Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's a sample log that came from my apache access log

83.46.27.159 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
83.111.193.170 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
164.0.26.47 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
202.67.41.31 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
106.51.191.193 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
101.51.247.74 - - [29/Aug/2013:18:20:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
117.200.117.29 - - [29/Aug/2013:18:20:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
79.180.5.148 - - [29/Aug/2013:18:20:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
197.81.50.146 - - [29/Aug/2013:18:20:04 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
46.227.191.4 - - [29/Aug/2013:18:20:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.28.175.246 - - [29/Aug/2013:18:20:05 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
123.125.40.251 - - [29/Aug/2013:18:20:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
58.254.214.62 - - [29/Aug/2013:18:20:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
190.138.196.47 - - [29/Aug/2013:18:20:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
123.24.22.73 - - [29/Aug/2013:18:20:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
212.200.53.193 - - [29/Aug/2013:18:20:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.126.92.27 - - [29/Aug/2013:18:20:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
70.61.76.43 - - [29/Aug/2013:18:20:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
101.51.185.237 - - [29/Aug/2013:18:20:07 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
173.220.121.74 - - [29/Aug/2013:18:20:08 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
83.111.193.170 - - [29/Aug/2013:18:20:08 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
176.44.200.201 - - [29/Aug/2013:18:20:08 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
94.182.244.93 - - [29/Aug/2013:18:20:08 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
109.93.154.52 - - [29/Aug/2013:18:20:08 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
95.132.244.55 - - [29/Aug/2013:18:20:09 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
85.108.193.30 - - [29/Aug/2013:18:20:09 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
202.131.242.44 - - [29/Aug/2013:18:20:09 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
182.181.214.157 - - [29/Aug/2013:18:20:09 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
41.218.218.33 - - [29/Aug/2013:18:20:10 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
213.207.45.237 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
41.135.129.28 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
94.182.244.93 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
74.219.66.46 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
190.138.196.47 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
103.10.67.164 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
105.225.194.4 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
67.236.185.94 - - [29/Aug/2013:18:20:11 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
194.208.45.122 - - [29/Aug/2013:18:20:12 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
212.179.87.180 - - [29/Aug/2013:18:20:12 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
101.51.157.5 - - [29/Aug/2013:18:20:13 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
101.51.185.237 - - [29/Aug/2013:18:20:13 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
66.104.93.69 - - [29/Aug/2013:18:20:14 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
121.1.43.78 - - [29/Aug/2013:18:20:14 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
78.237.28.128 - - [29/Aug/2013:18:20:14 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
173.61.19.233 - - [29/Aug/2013:18:20:15 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.26.171.116 - - [29/Aug/2013:18:20:15 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
209.82.189.23 - - [29/Aug/2013:18:20:15 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
202.67.41.31 - - [29/Aug/2013:18:20:15 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.28.175.246 - - [29/Aug/2013:18:20:16 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
27.114.177.230 - - [29/Aug/2013:18:20:16 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

And I have no idea what is causing it.

share|improve this question

2 Answers 2

If your question is how to stop/prevent it, you could get fail2ban and configure it to jail apache.

share|improve this answer

Is this not only "unusual traffic" but also "unusually quite a LOT MORE traffic"?

Since the user agent ID seems to be the same in each of your pasted lines, I guess you found some script kiddies "attacking" your host.

share|improve this answer
    
Yeah and it's eating a lot of my server resources. I have not detected any malware either. –  Wilfred Aug 29 '13 at 11:20
    
Maybe contact your server's hoster if they can help you blocking that traffic for a while. –  vautee Aug 29 '13 at 11:22
    
I just did that. Thanks. –  Wilfred Aug 29 '13 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.