0

I've been getting thousands of requests each day from a specific user agent, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0. They're all from different ip addresses (the ones I've looked up have been Google LLC and Cloudflare), and they all use that exact same user agent. nginx logs So far I've seen 90 unique ip addresses

ip count

I've started giving 403 statuses back to them, since it seems like something is wrong here, but I can't trace them back to any one specific point. They all seem to be legitimate requests, but they're just so suspicious with the amount of servers they're coming from. Am I missing something here?

Improve this question
1
  • Why do you think they are legitimate? For a start there is no referer and thise URLs look like md5 sums. Has the site been compromised? What was being returned prior to your 403? Why are you returning a 403 rather then a 404? Its not uncommon for attacks to use a pool of compromised IPs. Have you considered fail2ban to reduce the impact? – davidgo Apr 5 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.