Starting in early September (maybe) our customers (thousands across the US) started experiencing "random" 5 character alpha paths being appended to their URL requests with 302 responses intermittently when requesting the root of their domains. We have been exploring all possibilities, including malware, updates to hardware and software, and have not been able to find the cause.
Has anyone else experienced this issue, and found the cause?
Happy to provide more details of the environments as needed. Some details may have to be provided via PM.
Sample Paths
domain.com/OUZPZ/
domain2.com/LVQgZ/
domain2.com/UpTZZ/
domain2.com/WNZOR/
domain3.com/UncLZ/
domain4.com/SVpjZ/
domain4.com/WOVRZ/
domain5.com/NcmUZ/
Curl Path
curl -IL domain.com
HTTP/1.1 302 Found
Connection: close
Pragma: no-cache
cache-control: no-cache
Location: /WQiNZ/
HTTP/1.1 302 Found
Connection: close
Pragma: no-cache
cache-control: no-cache
Location: /ToNLZ/WQiNZ/
HTTP/1.1 302 Found
Connection: close
Pragma: no-cache
cache-control: no-cache
Location: /WQiNZ/
General Notes
- We only see this happen in person on sites with SSL enabled.
- Wordpress multisite installs.
- GoDaddy customers are experiencing this issue with their forwarding service as well (see links below).
- We only use GoDaddy as the domain registrar, and use an internal DNS name server system based on AWS route53.
- When we audit our server logs, we see many more URL paths of this
type. They stretch all the way back to April of this year (2017), but most
of them have a google bot user agent
- Regex for search:
/\/[a-zA-Z]{5}\//
- Regex for search:
- Both our company security team, hosting provider, and Sucuri have audited the environments and have not found any malware.
- Plugins audited for functionality and nothing found.
- Using Let's Encrypt SSL certs.
- Google and hosting provider say it does not have to do with DDoS protection in their environments (see reddit thread below).
- The only commonality so far between Godady and our environments are linux boxes.