For the past few weeks, I am observing a lots of visits from a specific user-agent -
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 to one particular URL.
The user-agent corresponds to chrome 84 on windows 10 desktop. This browser is an old browser and the overall contribution to traffic is lesser than 1%. But for the particular URL I am speaking about, 95% of the traffic is from this user-agent. Bounce rate is 100% for these visits. What is more confusing is that all the visits are from unique IPs and I couldn't find a pattern (like common location, revers DNS host, etc.,) in them.
I am clueless about where to start and how to proceed. Could this be a bot activity? If so, is there a way to find and prevent using firewalls like mod_security.
P.S: I am using apache 2.4 server with mod_security and OWASP ruleset 3.3.