Faked User Agents

Lots of hits from one IP-address with changing user agents

[doc_koliday]

Starting on sunday I discovered in our logfiles several thousand hits from one IP-address, but with ever changing user agent strings. Every 1, 2 or three hits the user agent string changes, but the hits are coming so close together and they hit the same part of our site too (and the IP-address belongs to a dial-in server), so I think it's extremely likely they all come from one computer.

All in all there must have been more than 60 different strings, here's just a sample:
Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; YComp 5.0.2.6)
Mozilla/4.0 (compatible; MSIE 5.0; AOL 4.0; Windows 98; DigExt)
Mozilla/4.0 (compatible; MSIE 5.0; AOL 7.0; Windows 98; DigExt)
Mozilla/4.0 (compatible; MSIE 5.0; Mac_PowerPC)
Mozilla/4.0 (compatible; MSIE 5.0; Windows 2000) Opera 6.06 [de]
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)
Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt; SP20; pbc4.0.0.0; YComp 5.0.0.0)
Mozilla/4.0 (compatible; MSIE 5.5; AOL 5.0; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.5; AOL 5.0; Windows 98; Win 9x 4.90)
Mozilla/4.0 (compatible; MSIE 5.5; AOL 5.0; Windows 98; surfEU DE M3)
They all seem valid to me so I guess someone took the trouble to collect them and feed them to a robot. BTW, there never is a referrer, so they block that out too.

It already started to mess up our logfile analysis, and if this catches on we might as well forget about it alltogether. So has anybody seen something like this and could give me some advice how to block this out? Any help would be appreciated!

Kind regards

[jalal]

I just asked this question (see previous thread on faked IP's and prn sites) and discovered it is 'log-spamming'. I won't repeat the answers here, check the other thread.

It would seem that at some point in mid sept or so, a bunch of windoze machines got comporomised with a trojan that is doing the log-spamming... sigh, yet another kind of spam to watch out for.

[doc_koliday]

Thanks, but I'd say this isn't log spamming, because as there are no referrers, how should they profit from it? And why change the user agent every few hits? Finally, we don't put our statistics on the server, so again, what is there to gain?

[jalal]

I understand your points but I'm in a similar situation, the web statistics aren't publicly available so no-one gains from it.

My guess is that, as they are all coming from dial-up connections (aka home computers) then there is a high probability that they trojanned computers. From my logs I can see 2, possibly 3, different attack styles, which suggests 2 or 3 programs. And, maybe some of the programs don't work properly and blank out the referers by mistake?

Either that or you are being DOS'd (rather poorly).

As for what to do about it... I have no idea!

:(

[jalal]

Oh, I forgot to add, someone mentioned this link:
[perlcode.org...]

which may give you some ideas.

[fiestagirl]

It could be this:
[webmasterworld.com...]

[ogletree]

You would be amazed the schemes people come up with. There are a lot of really smart programmers out there trying to make a living on the net. I know several of them are members here. When there is money being handed out there are always people trying to get some. They try to get all they can.

[ronburk]

It already started to mess up our logfile analysis,

There will always be new robots appearing, and new tools for downloading a local copy of partial and entire websites. Your logfile analysis should be prepared for the appearance of such things, or else you may indeed want to give up :-).