Is this abuse or what?

"Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"

[jackson]

Picked this item on my logs recently:

70.108.*.* - - [11/Jan/2005:13:36:59 -0600] "GET / HTTP/1.1" 200 4876 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"
70.108.*.* - - [11/Jan/2005:13:37:02 -0600] "GET /my_dir/my_page.css HTTP/1.1" 200 4516 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"
70.108.*.* - - [11/Jan/2005:13:37:05 -0600] "GET /my_dir/my_page.js HTTP/1.1" 200 564 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"
70.108.*.* - - [11/Jan/2005:13:37:11 -0600] "GET /my_dir/my_page.js HTTP/1.1" 200 339 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"
70.108.*.* - - [11/Jan/2005:13:37:14 -0600] "GET /my_dir/my_page.gif HTTP/1.1" 200 53 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"
70.108.*.* - - [11/Jan/2005:13:37:22 -0600] "GET /my_dir/my_page.jpg HTTP/1.1" 200 46113 "-" "Mozilla/4.0 (0000000000; 0000 0000; 00000000000)"

Need to figure out what all those zeros are and if this constitutes an abuse or not? Whatever it is, looks like the user is up to no good.

Would appreciate comments.

[edited by: Brett_Tabke at 7:03 pm (utc) on Jan. 22, 2005]

[pendanticist]

Looks like someone has modified their ua string [google.com].

Depending on who you communicate with here, the practice of modifying ones UA string is socially acceptible.

I am not of that school of thought.

[larryhatch]

Yeah, I've seen those too.

They usually come in and check out a few pages on my site and simply leave.
Since they don't spider much, bandwidth is low so I don't care much.
It does make me curious though. Why the endless zeroes?
Seems like a waste of THEIR bandwidth without any apparent purpose.
Why not just leave that part blank? - Larry

[larryhatch]

I'm using Firefox 1.0 for my personal browser.

Can anyone tell me how to modify my User Agent string?
I want to leave in the FF 1.0 part, but take out some other needless junk.

- Larry

[pendanticist]

>Why not just leave that part blank?

You mean blank ua [google.com] strings?

That's even more suspicious.

[ogletree]

I have a unique UA string when I browse so I can filter out my visits from my stats.

[larryhatch]

Hi Ogletree:

Can you tell me how to do that in firefox 1.0?
That sounds like what I'd like to do. - Larry

[ncw164x]

If you have fire fox installed all you have to do is download the "User Agent Switcher", you can add additional user agents or modify the presets

You can get this extension from the Mozilla update site listed under developer tools.

[larryhatch]

thanks ncw: I'll try that. -Larry

[swoop]

NetCaptor, my favorite browser, permits you to turn off and on the User-Agent string. I don't think it has the ability to edit it.

[George Cooper]

Could be some user behind an anal corporate firewall.

Some hardware firewall products can do stuff like this. The more common example I have seen is Cisco PIX firewalls blanking out entire SMTP responses except for the response codes (the important bits). This looks similar except they are blanking the browser specifics and only allowing the "important" part of the useragent to come through.

I guess it is an attempt to foil browser specific exploits that check useragents, just like the SMTP mangling is an attempt to foil people looking for exploitable SMTP servers.