Q:

DDOS-style requests from initially legitimate users of Firefox revision 52 (latest) -- extension causing it?

I wonder if anyone else has seen similar phenomena to what a site I help manage is experiencing.  For the last two weeks or so, about 10-15 times a day we will get thousands to tens of thousands of requests from a single IP.
These IPs are from all over the world, mostly the US.  They all use Firefox revision 52.
Here's an example from our logs:
[06/Apr/2017:11:58:10 -0500] XXX.XXX.XXX.XXX - - "GET / HTTP/1.1" 403 173 "[URL]" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"

The common part of all of these instances is: "WOW64; rv:52.0) Gecko/20100101 Firefox/52.0".  Sometimes the OS is different.
We get about 8-10 requests per second, and then it usually stops (it goes on long after our rate limiter gives them errors). I have seen it make up to 350,000 requests at once.
At first I thought it was from a botnet, since it kept popping up all over. But you'd think they'd do more coordinated attacks.
Then I dug in and realized that sometimes these visitors would browse the site, click an article, or read forum, and then the crazy requests would happen. The specific URIs have nothing in common.
I looked up the IPs of some of these attacks in our database and some are even legitimate community contributors.
My hypothesis is that this is caused by a browser extension that is incompatible in someway with Firefox 52, since it only happens with this revision.  The traffic does not seem malicious.
I wonder if anyone is seeing familiar "attacks," or whether anyone has an idea as to the cause.

A:

I suspect you are seeing symptomps of this Firefox bug:
Cached iframe executes previously loaded and dynamically inserted scripts, makes network calls before "onload" event.
This affects websites in an iframe. Does the website use iframes, or is it a popular-ish site that scammers could have embedded in an iframe?
Here is a comment from the bug:

I am working for AdTech company and after Firefox 52 we noticed increase (about 5x) in ad requests from Firefox browser, but actual number of ads our scripts are able to track left the same.

The fix is out but I would expect a lot of unpached browser for some time.
Looking at the user agent you provided, it doesn't seem to be providing fine grained patch level, so It would be quite hard to block these on server side.

