Weird Malware URL Reporting

[BPry]

Has anybody else noticed that their botnet report is triggering on weird URLs that couldn't actually exist. I've listed some examples but I can't figure out why some of the URLs being reported are so clearly 'wrong'. 

Visited malware URL 8M{zy!ces{~yeo{au?qfg.>Kcf~%7fwze%7fm%20}crzfeg!~znbe?mk%7fi%20}%7feca$lbkez|5#T82<:59<#%207;L-`bm2xefy/8M(<I5#T~}|~znbe``h~bh%20l%7f|7;Lfec`jc~fh'x!~mg%7f~~$y%7fm%7fztpfl'x|x||=w{nb%7f%7f(<I!)%?2<?>?*W4z7bv}`~v#v$8j=<m?$r

Visited malware URL 8Miczjbes`dficz*Ws{~x)?Hcq<w}'ha%20a|sp`z'ecykm%7f~y$geoxb{i<%209;<<?<8=bffxrezb|7~fi6dyz%7f5S,8M)?Hxgf<ek%7fe`k|>r}d/9Jh`{ucfhceah`{5#Thx%7f%7f(<I|p?l~&o`#`crs{y&bbzjr~}b'fbn{cdh?;::;=<='<a}eyu#f{}}4z7bv}c{w!t$2<oh?6)'

Visited malware URL 9J)?B%204A|~cxxdp|(dgd/9J`kkosg{n%7f?#tmv;Oc.?It6Y5-;<~~a!6Bo|}z.?L!7@:O~|e~plr~&jef)?Bqnb%ek%7fi~p(oi%kojyy}(rumgnx)?B#jhk4b%7fx}!6G:O/9Jyslusa}s%obi%204A|ao&`lp`us%`d&nhepr~%}xnbiw%204A

Visited malware URL 3@'1B%204A%7f~w/pf`aos&jol'1Bw#5Nhlm'1B#jhk4huvs!6G:O=tsr(nfmeqgm``hs&jo/wh!7@im~s$0Esjtkl,2Gcnawodiz=tllrb%aotqf)aiiied,vqqhv*xeaovf`(`fcl-rvlv|+telas/skiosajo,pftjtsm{-mgbov+pizhhldpjh*mqalkmaw+f??02235+nsee&r?j~ukqbz3,f:6`b>ih

[pulukas]

I've not seen these personally, but they look like they are worth reporting in an official support ticket.  Seems likely to be a bug they will need to work on.

[BPry]

Actually this appears to have vanished with time. I'm not sure why it started reporting correctly again since it corrected itself prior to any interaction from myself. I have restarted since then and haven't seen it come back at all. 

[GHoffman]

I agree. Mine has also corrected on its own. Not sure why.

[BPry]

@GHoffman glad to know I wasn't the only one affected, hadn't seen it getting reported anywhere. 

[GHoffman]

I was also glad that someone else was experiencing the problem. I reported yesterday that the problem seemed to have gone away, but I had some pop up in this morning's botnet report. I sent in a ticket.

[BPry]

@GHoffman, That's awesome as this morning I actually saw them pop back up again as well. The funny thing is they report perfectly fine this time in my logs, and the same URL was fine for other clients, so not exactly sure what's going on with it. 

[Brandon_Wertz]

My botnet reporting is still showing the crazy URL syntax as well.  Not on every suspected entry though.

[BPry]

@Brandon_Wertz ya it appears to have come back within the last few days for some reason. I would say likely 70% of my entires show fine and the rest will be crazy and unusable; however I can look in my logs and see that it records the correct data for the entry. 

[BPry]

Hey all; so i've been looking through this and it appears that all of my weird entires are from fqtag.com, and it's only listing the last section of the URL which is why it looks so god awfully weird. I've open a case to see why it's doing this and not showing fqtag.com/whatever so we can at least verify what domain they are going to.