Forum Moderators: DixonJones

Message Too Old, No Replies

User Agent strings with "DDDDD."

strings of "Ds" and zeroes in the User Agent String

         

Gneen

4:39 pm on May 27, 2009 (gmt 0)

10+ Year Member



I have hit coming to my site (a large one) that contain strings of zeroes and upper case "Ds" in the user agent strings. They appear to come from varying IP addys and they don't exhibit "crawler behavior" ... in fact, apart from the strangeness in the UA strings they seem to be "real human surfers".

Are these the result of "anonymizer" software of some sort? or something else? (samples with hit counts below for a random day)

ADVthanksANCE for any insights!
=Gneen

Also some listed at:
[botsvsbrowsers.com...]


230 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
154 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
132 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
110 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
72 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
68 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
58 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
22 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000000;+00)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+0000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
12 Mozilla/5.0+(000000000;+0;+00000+000+00+0;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDD
10 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
6 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+000000000000000000+0000000+0000+000000+00000000000+0000000000000
3 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000;+00000000000)+00000000000000+0000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+0000000005.27.1

enigma1

10:03 am on May 28, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



there were some posts about it on the mozillazine, but that was last year.

Gneen

11:10 am on May 28, 2009 (gmt 0)

10+ Year Member



Thanks for the mozillazine reference ... poking around there and following assorted links has led me to the conclusion that these UA strings are caused by an "anonymizer" from [intego.com...] for the Macintosh.

There is apparently an "Information Hiding" feature that can be turned on that results in masking of the User Agent string similar to what I'm seeing ...

=Gneen

jdMorgan

1:28 pm on May 28, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Not very clever... By doing this, the anonymizer tells the bad guys exactly what firewall they're up against.

And of course, it makes it impossible (or very difficult) for us to serve customized stylesheets or pages to these visitors.

After comparing a few real user-agent strings to these obscured ones, it looks like the 000+DDD format is Firefox/Mozilla, while the all-numeric 000+000 format is Apple Safari.

Jim