I'm seeing this in my logs.
Code
187.19.224.155 - - [03/Oct/2023:20:03:59 -0400] "GET /ubbthreads/ubbthreads.php/ubb/login.html?ocu=//www.stovebolt.com/ubbthreads/ubbthreads.php/ubb/addfavuser/User/8273/n/348617/p/1/f/1.html HTTP/1.1" 200 4105 "https://www.stovebolt.com/ubbthreads/ubbthreads.php/ubb/addfavuser/User/8273/n/348617/p/1/f/1.html" "Mozilla/5.0 (Linux; U; Android 2.3.7; zh-cn; MB200 Build/GRJ22; CyanogenMod-7) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"
What is the ?ocu= doing? iIs ocu an actual variable in UBB? Or are they trying to do something else with this?

Has anyone else seen this in their logs?

The Stovebolt Geek
https://www.stovebolt.com/ubbthreads/ubbthreads.php

Server Information
UBB.threads Version 7.7.5
Release 20201027
Server OS Linux
Server Load 0.16
Web Server Apache/2.4.6
PHP Version 7.4.33
MYSQL Version 5.7.43
Database Size 1.85 GB