Googlebot Random HTTP-GET Requests 1

Posted by JD 08/19/2011 at 21:00

I was going through the blog server logs today looking for odd, unexpected requests. Attended a Linux Security Meeting last evening that has me thinking … I see all the normal myphpadmin / dbadmin requests and other hack attempts for tools that we don’t use here. All the index.php requests are worthless / harmless. In the 404 list were lots of random strings requested at the top level of the blog. To me, these strings look like passwords from some password management tool. Hummm.

A few examples:

  • /d0ZX8m+pfnut+om+EDkVcP6P7NkIFNJZwGnFGC3Cf4=
  • /UbOQSJY3d3BRN0B1vqoYvURC/lPAR57ux+jbAaplOU=
  • /h795oDD2nl+YBxO1Rd6lSy+INmXqf9ZwAR/kL7Nsto=
  • /Opb43x4uiN1qhpgpmG2pilkYAfqVh9Up0FVZcskdlc=
  • /91NnupS9tEDNtRg2ENRyG5MuQg33KykPjIPgOxP1B4=
  • /4RBxH9ECaHZaUTLehkvpG3XGAP0I7avBzdjszjEGQw=
  • /ys8955MfrX8gWe795kseyTY2lecIT9MmKuiwCJOaMM=
  • /ZVsXXT/1HyQRYSQANAFwtwUD0FV+AOOtwlv07GSWEM=
  • /FXaDR7zR9Vfg74gggAoffVTyw15B2pYRq1Z7yDAwR0=
  • /JuYvUYjAOSPtl5DiKMgN+MKSVz0idfeJqZcWTHI9Cg=

What does that look like to you? There are many others. Since they are the same length and always end with the = character, that makes me think these are generated by some system. Time to dig into the logs, yuck. I really need to get splunk running here. Remote into the server where logs are placed and gunzip all the typo related logs. Then pick a substring from the suspects and grep.

$ grep JY3d3BRN0B1vqoYvURC  typo.

Ah – *googlebot. I check a few others too. They all say googlebot even when the IP addresses are different. Google has 100,000+ web crawlers, so seeing different source IPs is common. I match the IPs with a whois – all Google, Inc. Interesting.

I guess those could be session cookies from the blog software that google isn’t properly parsing and using correctly. The session IDs aren’t that length however. Humm.

It isn’t like I’ll block Google, but I do block other web search engines for abusive attempts. We don’t use google-analytics and don’t have a google-app-id. I’m a little confused why the search engine would throw crap requests here. Are they looking for malware or dangerous server setups? I googled for an answer for a few minutes and didn’t find anything.

Anyone have ideas what is happening?

  1. Gerard 06/26/2012 at 11:17

    The same is happening to us with query params like:

    opc=articulo&fam=ezhessjhb&subf=gmgyzmda&cod=ifahoqcfyy&txt=wiuvhfpktuchlngtalrvrlgy&marca=fqrivvucybtgl&alt=iUZKyxqDBm77382;
    opc=articulo&fam=oiyanma&subf=ancyfzhi&cod=keymgampyt&txt=wgqsvjopkatttrig&marca=zapjzxiyzszkptsn&alt=e0JuYw4AOuj0jWK6Iaui;

    It seems to be an IP Spoofing attack. Any ideas?….