I wonder if anyone else has seen similar phenomena to what a site I help manage is experiencing. For the last two weeks or so, about 10-15 times a day we will get thousands to tens of thousands of requests from a single IP.
These IPs are from all over the world, mostly the US. They all use Firefox revision 52.
Here's an example from our logs:
[06/Apr/2017:11:58:10 -0500] XXX.XXX.XXX.XXX - - "GET / HTTP/1.1" 403 173 "[URL]" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
The common part of all of these instances is: "WOW64; rv:52.0) Gecko/20100101 Firefox/52.0". Sometimes the OS is different.
We get about 8-10 requests per second, and then it usually stops (it goes on long after our rate limiter gives them errors). I have seen it make up to 350,000 requests at once.
At first I thought it was from a botnet, since it kept popping up all over. But you'd think they'd do more coordinated attacks.
Then I dug in and realized that sometimes these visitors would browse the site, click an article, or read forum, and then the crazy requests would happen. The specific URIs have nothing in common.
I looked up the IPs of some of these attacks in our database and some are even legitimate community contributors.
My hypothesis is that this is caused by a browser extension that is incompatible in someway with Firefox 52, since it only happens with this revision. The traffic does not seem malicious.
I wonder if anyone is seeing familiar "attacks," or whether anyone has an idea as to the cause.