i'm pretty sure its attack. how to defend?

In my log file in matter of hours i can see tens of thousands of lines
137.159.128.245 - - [13/Oct/2001:02:12:52 -0400] "GET /?did=150&ver=1.51&duid=nxccfwekqqgtnsuinfdlitvyldaal HTTP/1.1" 200 16106 "-" "-"
137.159.128.245 - - [13/Oct/2001:02:16:52 -0400] "GET /?did=150&ver=1.51&duid=nxccfwekqqgtnsuinfdlitvyldaal HTTP/1.1" 200 16106 "-" "-"
137.159.128.245 - - [13/Oct/2001:02:20:52 -0400] "GET /?did=150&ver=1.51&duid=nxccfwekqqgtnsuinfdlitvyldaal HTTP/1.1" 200 13578 "-" "-"
137.159.128.245 - - [13/Oct/2001:02:24:55 -0400] "GET /?did=150&ver=1.51&duid=nxccfwekqqgtnsuinfdlitvyldaal HTTP/1.1" 200 13578 "-" "-"
137.159.128.245 - - [13/Oct/2001:02:28:52 -0400] "GET /?did=150&ver=1.51&duid=nxccfwekqqgtnsuinfdlitvyldaal HTTP/1.1" 200 0 "-" "-"
and similar. Almost all of them have did= (different versions) ver=(different values) duid=(seems random)
Multiple IP addresses in universities, europe, etc.
Anyone can give me any insight about this?

 

 

 

 

Top