Strange things in the error log

subster · Aug 27, 2018

Hi there,

I faced some issues one of my sites and checked the error logs - never saw something like this before. Some chinese IPs keep on sending this stuff. Did you ever saw something like this in your logs?

too long: [client 137.226.113.10:57858] AH00036: access to /YesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScann failed (filesystem path '/home/so/web/XXX/public_html/YesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScann')

Couch Monkey Media · Aug 28, 2018

I am guessing you are running a Wordpress site right. I would have your web host to do a scan to make sure nothing has been added into your site. You could also ask them to block that location as well if it keeps hitting your site.

BlogPro · Aug 28, 2018

This is from a Research Study by RWTH Aachen University

http://researchscan.comsys.rwth-aachen.de/

You can block the entire subnet - 137.226.113.0/26 and it'll go away.

meHiduHo · Aug 28, 2018

what type of site are you hosting, why would they want to research you tho

subster · Aug 28, 2018

Seems to be a real "study" by a German university.

https://techglimpse.com/yes-this-is-a-really-long-request-url-apache-log/

Pretty annoying one, tho

meHiduHo · Aug 28, 2018

damn, germans doing something for study worldwide again...

Strange things in the error log

subster

Elite Member

Couch Monkey Media

Elite Member

BlogPro

Elite Member

meHiduHo

Newbie

subster

Elite Member

meHiduHo

Newbie

Main Menu

Marketplace

Making Money

BlackHat World