Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?

89.70.25.120 - - [03/Sep/2012:07:19:12 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:13 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:14 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
share|improve this question
1  
That looks like a spam bot to me. It could be a brute force bot but I'd want to see more traffic to be sure. Whenever you see "MSIE 6.0" these days, it's nearly always a bot. –  Ladadadada Sep 3 '12 at 6:13
    
How could we possibly know why anyone is flooding your server? –  John Gardeniers Sep 3 '12 at 7:37
    
I am more curious why FunWebProducts would do such a thing. I guess if an individual wants a reason they will surely find one :D FunWebProducts looked like a legit product...I now understand this may have been a fake header for a spamcrapper. –  giorgio79 Sep 3 '12 at 8:55
add comment

1 Answer

up vote 6 down vote accepted

Don't ever trust the User-Agent string. It is ridiculously easy to fake.

And if you haven't banned that IP address already, go do it now.

share|improve this answer
1  
But why would someone fake a unique, obscure piece of software that is apparently associated with spyware? –  Fake Name Sep 3 '12 at 7:52
    
If you want to fake a user-agent, I would expect someone to spoof a common user-agent string. –  Fake Name Sep 3 '12 at 7:53
    
Common user-agent strings are too common, I suppose. –  Michael Hampton Sep 3 '12 at 7:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.