Forum Moderators: phranque
Over the past few weeks, I've been getting a lot of wierd traffic in my 404 log like this:
http://11.22.333.44411.22.333.444/thank-you.aspx?ticket_num=ca-nnnnn&firm_name=nnnnnn
when the user should have been POSTed from another site to:
http://www.example.com/thank-you.aspx?ticket_num=ca-nnnnn&firm_name=nnnnn
11.22.333.444 is the IP of my server. (I've removed the querystring data to protect my user).
I only seem to get this on POST requests, never on regular get requests. I originally thought that this was due to a poorly written link submission bot, but this one was clearly from a real person. Maybe a messed up proxy server?
Has anyone else seen requests with a doubled up server IP instead of a hostname like this before? Any idea what may be the cause.
Thanks,
Tristan
[edited by: encyclo at 6:50 pm (utc) on July 29, 2007]
[edit reason] obscured specifics [/edit]
Are you using a script you wrote yourself, or something by a 3rd party? Is there any other info you could give us?
