Why is FunWebProducts flooding my server?

giorgio79 asked:

I have received 47 000 hits in the past couple of hours from a single domain. I researched FunWebProducts but it seems to be some kind of a plugin, not sure how this is possible?

89.70.25.120 - - [03/Sep/2012:07:19:12 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:13 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"
89.70.25.120 - - [03/Sep/2012:07:19:14 +0200] "POST /user/login HTTP/1.0" 200 18127 "http://xxxyyyzzzsitename.com/user/login" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; FunWebProducts; MRA 4.6 (build 01425); .NET CLR 1.1.4322; .NET CLR 2.0.50727)"

My answer:


Don’t ever trust the User-Agent string. It is ridiculously easy to fake.

And if you haven’t banned that IP address already, go do it now.


View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.