[SOLVED] Stagefright - Exploit? - recurring requests for same files

Stagefright - Exploit? - recurring requests for same files

I get these following requests from useragent "stagefright" for some mp3 files in the webfolder, the IPs happen to be unique but the file names are always repeated (around 15 files are being requested), also these mostly come from older Android version devices but now i notice Android 10 as well.

I have blocked the access to user agent "stagefright" using.htaccess but by the time it caught my attention it had consumed a huge amount of bandwidth, I am not bothered by it as it returns 403 but can someone throw some light on these type of requests? This has been ongoing for more than a year now and is unique to only MP3 file requests.

Also, there is a burst of requests in a second for the same file/s multiple times. See log extract below.

84.65.126.81 - - [23/Apr/2020:15:53:37 +0400] "GET /xxx.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
47.184.9.3 - - [23/Apr/2020:15:53:37 +0400] "GET /xxx.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
73.90.23.108 - - [23/Apr/2020:15:53:37 +0400] "GET /SS007.mp3 HTTP/1.1" 403 227 "-" "Samsung SM-T350 stagefright/Beyonce/1.1.9 (Linux;Android 7.1.1)"
47.184.9.3 - - [23/Apr/2020:15:53:37 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
84.65.126.81 - - [23/Apr/2020:15:53:37 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
84.65.126.81 - - [23/Apr/2020:15:53:37 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
47.184.9.3 - - [23/Apr/2020:15:53:37 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
73.90.23.108 - - [23/Apr/2020:15:53:38 +0400] "GET /SS007.mp3 HTTP/1.1" 403 227 "-" "Samsung SM-T350 stagefright/Beyonce/1.1.9 (Linux;Android 7.1.1)"
84.65.126.81 - - [23/Apr/2020:15:53:38 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
47.184.9.3 - - [23/Apr/2020:15:53:38 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
84.65.126.81 - - [23/Apr/2020:15:53:38 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
47.184.9.3 - - [23/Apr/2020:15:53:38 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
84.65.126.81 - - [23/Apr/2020:15:53:38 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
84.65.126.81 - - [23/Apr/2020:15:53:38 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
73.90.23.108 - - [23/Apr/2020:15:53:38 +0400] "GET /SS007.mp3 HTTP/1.1" 403 227 "-" "Samsung SM-T350 stagefright/Beyonce/1.1.9 (Linux;Android 7.1.1)"
47.184.9.3 - - [23/Apr/2020:15:53:38 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
47.184.9.3 - - [23/Apr/2020:15:53:39 +0400] "GET /SS043.mp3 HTTP/1.1" 403 227 "-" "stagefright/1.2 (Linux;Android 8.1.0)"
84.65.126.81 - - [23/Apr/2020:15:53:39 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
84.65.126.81 - - [23/Apr/2020:15:53:39 +0400] "GET /yyy.mp3 HTTP/1.1" 403 221 "-" "stagefright/1.2 (Linux;Android 10)"
73.90.23.108 - - [23/Apr/2020:15:53:39 +0400] "GET /SS007.mp3 HTTP/1.1" 403 227 "-" "Samsung SM-T350 stagefright/Beyonce/1.1.9 (Linux;Android 7.1.1)"

Solution

Could not find the root cause of this incoming traffic but used ModSecurity to block all traffic with stagefright in user-agent