Skip to main content
1 of 3
jar3d
  • 31
  • 1

Many Requests from Facebook


i just recognised a peak in our access logs and i'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo

The number in the s= parameter within the u= parameter, in this case 23842660217050537, is changing every request. (The s= Parameter has no function on the website).

My guess is that somebody is posting many urls with the changing s parameter in a facebook chat or post window to make this requests. Maybe to crawl something or maybe DDoS the Website. BUT the request on our site even executes the JavaScript and gets tracked by GoogleAnalytics, in addition to this the useragent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?
Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?

Best withes and thanks in advance
Jared

jar3d
  • 31
  • 1