Welcome to WebmasterWorld Guest from

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

User Agent strings with "DDDDD."

strings of "Ds" and zeroes in the User Agent String

4:39 pm on May 27, 2009 (gmt 0)

New User

10+ Year Member

joined:May 18, 2009
posts: 3
votes: 0

I have hit coming to my site (a large one) that contain strings of zeroes and upper case "Ds" in the user agent strings. They appear to come from varying IP addys and they don't exhibit "crawler behavior" ... in fact, apart from the strangeness in the UA strings they seem to be "real human surfers".

Are these the result of "anonymizer" software of some sort? or something else? (samples with hit counts below for a random day)

ADVthanksANCE for any insights!

Also some listed at:

154 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
132 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
72 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
68 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
58 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+0000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
6 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+000000000000000000+0000000+0000+000000+00000000000+0000000000000
3 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000;+00000000000)+00000000000000+0000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+0000000005.27.1
10:03 am on May 28, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 30, 2007
votes: 0

there were some posts about it on the mozillazine, but that was last year.
11:10 am on May 28, 2009 (gmt 0)

New User

10+ Year Member

joined:May 18, 2009
posts: 3
votes: 0

Thanks for the mozillazine reference ... poking around there and following assorted links has led me to the conclusion that these UA strings are caused by an "anonymizer" from [intego.com...] for the Macintosh.

There is apparently an "Information Hiding" feature that can be turned on that results in masking of the User Agent string similar to what I'm seeing ...


1:28 pm on May 28, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member jdmorgan is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Mar 31, 2002
votes: 0

Not very clever... By doing this, the anonymizer tells the bad guys exactly what firewall they're up against.

And of course, it makes it impossible (or very difficult) for us to serve customized stylesheets or pages to these visitors.

After comparing a few real user-agent strings to these obscured ones, it looks like the 000+DDD format is Firefox/Mozilla, while the all-numeric 000+000 format is Apple Safari.



Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members