We recently moved some pages around on our site without bothering to put any redirects in place, and we started to notice something interesting. One of the pages we moved was receiving a surprising amount of strange traffic, which are now showing up in the broken link reports.

The traffic doesn't appear worrying (just normal page requests with no odd query strings now showing up as 404's), but:

  • It all originates from sketchy domains in Russia and China like you normally see doing port scans and other malicious activities.
  • It's all directed at this one particular page out of hundreds on the site.
  • 99% of the User-Agent strings indicate IE 6.0 on Windows Server 2003

Should we be worried? It doesn't seem like (especially now that we've moved the pages) any harm can come from this, as the amount of traffic certainly doesn't rise to the level of a DoS attack. However, the traffic does look like it's coming from infected computers. Why would this be happening at all? Thanks in advance.

2 Answers 2


If the name of the page is a common name I would not be too concerned altough I would check my current patch levels as this might come from any number of vulnerability databases such as MetaSploit uses.

If it is a file which could only refer to something on your site, I would be slightly concerned, and I would set up a redirect to a separate server to see what the result is of this request on my site. It could be harmless, or it could indicate that you are or have been the target of something.

  • Thank you for the confirmation and the suggestion for how to further proceed. I had not thought of trying to catch and examine the request more closely like this. Commented Aug 20, 2013 at 18:59

Yes, this is a cause for (mild) concern as someone, somewhere thought that page or the server was possibly vulnerable to something. Although traffic levels are not currently at DoS or DDoS levels that's merely a setting somewhere so ignoring the warning signs are probably not in your best interest.

As for why it is happening at all, it could be that a scan returned something that resulted in them doing a more thorough test of your defenses or it could be something else altogether more benign (an index-building bot) or less benign. There really isn't enough information to know at this time.

  • Thank you for your opinion. Glad to know I'm not worrying needlessly. Both answers were quite good and I only accepted the other because it also included how to get more information. I would like to upvote this but do not yet have the rep. Commented Aug 20, 2013 at 19:00
  • @Two-BitAlchemist upvoted in your name. :) Commented Aug 21, 2013 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.