Some users reported that they have an issue when visiting our website. There are some strange subdirectories that these users are being redirected to. I have googled a lot but never found an explanation to this issue.

I have noticed that some bots such as Yandex and Bido are affected by these subdirectories.

Examples from IIS logs is as below:

Line 3065: 2016-03-28 01:36:55 GET /QYkZf/USMLg/afWLO/EN/********/NEWS - 80 - Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+fr;+rv:1.9.2)+Gecko/20100115+Firefox/3.6 404 0 0 0
2016-03-28 02:11:06 GET /cOaOL/pYjOi/iTQZT/SSKTY/LWVVo/LlVWe/KMNSn/eoNWO/lffKo/SmKNZ/WKOXS/Ar/***/News/171-ar-17-9.htm - 80 - Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp) 404 0 0 15

There are many entries such as these. If more information is needed please ask.

I have read about the cockieless session state but this does not look like cookieless to me neither it is configured to use that.

We have SharePoint 2010 and windows server 2008 R2.


I am not sure, but I will bet on some bot doing some sort of canonical attack (trying to brute force private URLs).

  • I can agree to your point if the issue was not affecting the end users. Jan 30 '17 at 1:53
  • Do you have any custom solutions installed on the farm? Maybe an erroneous solution is causing the issue? Feb 2 '17 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.