed in correctly. An example which just happened shows that this is also not limited by user agent - I've seen everything from IE to Chrome and, now, the Kindle Silk Browser: ""/media/4395/ervice/dz/1/1_files/12/8_4.jpg HTTP/1.1" 404 3091 "wdl.org/en/item/4395/zoom" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us; Silk/1.0.22.153_10033210) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 Silk-Accelerated=true"
    – Chris Adams
    Commented Dec 27, 2012 at 16:36
  • @ChrisAdams What framework or language is your website built on?
    – Anagio
    Commented Dec 27, 2012 at 23:49
  • 1
    For what its worth, I've seen similarly garbled URLs. I don't have a solid answer but in my case, where I have been able to track it down, it has always been associated with what look like automatically generated "related posts from the web" links.
    – s_ha_dum
    Commented Jan 20, 2013 at 23:36

2 Answers 2

Reset to default
1

I believe that those are DZI (Deep Zoom Image) requests. Does your app deal with maps? Most Likely Silverlight?

You are getting that because one of the collection images is missing or the DZI collection si not defined correctly.

http://msdn.microsoft.com/en-us/library/cc645022(v=vs.95).aspx

Improve this answer
1
  • 1
    They are DZI files but it's not because a file is missing - the filename being requested is actually wrong. In my example above, I showed the correct form which almost all clients request but in some cases a non-obvious failure causes a single character to be converted to a /
    – Chris Adams
    Commented Feb 26, 2013 at 18:47
1

Sometimes people will change URLs to see how your site responds. I've done this with several sites where I needed high-resolution reference imagery and figured that the site was scaling the images based on the REQUEST_URI. Sometimes (depending on the library being used) you can change things like dimensions, directories, and aspect ratios to get error messages (to tell you what someone is running on their server) and you can get larger (unscaled images).

Most sites that use the image scaling software do it for increasing the page optimization, and most users tend to upload images that are not scaled [down] from their original digital camera (sometimes now up to 24 mega pixels).

Another (more likely) possibility

Since the IPs are from all over the world, there may be a known issue with the software you're using and they're (using a botnet) trying to execute an exploit for a non-patched version.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.