Bombarded with hundreds of probably automated page refreshes every few hours

by

It seems like some Internet Explorer users are sending my web server hundreds of requests per minute (for a few minutes) to refresh the page with a user-agent like this:

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)

This is happening every few hours with a different user and IP. I noticed that all users that send this kind of request are have Media Center PC MSIE in their user agent. It is definitely not an attack because different signed-in users from different places are doing this. And it is not a public web-app. I have rate-limited per IP and it is not causing a problem at the moment, but I would like to prevent this from happening because it could cause problems if many users do this concurrently.

UPDATE

Every time the requests come from one valid IP of a user. I know who the user is each time. About 5-10 requests per second. For a few minutes. All requests are GET, the same URL is repeatedly fetched.

Here is my log of it happening for 2 minutes by one of the users after applying per-IP rate-limit:

xxx.xxx.21.130 - - [06/Jun/2015:13:35:31] "GET /login              HTTP/1.1" 200 5966  "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:37] "POST /login             HTTP/1.1" 302 109   "http://the.server.ip.address/login" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:37] "GET /                   HTTP/1.1" 200 10594 "http://the.server.ip.address/login" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:39] "GET /url0/info.json     HTTP/1.1" 200 7366  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:39] "GET /url1/info.json     HTTP/1.1" 200 54    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:40] "GET /homepage.json      HTTP/1.1" 200 26819 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:41] "GET /homepage.json      HTTP/1.1" 200 26819 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:41] "GET /url0.json          HTTP/1.1" 200 91    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:53] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:53] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:53] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:53] "GET /                   HTTP/1.1" 304 0     "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:54] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:54] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:54] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:54] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:55] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:55] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:59] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:59] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:59] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:36:59] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:00] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:07] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:07] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:08] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:08] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:08] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:16] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:16] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:17] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:17] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:24] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:24] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:24] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:25] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:25] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:33] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:33] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:34] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:34] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:34] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:44] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:45] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:45] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:45] "GET /url1.json          HTTP/1.1" 200 1025  "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:45] "GET /url4.json          HTTP/1.1" 200 41    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:55] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:55] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:55] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:56] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:56] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:56] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:56] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:57] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:57] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:37:57] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:06] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:06] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:06] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:06] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:06] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:16] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:16] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:16] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:17] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:17] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:17] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:17] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:18] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:18] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:18] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:18] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:19] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:25] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:25] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:26] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:26] "GET /url3.json          HTTP/1.1" 200 10255 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:26] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:41] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:41] "GET /url4.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:41] "GET /url3.json          HTTP/1.1" 200 10254 "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:42] "GET /url2.json          HTTP/1.1" 200 66    "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"
xxx.xxx.21.130 - - [06/Jun/2015:13:38:42] "GET /url1.json          HTTP/1.1" 304 0     "http://the.server.ip.address/#/homepage" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; .NET4.0C; .NET4.0E)" "-"

What is causing this?

UPDATE

Why is this getting downvotes?

Answer

Windows 7 Media Center (Media Center 6 User Agent String) has a remote code execution vulnerability patched August 2014. The fact your site is being subjected to contiguous/semi contiguous visits by the same type of PC implies BotNETs trolling the web with a fairly narrow criteria including just inventorying particular Web server headers along with attempting to GET particular files (frequently *.php) associated with a vulnerability.

Your not alone in your observations, (another web site operator posted a similar observation in Feb 2015)and chunked a portion of his logs to the posting. It could be worth comparing his excerpt to yours.
lowendtalk.com/discussion/22374/have-you-seen-this-user-agent-string

Media Center, in response to your observation of being oblivious to it, is a failed stand alone / quasi server intended to embed Windows into the home as a jukebox. It went through iterations as “Windows Home Server” nothing more than a veiled Microsoft IIS component that owners described as turtle slow compared the customary instant feedback of TV/Stereo controls along with providing a superb gateway of IIS server vuln’s into the home networks of semi affluent early adopters unaware they purchased a corporate version of Microsoft Server w/o the customary IT patch management.

Media Center, it’s offspring are currently shelved by Microsoft.

Attribution
Source : Link , Question Author : sina , Answer Author : user292744

Leave a Comment