118.173.143.171 - - [14/Dec/2011:13:47:06 +0000] "GET /index.php HTTP/1.1" 200 5103 ".ontcpflood=176.9.208.104:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"
118.173.143.171 - - [14/Dec/2011:13:47:06 +0000] "GET /index.php HTTP/1.1" 200 5103 ".ontcpflood=176.9.208.104:80" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"
118.172.34.179 - - [14/Dec/2011:13:47:07 +0000] "GET /index.php?app=core&module=global&section=register HTTP/1.1" 200 26148 ".onudpflood=176.9.208.104:21" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

Hello, I am receiving a lot of syn and tcp floods. In logs they all have the following in common:

".onudpflood=176.9.208.104:21"
".ontcpflood=176.9.208.104:80" "

How do I block that? It is neither referrer nor useragent?

Regards,
Prometheus