I just recognised a peak in our access logs and I'm curious how to explain this or if my suggestion how to explain is right.

There about 600 requests in 3 minutes with a referrer like this:

`http://l.facebook.com/l.php?u=http%3A%2F%2Fwebsite.tld%2F%3Fs%3D23842660217050537&h=ATPGZAKFqpZ7hfY6SgKTDAE3WGgI7-kgN1nq8GtniXf-mxzE8aeMvjTbcze7mNvbjYZrOI5FDHiZa-VwQiW3_jN_sndIh71MOAg5yYrOFoo`

The number in the `s=` parameter within the `u=` parameter, in this case `23842660217050537`, is changing every request. (The `s=` parameter has no function on the website).

My guess is that somebody is posting many URLs with the changing `s` parameter in a Facebook chat or post window to make these requests. Maybe to crawl something or maybe DDoS the website. BUT the request on our site even executes the JavaScript and gets tracked by Google Analytics, in addition to this the user-agent and the request language changes with every request. The IP Range those requests where made from are Facebook owned addresses.

Isn't facebook doing a rate limiting for those requests?

Is this some kind of extremely ineffective reflection attack or more likely an attempt to crawl our website with requesting the same page?