1

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?

89.70.25.120 - - [03/Sep/2012:07:19:12 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:13 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:14 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
3
  • 1
    That looks like a spam bot to me. It could be a brute force bot but I'd want to see more traffic to be sure. Whenever you see "MSIE 6.0" these days, it's nearly always a bot.
    – Ladadadada
    Sep 3, 2012 at 6:13
  • How could we possibly know why anyone is flooding your server? Sep 3, 2012 at 7:37
  • I am more curious why FunWebProducts would do such a thing. I guess if an individual wants a reason they will surely find one :D FunWebProducts looked like a legit product...I now understand this may have been a fake header for a spamcrapper.
    – giorgio79
    Sep 3, 2012 at 8:55

1 Answer 1

6

Don't ever trust the User-Agent string. It is ridiculously easy to fake.

And if you haven't banned that IP address already, go do it now.

3
  • 1
    But why would someone fake a unique, obscure piece of software that is apparently associated with spyware?
    – Fake Name
    Sep 3, 2012 at 7:52
  • If you want to fake a user-agent, I would expect someone to spoof a common user-agent string.
    – Fake Name
    Sep 3, 2012 at 7:53
  • Common user-agent strings are too common, I suppose. Sep 3, 2012 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .