links with RK=0/RS

enddDD
(@endddd)

9 years, 12 months ago

Hello,i have seen in seo 404 log files that i have a lot of 404 with links like this:

RK=0/RS=WHus6Oj4rLCUJUDyolIdn7E1XRg-
RK=0/RS=TB8oQ5K63pqC0JVe_zM7S5RMlgA-

And a lot of other strings. What is this? Can somebody explain?

Thank you

Viewing 5 replies - 1 through 5 (of 5 total)

kjodle
(@kjodle)

9 years, 11 months ago

A quick search on the google turned up these links:

https://isc.sans.edu/forums/diary/Web+server+logs+containing+RS/17803/
http://webmasters.stackexchange.com/questions/58871/strange-entry-in-access-log
http://rankexploits.com/musings/2014/it-q-rk0rsfoo-in-uri/

If, after reading that, you feel the need to block them (and you might), here’s a page with access on what to add to your .htaccess file:

http://stackoverflow.com/questions/22761208/htaccess-rewrite-rule-remove-everything-after-rk-0-rs

wnthne
(@wnthne)

9 years, 11 months ago

Would it not be a good idea to automatically block the IP address so the hacker does not just try other methods? If so, what code do I put into .htaccess?

authentictech
(@authentictech)

9 years, 11 months ago

@wnthne Your hosting control panel might have a feature for blocking IP addresses; otherwise use this:

<Limit GET POST HEAD>
order allow,deny
deny from X.X.X.X
</Limit>

doug wilson
(@dgswilson)

9 years, 8 months ago

the problem with blocking the ip is they change
I was just looking at the same /rk thing and they were switching the ip for each request (10, 20, 30 times…) if your servers set up right it’s just another 404.. or you can send them “request URI rk=” back where they came from using htaccess
wnthne
(@wnthne)

9 years, 8 months ago
Thanks to all for all the good input. This works for me. It strips RK= and whatever follows.
```
# Removes hacking attempts from url, such as: /RK=0/RS=AYp9kgWwyL1Te5LIMYeMtv4cBVQ-
RewriteRule ^(.*)RK= /$1 [L,NC,R=301]
```