Strange long entries (dir/1)

Some odd browser plug-in?

[StuffOfInterest]

I've started to see some odd entries in my site log and I'm curious if anyone else has identified it. Right after a download of a file (say 'foo/bar.html') there will be two attempts to download from the same directory a file named '1' (as in 'foo/1'). These two attempts always occur within one second of each other and the agent always shows as 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)'.

My first thought is that this is a new browser plug-in of some sort. My second thought is that this is some sort of virus probing for its brethern. Has anyone else experienced this?

Thanks.

[StuffOfInterest]

A week later and I'm still seeing requests for a file named "1" in directories where a page has just been loaded. At first I thought my site might be malfunctioning, but it looks like the request is showing up on two sites that I manage.

If someone were to request the page "/foo/bar/bath.html", there would be one or two (usually two) requests immediately afterward for "/foo/bar/1".

Does anyone have an idea what is requesting this file? The agent string is always the same as that which requested a valid page but the referal information is always blank. It would be nice to figure out what is requesting this and then to see if there is a way to use it.

[directrix]

If your visitor profile is anything like mine, you'll probably find the vast majority of your visitors show that user agent string, so that may be a red herring.

Does this happen only after certain files are requested, or could it be after any file? Do you have any Javascript or CSS that could be inadvertently requesting dir/1, due to a typo, perhaps? Just clutching at straws...

[larryn]

Stuff,

Are those requests from the same IP or block of IP's? Could be a broken bot?

[StuffOfInterest]

larryn,

No, they are coming from all over. It really appears to be something running as part of the user's web browser.

Regarding the user agent string, I started seeing other user agents in there, so I really doubt that it is a bot. At this point, I would say that 5-15% of my hits are generating these odd requests.