Anyone seen these before? Not sure if this is related to Google Analytics or UserFly running on our site or indicative of automated attacks from user machines.
The requests come from users with all user-agent strings, and from users who make legitimate requests and from trusted users. I've matched the string in a mod_rewrite rule to return "forbidden" but I would like to know where these are coming from. They come in waves, nothing for a week or more, than many many requests in one day.
The requests are for many random pages on the site and then have this odd query string appended, which varies but always looks something like:
"GET /&data=%7C%23ujnftubnq%23%3B2392714553497-%23fwfout%23%3B%5C%5E-%23efubjmt%23%3B%5C%5E-%23ujnft%23%3B%5C%5E~ HTTP/1.1"