Mobile app version of vmapp.org
Login or Join
Becky754

: Clients requesting garbled URLs I've noticed some odd 404s which appear to be broken URL rewriting code. Our image viewer requests tiles using URLs like this: /media/204/service/dzi/1/1_files/7/0_0.jpg

@Becky754

Posted in: #Logging

I've noticed some odd 404s which appear to be broken URL rewriting code. Our image viewer requests tiles using URLs like this:

/media/204/service/dzi/1/1_files/7/0_0.jpg


I see some - well under <1% - requests for slightly altered URLs:

/media/204/s/rvice/d/i/1/1_files/7/0_0.jpg


These requests come from IP addresses all over the world (US, Canada, China, Russia, India, Israel, etc.), desktop and mobile users with multiple user-agents (Chrome, IE, Firefox, Mobile Safari, etc.), and there is often normal activity within the same session from the same IP address so I'm assuming this is either malware or a broken proxy / filter. I have not seen them from anything other than images, which suggests that this may be some sort of content filter.

Has anyone else seen this? My CDN logs show the first request on June 8th ramping up from several dozen to several hundred per day.

10.02% popularity Vote Up Vote Down


Login to follow query

More posts by @Becky754

2 Comments

Sorted by latest first Latest Oldest Best

 

@Ann8826881

Sometimes people will change URLs to see how your site responds. I've done this with several sites where I needed high-resolution reference imagery and figured that the site was scaling the images based on the REQUEST_URI. Sometimes (depending on the library being used) you can change things like dimensions, directories, and aspect ratios to get error messages (to tell you what someone is running on their server) and you can get larger (unscaled images).

Most sites that use the image scaling software do it for increasing the page optimization, and most users tend to upload images that are not scaled [down] from their original digital camera (sometimes now up to 24 mega pixels).

Another (more likely) possibility

Since the IPs are from all over the world, there may be a known issue with the software you're using and they're (using a botnet) trying to execute an exploit for a non-patched version.

10% popularity Vote Up Vote Down


 

@Merenda212

I believe that those are DZI (Deep Zoom Image) requests.
Does your app deal with maps? Most Likely Silverlight?

You are getting that because one of the collection images is missing or the DZI collection si not defined correctly.
msdn.microsoft.com/en-us/library/cc645022(v=vs.95).aspx

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme