"url(" in the URL

been seeing a lot in my logs lately

[LifeinAsia]

Lately (occasionally in the past few months, more frequently in the last week or so), I've been seeing a lot of web server log entries like the following:

folder1/subfolder1/page1/url(&quote;http://example.com/folder2/subfoder2/page2

For the most part, they seem to be coming from legit users (ISP IPs instead of bots/server farms). A lot of them also seem to be coming from Spanish speaking countries.

Also, I'm only seeing this in Linux/Apache logs, not in Windows/IIS logs.

Has anyone else seen this and/or know why it's happening?

[lucy24]

Does it really say &quote; not " ? Or is that an artifact of posting?

Poring through my own logs, I find a lone occurrence of
url(
but it's a red herring, evidently caused by link checker getting confused about background layers in CSS, leading to:

HEAD /ebooks/second/images/backline.png%22),%20no-repeat%20center%20bottom%20/%206em%202px%20url(%22images/backline.png

(surprisingly, it got a 200 response, which I think involves the AcceptPathInfo setting).

You can see the quotation marks in there, rendered as %22

[LifeinAsia]

Does it really say &quote; not " ? Or is that an artifact of posting?

More likely an artifact of a brain fart- no e. :)

[lucy24]

Also, I'm only seeing this in Linux/Apache logs, not in Windows/IIS logs.

For the same site, running on some multi-layered server configuration? Or on different sites that happen to be on different servers? If it's different sites, then the different servers may be coincidental.

Continuing to look at my lone url(" example, I wonder if something analogous is happening in your visitors' browsers. In the case of the link checker, it looks as if it is set up to look for the url(" construction and then grab everything up to the last " in the line, rather than stopping at the first " it meets.

[LifeinAsia]

Different sites/different servers.