Lots of identical POST requests to **/edit?

S

StopDesign2013-06-27 21:12:28

Opera

StopDesign, 2013-06-27 21:12:28

I see a lot of identical POST requests in the logs. It usually starts with a live user viewing some page page , and then starts POST requests to page /edit. Since I don’t have such a page, endless 404s like this appear in the logs:

[27/Jun/2013:14:20:06] ***.ru 0.019s &quot;POST /page/edit HTTP/1.1&quot; 404 1678 &quot;http://***.ru/page/&quot; &quot;Opera/9.80 (Windows NT 6.1; WOW64; MRA 5.9 (build 4832)) Presto/2.12.388 Version/12.14&quot;

The request rate sometimes reaches 8 per second. Each session lasts several hours. Sometimes my scripts ban it for too much frequency.
I do not think that there is any harm from this flood in the logs. I'm just wondering: what the hell is this? Why does someone's Opera (most often Opera) make tens of thousands of requests to non-existent pages of my site? I found only one mention of a similar situation on the Internet, but there are no answers to my questions.

Reply

Answer the question

In order to leave comments, you need to log in

3 answer(s)

V

Vlad Zhivotnev, 2013-06-27
@StopDesign

This is the application of these bad people - everysale.net/
More precisely, their plug-in for the opera.

L

Lihonosov, 2013-06-28
@Lihonosov

We have the same problem. Moreover, they noticed it after the DDOS attack, I thought it was her “echoes”, because. the address is always the same, but after the ban of this address, it changes after a while. Banned in iptables like this:
iptables -I INPUT 1 -p tcp --dport 80 -m string --string "POST /url/edit" --algo kmp -j DROP

K

KingOfNothing, 2013-06-27
@KingOfNothing

Do all requests have the same IP? Surely there is no script on the site that sends these requests?