Invalid_Viewstate-Errors and strange usage patterns in logs

[AndreasJ.Mueller]

Hi

Since we have moved our application (.NET 1.1) to a new server a few
weeks ago we have seen in the event-logs multiple errors (which in
itself is not my current problem, so I no Server.Transfer-Comments).
What seems very strange is that each corresponding request shows as
user agent "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4" even though the requests
come from different IPs from all over the world.

Furthermore the request is strange in that it only has a POST (to our
simple project search) without having accessed this or any other page
on our server first (GET). I see no other instance of POST to the
search except for those specific cases. The Viewstate by the way is
exactly what you would expect from this page seen with Firefox
(including the MAC at the end), so probably something else in the
return-string has been doctored with. Don't think we can have
EnableViewStateMac set to false on the server (it might have been
disabled on the old server, though).

Even if it were a form of attack (SQL-Injection or else) it would seem
strange to me that each case shows a user-agent and even has the same
user-agent.

Any ideas what this could be? Did I miss an existing discussion on
that?

Kind Regard
Andreas