Not sure what to make of these URLs

What sort of URLs are they? Most browsers should tell you a type (redirect) - could that provide more clues?

Also, what about cookies? They could be tracking GUIDs.. perhaps?

Has anyone seen this before?

Not sure I understand the question. You can see just about any kind of query out there – why should a query with a GUID be any different?

Or are you assuming that queries must have a particular form? Like ?param1=value1&… ? (There are some source on the net that claim so, I see, but those are usually special cases.) Check RFC 3986 – which I think is the latest – for the real story.

Or … ?

Any insight into what these links mean or where they might come from would be appreciated. Are these likely pop-ups from another site or adware program?

URLs are URLs. As long as the conform to the URL specification, they work as specified (modulo bugs).

In this case, these particular URLs are relevant for this particular web server. Most likely they come from the server itself check JavaScript resources, or HTML resources or whatever other resources are present.

Or, wildly hypothetically, they could come from some kind of access application, distributed separately. That way, you can't just stumble over the web server or find its data in Google you need to have the access application. And if you have only the access application, but not the server, you may not be able to confirm that it contains what it claims to contain.

Or perhaps they're results of some kind of local proxy/cache setup?

Athulin,

I wasn't concerned about the queries being in the form http//site/?GUID vs http//site/?p=something. My confusion comes from the fact that the user will visit site.com/GUID and will only request that single URL from the site without any other visits to the site or any searches related to the site. The user usually hits two or three sites (gambling or porn) in within one second of each other all in the site.com/?GUID format. I'm sure he is not typing the addresses in, he doesn't appear to be searching for them, and he isn't on a pornography or gambling related website prior to or after hitting these URLs.

If the user did a Google search for some related terms or visited http//www.site.com then http//www.site.com/?GUID, that would provide the context I'm looking for.

My confusion comes from the fact that the user will visit site.com/GUID and will only request that single URL from the site without any other visits to the site or any searches related to the site.

That suggests that the URLs are delivered in another way.

If you're lucky you could find them in other cached web traffic (possibly encrypted), or an executable, or pagefile or unallocated areas, but I assume you have already covered that.

Removable storage – is there any correlation between the state of removable storage and the requests? A cell phone connected, perhaps?

Or … is there some malware installed that retrieves the UIDs from an external site, and then requests the URLs as they are received?

You presumably have a point in time when this started. What relevant things correlate with that? I'd look for startup programs or browser plugins installed around then.

My confusion comes from…

Based on what you've shared so far, I'd have to agree with Athulin…if you see URLs in logs that originate from the box in question, but find no indication that those URLs were the result of actions taken by the user, you should probably consider looking elsewhere…adware or malware, perhaps.

…..
What I did find is that the user has been downloading a number of emulators for video game consoles (e.g. NES, SuperNintendo) and games for them. I haven't had time to run any of them to check their behavior….

Here is an analysis of a fake PS3 emulator, published in the german magazine "heise.de", one of the leading IT publishers in Germany
http//www.heise.de/security/artikel/Analysiert-PS3-Emulator-im-Schafspelz-2583457.html

To make a long story short and translated
- faked PS3 emulator promising playing games
- faked emulator software opens several "adult" and gaming websites
- developer of the faked emulator makes money using a "Affiliate Program", the connections to sites/advertisments are coming from infected computers

Does this sound familiar to you? D

best regards, Robin