Log oddities: 404s for client-garbled image URLs
- by Chris Adams
I've noticed some odd 404s which appear to be broken URL rewriting code:
Our deep zoom view generates images URLs like this:
/media/204/service/dzi/1/1_files/7/0_0.jpg
I see some - well under <1% - requests for slightly altered URLs:
/media/204/s/rvice/d/i/1/1_files/7/0_0.jpg
These requests come from IP addresses all over the world (US, Canada, China, Russia, India, Israel, etc.), desktop and mobile users with multiple user-agents (Chrome, IE, Firefox, Mobile Safari, etc.), and there is plenty of normal activity in the same session so I'm assuming this is either widespread malware or some broken proxy service. I have not seen them from anything other than images, which suggests that this may be some sort of content filter.
Has anyone else seen this? My CDN logs show the first request on June 8th ramping up from several dozen to several hundred per day.
