3

I've recently noticed a number of garbage requests coming into a website that I run. They look like so:

2015-02-19 13:54:27.272 /notify-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tLw==
2015-02-19 13:44:35.159 /verify-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tL2NvbXBhbnkvdGVuLXRoaXJ0eS1vbmUtcHJvZHVjdGlvbnM=
2015-02-19 13:44:35.081 /verify-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tL2NvbXBhbnkvdGVuLXRoaXJ0eS1vbmUtcHJvZHVjdGlvbnM=
2015-02-19 13:43:31.952 /accepted-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tL2ludmVzdG9yL21jdWJhbg==
2015-02-19 13:43:31.841 /accepted-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tL2ludmVzdG9yL21jdWJhbg==
2015-02-19 13:43:29.356 /notify-Speed_Bump?aHR0cDovL3d3dy5zaGFya2FseXRpY3MuY29tL2ludmVzdG9yL21jdWJhbg==

Searched around for answers as to what this Speed_Bump thing is about, but couldn't find anything about it. No harm done yet, as of course the server returned 404 each time. I haven't gotten that many of these requests, but they're coming from IPs in ranges that were already suspect due to previous bad behavior.

Is it malicious, annoying, or just nothing?

Improve this question
3
  • So far, I am seeing two things associated with the term speed bump. One is a JS disclaimer that cannot be bypassed that the banking industry (and others) uses to ensure that users cannot log in without bypassing a disclaimer. The other, so far, seems to be a JS user tracking app that takes the IP address, the request, and the referrer and presumably adds this to a database. The use of notify-Speed_Bump? can be found all over the place. I did a search for known vulnerabilities/attacks and did not find anything. For now, I would suggest just blocking these or letting them 404.
    – closetnoc
    Commented Feb 20, 2015 at 15:59
  • Interesting... some of the IPs were traceable to an investment bank, so maybe it's just something on their end. Like their internal systems requiring them to be logged in before they can surf the internet, or tracking their behavior online. I'll probably just let them 404 like you suggest. Thanks!
    – kriztynna
    Commented Feb 24, 2015 at 16:50
  • Interesting... I love the 404 error! It does wonders. ;-) But people seem to be afraid of them. If your work is okay and exact/correct and a request for a non-existent page happens, then you can just grin and think to yourself, Oooppppssss!
    – closetnoc
    Commented Feb 24, 2015 at 16:54

1 Answer 1

Reset to default
1

There is not much you can do about it. Log records like these happen all the time no matter what sort of site you host. There are a number of reasons...

  1. Site Profiling - Some malicious users will attempt to inject various random URL chains into the path to see if they get a valid return or not, this is designed to identify the platform hosting the system (ie: framework, language, hidden section, etc).
  2. Virus on the Client Machine - Some viruses and malware can do the same thing for very much the same reason when it is installed on a remote clients machine.
  3. Misconfigured Network - Sometimes a network security appliance or network software will cause something like this to be added to URL's for it to work on the local network but which will have no meaning for your server. In this instance it is just the way they have needed to configure their network.

Based on your question research has shown that it would be more than likely to be option 3. In this sort of instance you are already doing all that you can do and that is to return 404 errors to the request. It is unlikely that it is a malicious issue and short of blocking the address block (which would also have the affect of blocking a number of potential visitors to your site) there is not much else that you can do.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.