128.121.20.46 rapidly requesting nonexistent pages

28 attempts in 4 seconds

[jazzguy]

Strange behavior coming from 128.121.20.46. A bot/visitor hit my home page, did not request any images, css, javascript, etc. Then it proceeded to rapidly request nonexistent PHP pages with common names. A total of 28 404 requests in the span of 4 seconds. No valid requests. Didn't follow any actual links.

The initial home page request had a blank referrer and a blank UA. The rest of the requests had a typical "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)" UA.

There's no reverse dns configured for 128.121.20.46. The block owner is Nexpoint Technologies Inc. (NETBLK-C052-128-121-20-0) C052-128-121-20-0 128.121.20.0 - 128.121.20.255, who appear to be a web host.

[DaveAtIFG]

It sounds to me as if someone is "experimenting" with a spider or a web page indexing system and it "got away from them" for a few seconds.