0

I see the following in my access log:

access.log.1:66.249.69.81 - - [02/Apr/2015:23:03:13 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'dmjdl(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
access.log.1:66.249.65.178 - - [04/Apr/2015:12:22:32 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'lfzxps(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
access.log.1:66.249.65.178 - - [04/Apr/2015:13:07:21 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'lfzx(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

The IPs are from Google, UA string claims to be Googlebot -- but why is it trying to fetch such strange URLs? My site does not even use PHP.

I see a previous question here, without any conclusive answers.

Some googling reveals this is not specific to my website. For e.g., google for "click.php opqbz" gets 443000 results with similar URLs.

What gives?

Improve this question
6
  • Your situation is no different the other.
    – John Conde ♦
    Commented Apr 5, 2015 at 14:26
  • The answers in the other question do not provide an "answer". If it is a scan for an exploit, then someone from a Google-owned IP is running it. If it is something with my site, then there can't be 443k URLs having a similar entry in the google index?
    – Charlie Winston
    Commented Apr 5, 2015 at 14:32
  • Spoofing IPs is not difficult. This is just a vulnerability scanner. We all get them.
    – John Conde ♦
    Commented Apr 5, 2015 at 14:35
  • Oh. Hmm. But why are those URLs in google's index then?
    – Charlie Winston
    Commented Apr 5, 2015 at 14:39
  • They'll fall away eventually. Google thinks they exist for some reason, probably because they found links to those URLs, but since they;re not real pages they'll eventually drop off. Whomever is doing this to your site must have left something that google could find and crawl. Kind of odd but sloppiness is not not uncommon with attacks like this. It's just a brute force attack of sorts.
    – John Conde ♦
    Commented Apr 5, 2015 at 14:41

0

Reset to default

Browse other questions tagged or ask your own question.