0

I found an increased access to my website on www.mydomain.tld/imaginaryTeachingToolUrl.

This isn't a valid URL on my site, I tried to Google this, but there are under 10 results. So I guess this specific title isn't something common - but could this be some kind of approach to hack my site?

A snippet from the Apache logs. Actually this looks like a regular request. But this requests are for two reasons kind of odd:

  • requester: from SA
  • request on: non English, European page
  • high number of requests (for three days now)
  • unique ip (seems not to be a bot network or sth. like that)

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../style-custom.css HTTP/1.1" 200 1489 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../css/responsive.css HTTP/1.1" 200 3584 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/jquery.hoverIntent.js HTTP/1.1" 200 470 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/jquery.omslider.min.js HTTP/1.1" 200 1008 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

66.249.88.*** - - [03/May/2014:01:36:59 +0200] "GET /.../js/libraries.js HTTP/1.1" 200 870 "http://www.google.com/imaginaryTeachingToolUrl" "Mozilla/5.0 (en-us) AppleWebKit/537.36 (KHTML, like Gecko; Google PP Default) Chrome/27.0.1453 Safari/537.36"

Improve this question
3
  • check your server logs, it will tell you the ip addresses of the traffic and possibly the user agents. Its most likely bots if you get an unexpectedly high spike, either spambots or searchbots
    – Eeji
    Commented May 3, 2014 at 15:47
  • I did a quick bit of research. There is little information on this, however, it does appear to be used as a referrer URL at least in one case. The URL was www.google.com/imaginaryTeachingToolUrl which does not exist. If you can give us an anonymous log sample, we may be able to tell you something. You can edit your question and add the log data.
    – closetnoc
    Commented May 3, 2014 at 16:37
  • @closetnoc added a extract from the apache logs, I don't know why I didn't added it myself.
    – Lucas
    Commented May 3, 2014 at 16:55

1 Answer 1

Reset to default
1

Okay. It appears that not all the access are here, but that does not matter. It looks like these are valid requests with an invalid referrer URL. I am not sure why since these are Google IP addresses. I looked into my abuse database and I only see valid accesses for this IP address range except for one bot trap access so I don't think you have anything to worry about. If you try and access the URL, you will get a 404. This may be a new feature/algorithm testing by Google. Congratulations! You are on the bleeding-edge of technology!

Improve this answer
3
  • Hmm.. these accesses appear in my analytics tools. usually [random search engine] bots don't appear there (well you'll know that). Should I still don't worry?
    – Lucas
    Commented May 3, 2014 at 17:35
  • No. It is Google. I have been aggressively tracking all abuse accesses to my sites for 6 years. Google has only just a very small number of mistakes none more serious than falling into a bot trap. That means that it has accessed a portion of my site that is restricted by robots.txt less than a handful of times. Google has made errors, but no hacks or bad behaviors to concern ourself with.
    – closetnoc
    Commented May 3, 2014 at 17:41
  • Any time. I just happen to research hacker activity and the processes of detecting and mitigating the attacks as well as predicting attack sources. This is a work in process and rather interesting. I look at patterns and indications more than anything and how to automate abuse research with processes that can be used in analysis tools.
    – closetnoc
    Commented May 3, 2014 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.