Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website keeps getting hit by odd requests with the following user-agent string:

Mozilla/4.0 (compatible; Synapse)

Using our friendly tool Google I was able to determine this is the hallmark calling-card of our friendly neighborhood Apache Synapse. A 'Lightweight ESB (Enterprise Service Bus)'.

Now, based on this information I was able to gather, I still have no clue what this tool is used for. All I can tell is that is has something to do with Web-Services, and supports a variety of protocols. The Info page only leads me to conclude it has something to do with proxies, and web-services.

The problem I've run into is that while normally I wouldn't care, we're getting hit quite a bit by Russian IPs (not that russian's are bad, but our site is pretty regionally specific), and when they do they're shoving wierd (not xss/malicious at least not yet) values into our query string parameters.

Things like &PageNum=-1 or &Brand=25/5/2010 9:04:52 PM.

Before I go ahead and block these ips/useragent from our site, I'd like some help understanding just what is going on.

Any help would be greatly appreciated :)

share|improve this question
An enterprising user over here ( took a look at the source for Apache Synapse. The UA header it uses doesn't match what your logs show. Further digging on his part turned up Ararat Synapse which DOES use that header. – Doug Wilson Mar 12 '13 at 14:35
See related question and commentary on this other stackexchange site,… – Funka Apr 18 '13 at 19:02
Whenever I google on this user agent, I come across this post so thought I should share some of my findings in case someone is looking for it. This a mostly a botnet attack and has nothing (or very little) to do with Apache Synapse project. – Sep 19 '13 at 10:06
up vote 11 down vote accepted

Are all the IPs from a specific range? Is that range assigned to a specific company? If it is, just lookup who the range is assigned to and contact the Technical Contact listed.

The most likely thing I can think of is that they are scraping content from your webpage or programming something which will scrape content (which explains the weird boundary conditions as arguments).

It could be something a little less innocent, I don't know what data you are trying to protect (it could be worth something). They could be trying to expose an error page which can dump sensative debug info. If that is the case then I would suggest setting up a web app firewall. They are made to prevent this kind of sensitive error messages and other abuses from happening.

You could just try banning the IP ranges and see who complains... although that's your last resort.

share|improve this answer
All site-errors are presented with a nice little "Site Error" page. If they're just scraping us, I don't care, it's that currently any time a user generates an exception that's unhanded it's logged to e-mail. I get 100+ a day from this guy alone. Of course the simple solution is to handle more errors, but this engine it seemed pretty fishy when i looked into it so i was concerned. – Aren B May 27 '10 at 23:10

I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, which is a Delphi TCP/IP library. I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and the default is :

enter image description here

On the other hand, Ararat Synapse has this default user agent :

enter image description here

It's just like one you have in your logs, and I have exactly the same user agent probing with various SQL Injection attacks. Probably the attackers are using some tool built in Delphi with the Ararat Synapse library.

Since the bad guys didn't change default user-agent, I think it's safe to block user agent:

Mozilla/4.0 (compatible; Synapse)

not partially because you can block some legitimate tool running on Apache Synapse, and I believe that any legitimate bot or project would define user-agent and not hide with default.

There is no point blocking IPs because it seems that atttack is comming from various IP adresses around the world, probably some botnet.

share|improve this answer

Same person trying to inject -1 into the viewstate:

finder-query: -1'

It's probably an automated SQL injection tester tool.

share|improve this answer
I'd even say, inject -1' (apostrophe is important) – billy Feb 12 '13 at 20:39

I have recently seen this User-Agent coming from one IP:

217.35.nn.nn - - [21/Feb/2012:07:01:22 +0000] "GET /view/pubcal.php?event=17' HTTP/1.0" 200 405 "-" "Mozilla/4.0 (compatible; Synapse)"
217.35.nn.nn - - [21/Feb/2012:08:06:31 +0000] "GET /view/pubcal.php?event=16' HTTP/1.0" 200 405 "-" "Mozilla/4.0 (compatible; Synapse)"

It was fairly shortly followed by a definitely malicious user agent (Havij):

217.35.nn.nn - - [21/Feb/2012:10:44:26 +0000] "GET /view/pubcal.php?event=1 HTTP/1.1" 200 6627 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij"
217.35.nn.nn - - [21/Feb/2012:10:44:26 +0000] "GET /view/pubcal.php?event=999999.9 HTTP/1.1" 200 2235 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij"

This was followed by several attempts at SQL injection.

Synapse isn't malicious in and of itself, but it does appear to be being used to probe data-driven websites. If your website does not offer an API to anyone, I'd block this User Agent. Maybe use the apache-badbots filter in fail2ban to block traffic from IP addresses which try to use this agent string. And stick 'Havij' in there, too while you're at it.

share|improve this answer

I have checked my database with over 75 million requests gathered by our security application and only found that user agent without any referrer URL.

Also, I can see that they hit various subdomains within less then a minute and a normal visitor couldn't navigate so quickly.

I count only 23 requests for that user agent so I've blocked the guys. Here the IP addresses from my sites:
share|improve this answer
It's probably using a botnet. I don't think banning those IPs would help anyone a whole lot. – Aren B Nov 1 '10 at 16:03
Except that all the addresses are dynamic IPs and you are blocking eventually paying customers... – ZaB Mar 9 '12 at 12:18

I've come here after searching for this user agent. A different IP ( but the same approach - every field from a form replaced in turn by -1[quote].

It's the only time I've ever seen it used, so I agree that banning it is the way forward.

share|improve this answer
For what it's worth, 'Apache Synapse' doesn't to this behavior. The tool being used has a similar agent string. I suggest you read the other answers for more information. – Aren B Sep 12 '13 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .