nginx access.log long comma separated GET requests - security

Question

I am not sure yet, but I am seeing lots of what looks like attacks using the pagepeeker API (based on the source IP addresses). Granted it could be a problem with my nginx, haproxy load balancer, or php-fpm configurations.
Has anyone seen something similar? I have removed my domain name and replaced with an example domain in the log example below.
144.76.235.110 - - [06/Jul/2014:01:20:15 +0100] "GET /wp-admin/network/,%20https:/www.domain.org/wp-admin/network/,%20https:/www.domain.org/wp-admin/network/,%20https:/www.domain.org/wp-admin/network/,%20https:/www.domain.org/wp-admin/network/,%20https:/www.domain.org/wp-admin/network/,%20https:/www.domain.org/wp-admin/network/ HTTP/1.1" 301 5 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.4 (KHTML, like Gecko) Chrome/22.0.1229.94 Safari/537.4"
this is one of the virtual host files in question. Have have not seen a re-occurrence of the errors as yet.
NOTE: My SSL termination is done by HAPROXY.
server {
listen 127.0.0.1:8080;
server_name ftmon.org;
port_in_redirect off;
return 301 $real_scheme://www.ftmon.org$request_uri;
}
server {
listen 127.0.0.1:8080;
port_in_redirect off;
server_name www.ftmon.org;
root /home/wpmsite/domains/ftmon.org/public_html;
access_log /home/wpmsite/domains/ftmon.org/logs/access.log main;
error_log /home/wpmsite/domains/ftmon.org/logs/error.log error;
index index.php index.html index.htm;
autoindex off;
pagespeed on;
# Allow pagespeed to bypass the load balancer (HAPROXY)
pagespeed MapOriginDomain http://127.0.0.1:8080 https://www.ftmon.org;
pagespeed MapOriginDomain http://127.0.0.1:8080 http://www.ftmon.org;
# Allow pagespeed to bypass nginx
# pagespeed LoadFromFile http://www.ftmon.org /home/wpmsite/domains/ftmon.org/public_html;
# pagespeed LoadFromFile https://www.ftmon.org /home/wpmsite/domains/ftmon.org/public_html;
include /etc/nginx/common/pagespeed.conf;
# Rewrites for my reset site move to fresh multisite install.
rewrite ^(/files/)(.*)$ /wp-content/uploads/$2 permanent;
rewrite ^(/wp-content/blogs.dir/22/files/)(.*)$ /wp-content/uploads/$2 permanent;
location / {
try_files $uri $uri/ #wpmulti #memcached /index.php$is_args$args;
}
include /etc/nginx/common/locations.conf;
include /etc/nginx/common/wpcommon.conf;
#
# caching solutions
#
# include /etc/nginx/common/wordfence.conf;
include /etc/nginx/common/wpffpc.conf;
}

Answer 1

I solved my problem by disabling Pagespeed.
pagespeed off;
Also, in wordpress I added the following to wp-config.php
define('ADMIN_COOKIE_PATH', '/');
define('COOKIE_DOMAIN', '');
define('COOKIEPATH', '');
define('SITECOOKIEPATH', '');
I might wait for nginx pagespeed code base to stabilize more before revisiting using it again with wordpress multisite when using a network plugin such as network+.
NOTES
The redirect loop only impacted the main site in multisite wordpress with the network+ plugin installed. The other sites in the multisite were fine.
The problem only occurred with thumbnail services (and only with some of them), which made me initially think someone was using these services for attacks.
The website thumbnail service was caching pages (even error pages), so it was very difficult to debug and test possible fixes.
It's interesting that the redirect loops contained a single / for the http/https redirect addresses i.e. ,%20https:/ rather than ,%20:https//.