404 errors in log showing urls with 'GET', plus and numerical code

Question

My wordpress logs show 404 errors to URLs having the following pattern:

http://example.com/path/++GET+http:/example/+0,48595,73506+-

Web searches do not return answers because of the plus and minus symbols. Note that the second http is followed by a single slash. Accessing my site with a corrected URL (where I use a double slash after the second http) returns a 404.

My logs show fifty errors each day from different IP addresses, where each IP address tries the same file three times.

I am curious to know what type of exploit this may be. It seems to have something to do with the GET request method.

Ideas?

Answer 1

Maybe it is just a stupid bot. I have daily 404s from different IP adresses trying to access urls like http://www.example.com/http://facebook.com/ or http://www.example.com/sms:+43123456789. The user agent of the bot I always see is something like Java/... This bot tries to follow all links, href, src, etc he can find.

Check if you maybe have the text (+0,48595,73506+-) somewhere on the referring page and what user agent is sent.

PS: If you want to search for something with a minus you can quote in on google like site:example.com "-text" will search for text on example.com which that contains "-text". However, I think this will only find visible text on your page and not links, etc.