Welcome to WebmasterWorld Guest from 35.172.100.232

Forum Moderators: DixonJones & mademetop

Message Too Old, No Replies

User Agent strings with "DDDDD."

strings of "Ds" and zeroes in the User Agent String

     
4:39 pm on May 27, 2009 (gmt 0)

New User

10+ Year Member

joined:May 18, 2009
posts: 3
votes: 0


I have hit coming to my site (a large one) that contain strings of zeroes and upper case "Ds" in the user agent strings. They appear to come from varying IP addys and they don't exhibit "crawler behavior" ... in fact, apart from the strangeness in the UA strings they seem to be "real human surfers".

Are these the result of "anonymizer" software of some sort? or something else? (samples with hit counts below for a random day)

ADVthanksANCE for any insights!
=Gneen

Also some listed at:
[botsvsbrowsers.com...]


230 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
154 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
132 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
110 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
72 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDDD
68 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
58 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
22 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000000;+00)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+0000000000)+DDDDDDDDDDDDDDDD+DDDDDDDDDDDDD
18 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
12 Mozilla/5.0+(000000000;+0;+00000+000+00+0;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDD
10 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDDDD+DDDDDDDDDDDDDDD
6 Mozilla/5.0+(000000000;+0;+00000+000+00+0+000000;+00000)+000000000000000000+0000000+0000+000000+00000000000+0000000000000
3 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000;+00000;+00000000000)+0000000000000000+00000000000000
2 Mozilla/5.0+(000000000;+0;+00000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000;+00000000000)+00000000000000+0000000000000000
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+000000;+00000)+DDDDDDDDDDDDDDDDDD+DDDDDDD+DDDD+DDDDDD+DDDDDDDDDDD+DDDDDDDDDDDDD
2 Mozilla/5.0+(000000000;+0;+000+000+00+0+0000000;+00)+00000000000000000000+0000000+0000+000000+0000000000000+0000000005.27.1
10:03 am on May 28, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 30, 2007
posts:1394
votes: 0


there were some posts about it on the mozillazine, but that was last year.
11:10 am on May 28, 2009 (gmt 0)

New User

10+ Year Member

joined:May 18, 2009
posts: 3
votes: 0


Thanks for the mozillazine reference ... poking around there and following assorted links has led me to the conclusion that these UA strings are caused by an "anonymizer" from [intego.com...] for the Macintosh.

There is apparently an "Information Hiding" feature that can be turned on that results in masking of the User Agent string similar to what I'm seeing ...

=Gneen

1:28 pm on May 28, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member jdmorgan is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Mar 31, 2002
posts:25430
votes: 0


Not very clever... By doing this, the anonymizer tells the bad guys exactly what firewall they're up against.

And of course, it makes it impossible (or very difficult) for us to serve customized stylesheets or pages to these visitors.

After comparing a few real user-agent strings to these obscured ones, it looks like the 000+DDD format is Firefox/Mozilla, while the all-numeric 000+000 format is Apple Safari.

Jim

 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members