Strange "" (quotes and single quotes) in my urls

Hello community,

starting on 2020/07/14 - 06:38:10 I saw some weird quotes and single quotes in my access logs, causing all sort of errors on my side.

A proper url in my site is
/noticia/$ID/$slug-for-seo
for example:
/noticia/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados

And I’m seeing in the access logs the following example hits:
2020/07/14 - 06:38:10 | /noticia"'/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados
2020/07/14 - 06:38:11 | /noticia/29Sssyrd"'/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados
2020/07/14 - 06:38:11 | /noticia/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados"'

Notice the strange "' in different parts of the URL. At first I thought it could be an issue on my side, generating bad URLs, but the timing of the requests (three in less than a second) made me think it’s a kind of bot or crawler.
I’m also getting proper requests as well, not only these with the quotes, so it’s not a general issue on my site.

So I grep’ed the URLs with strange quotes, extracted the IPs and these are the top hits:

count IP
33 162.158.122.190
33 162.158.123.83
31 162.158.107.157
31 162.158.123.245
31 162.158.167.16
29 162.158.166.39
26 162.158.107.11
26 162.158.122.238
26 162.158.165.234
26 162.158.165.46
25 162.158.166.113
24 162.158.107.197
23 162.158.166.137
21 162.158.106.28
21 162.158.111.155
21 162.158.165.16
20 162.158.166.123
19 162.158.107.161
19 162.158.165.202

Since these all look like Cloudflare IPs (https://www.cloudflare.com/ips/) I’m posting here, as it might be a crawler bug?

These are some of the user agents I get in these requests, just in case:

2020/07/15 - 13:19:29 | /noticia/K94O7Fmd"'/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36
2020/07/15 - 13:19:29 | /noticia"'/K94O7Fmd/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1500.55 Safari/537.36
2020/07/15 - 13:19:30 | /noticia/K94O7Fmd/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda"'

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36

(notice one again the consecutive requests in a very short time)

Have you seen a similar thing in your site? Could this be a bug on my side or should I contact support?
My site is www.mininoticias.com.ar

Thanks for your time for such a long post

Cloudflare does not scan your site. You get these IP addresses as you are not rewriting IP address on a server level. These are regular requests from clients.

And yes, you should rewrite IP addresses as you will otherwise never have the actual IP addresses in your logs. The search has more on that topic.

This topic was automatically closed after 14 days. New replies are no longer allowed.