Forum Moderators: open

Message Too Old, No Replies

A tough one: spambot disguised as IE

Problem with a spambot disguised as IE

         

tnlnyc

3:59 am on Oct 4, 2005 (gmt 0)

10+ Year Member



On my site, I track some of the incoming user-agent and, for stuff like IE, the program also auto-classifies them. A problem, however, seems to have occured with an abusing User-Agent string and I can't figure out which one it is.

On the following page, I list IE 6 user agent strings (please read the rest of note before going there):

The problem I'm facing, however, is that one of those strings seems to have created a pop-up to another site

I'm assuming the site is of the spammy kind but this is the first time I've encountered this problem and not been able to fix it. The issue is that it seems none of the UA have javascript in them and yet, the pop-up fires-up.

This is the first time I've encountered this issue and I'd like the help of this forum to do two things:
1. Identify the culprit so I can reclassify is as a spambot.
2. Get an understanding of how that works so I can program an exception in my classifying program.

Anyone has any idea? I've been trying to figure it out on my own for the last few days but no luck (and my GoogleFoo is failing me on this one).

TNL

[edited by: jatar_k at 3:10 pm (utc) on Oct. 7, 2005]
[edit reason] removed urls [/edit]

jatar_k

3:12 pm on Oct 7, 2005 (gmt 0)

WebmasterWorld Administrator 10+ Year Member



I don't see any of those strings being a culprit for what you are describing

>> The problem I'm facing, however, is that one of those strings seems to have created a pop-up to another site

I don't quite see what you mean, are we talking spyware somehow?

wilderness

6:49 pm on Oct 7, 2005 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



TNL,
If your inquiry is limited to half a dozen or so log lines?

Than list the log lines; having first taking the following precautions:

1) XXX the Class D of the IP Range
2) Modify any folder or page references to your site to dummy names.

Perhaps then somebody may assist. URL links personal websites are even in most instances when used for reference are a violation of the charter.

Today with many folks using PHP, Java and server side scripting, it's relaitively easy to redirect somebody based on an input page.

Best thing users may do regarding Java is to either stop using Internet Explorer entirely ( I have) or replace the MS Java with Sun Java.
I rarely see a pop-up in Firefox, even when I want to :)

Don

tnlnyc

8:01 pm on Oct 7, 2005 (gmt 0)

10+ Year Member



Finally figured it out. Some @#$#$ spammer had a javascript window.open method in their UA string. Annoying....