0

This question is an exact duplicate of:

I see the following in my access log:

access.log.1:66.249.69.81 - - [02/Apr/2015:23:03:13 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'dmjdl(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
access.log.1:66.249.65.178 - - [04/Apr/2015:12:22:32 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'lfzxps(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
access.log.1:66.249.65.178 - - [04/Apr/2015:13:07:21 -0400] "GET /click.php?c%3Ec4C%7B%5BHG%7BbD6kc31%3E'lfzx(..more such snipped..) HTTP/1.1" 404 19 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

The IPs are from Google, UA string claims to be Googlebot -- but why is it trying to fetch such strange URLs? My site does not even use PHP.

I see a previous question here, without any conclusive answers.

Some googling reveals this is not specific to my website. For e.g., google for "click.php opqbz" gets 443000 results with similar URLs.

What gives?

marked as duplicate by John Conde Apr 5 '15 at 14:26

This question was marked as an exact duplicate of an existing question.

  • Your situation is no different the other. – John Conde Apr 5 '15 at 14:26
  • The answers in the other question do not provide an "answer". If it is a scan for an exploit, then someone from a Google-owned IP is running it. If it is something with my site, then there can't be 443k URLs having a similar entry in the google index? – Charlie Winston Apr 5 '15 at 14:32
  • Spoofing IPs is not difficult. This is just a vulnerability scanner. We all get them. – John Conde Apr 5 '15 at 14:35
  • Oh. Hmm. But why are those URLs in google's index then? – Charlie Winston Apr 5 '15 at 14:39
  • They'll fall away eventually. Google thinks they exist for some reason, probably because they found links to those URLs, but since they;re not real pages they'll eventually drop off. Whomever is doing this to your site must have left something that google could find and crawl. Kind of odd but sloppiness is not not uncommon with attacks like this. It's just a brute force attack of sorts. – John Conde Apr 5 '15 at 14:41