Hello community,
starting on 2020/07/14 - 06:38:10 I saw some weird quotes and single quotes in my access logs, causing all sort of errors on my side.
A proper url in my site is
/noticia/$ID/$slug-for-seo
for example:
/noticia/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados
And I’m seeing in the access logs the following example hits:
2020/07/14 - 06:38:10 | /noticia"'/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados
2020/07/14 - 06:38:11 | /noticia/29Sssyrd"'/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados
2020/07/14 - 06:38:11 | /noticia/29Sssyrd/coronavirus-en-colombia-hay-10-muertos-y-702-contagiados"'
Notice the strange "' in different parts of the URL. At first I thought it could be an issue on my side, generating bad URLs, but the timing of the requests (three in less than a second) made me think it’s a kind of bot or crawler.
I’m also getting proper requests as well, not only these with the quotes, so it’s not a general issue on my site.
So I grep’ed the URLs with strange quotes, extracted the IPs and these are the top hits:
| count | IP |
|---|---|
| 33 | 162.158.122.190 |
| 33 | 162.158.123.83 |
| 31 | 162.158.107.157 |
| 31 | 162.158.123.245 |
| 31 | 162.158.167.16 |
| 29 | 162.158.166.39 |
| 26 | 162.158.107.11 |
| 26 | 162.158.122.238 |
| 26 | 162.158.165.234 |
| 26 | 162.158.165.46 |
| 25 | 162.158.166.113 |
| 24 | 162.158.107.197 |
| 23 | 162.158.166.137 |
| 21 | 162.158.106.28 |
| 21 | 162.158.111.155 |
| 21 | 162.158.165.16 |
| 20 | 162.158.166.123 |
| 19 | 162.158.107.161 |
| 19 | 162.158.165.202 |
Since these all look like Cloudflare IPs (IP Ranges) I’m posting here, as it might be a crawler bug?
These are some of the user agents I get in these requests, just in case:
2020/07/15 - 13:19:29 | /noticia/K94O7Fmd"'/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda
User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36
2020/07/15 - 13:19:29 | /noticia"'/K94O7Fmd/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda
User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1500.55 Safari/537.36
2020/07/15 - 13:19:30 | /noticia/K94O7Fmd/el-gobierno-muy-cerca-de-definir-al-asesor-que-le-permitira-iniciar-la-renegociacion-con-los-acreedores-de-la-deuda"'
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
(notice one again the consecutive requests in a very short time)
Have you seen a similar thing in your site? Could this be a bug on my side or should I contact support?
My site is www.mininoticias.com.ar
Thanks for your time for such a long post