Reviewing my logs, I found this odd request:
It does look like a valid request from Facebook. "facebookexternalhit" is used by Facebook to screen links people post for malware. However, the link "doesn't make sense". Doesn't really look like an attack to me, just weird. Any ideas how this may happen? ------
Johannes B. Ullrich, Ph.D. |
Johannes 4474 Posts ISC Handler Apr 7th 2014 |
Thread locked Subscribe |
Apr 7th 2014 8 years ago |
Just an observation from the GET statement, "basura-que-va-acumulando" is Spanish and it means "garbage that is accumulating".
|
Anonymous |
Quote |
Apr 7th 2014 8 years ago |
Some additional observations:
"brand=nokiaokseen" -- I believe it reads "Nokia Ok Seen" -- as in a Nokia device? "orderBy=Prezzo" -- may refer to a UK-based pizza place: https://en-gb.facebook.com/loveprezzo "%e0%b9%89%e2%86%90_%c3%96k%e2%98%bc%e0%b9%84%e0%b8%a1%e0%b9%88%e0%b9%84%e0%b8%8a%e0%b9%88%e2%99%a5His%c3%b6%e2%86%94ll%e0%b8%95%e0%b9%88%e0%b8%81%e0%b9%89%c3%b6%e0%b8%a1%e0%b8%b1%e0%b9%88%e0%b8%a2%e0%b8%94%e0%b9%89%e0%b8%b2E%e2%86%90n%c3%96%e2%86%90m%c3%96neY%c2%ae%e2%97%84%e2%97%84" -- equates to " ??_Ök????????Hisö?ll????ö???????E?nÖ?mÖneY®??" (via urldecode) EDIT: The character encoding on my last point doesn't really hold up here on the forums, but essentially it's a bunch of fancy font symbols which might actually form words (but I can't read them) where the "?" marks are displayed. |
Alex Stanford 136 Posts |
Quote |
Apr 8th 2014 8 years ago |
The part "fortumin-joensuun-voimalaitokselle" is in Finnish and could be a piece from a article/news which has something to do with a new powerplant which is being built to city of Joensuu for a company named "Fortum". The actual translation is "..to Fortum's powerplant in Joensuu..". Basically that is only a part of a sentence and doesn't mean much by itself.
|
Paul 13 Posts |
Quote |
Apr 8th 2014 8 years ago |
indeed its strange...
2a03:2880::/32 belongs to Facebook. Looks like advertisements on some Facebook account. Also, mention of Tehreek-e-Insaf is a pakistan political party. looking at the GET request it is indeed suspicious but no flags that suggests attack or an anomaly. |
makflwana 17 Posts |
Quote |
Apr 9th 2014 8 years ago |
Sign Up for Free or Log In to start participating in the conversation!