Mozilla (Google Web Accelerator Cache Warmer; Google-TR-1)

IP belongs to Road Runner

[GaryK]

The files do not appear to have been taken by a human.

The reason I think so is there were too many files that had no logical connection (in other words there's no reason a web accelerator would know to cache them) taken nearly all at once from all over the website.

Also none of the usual files a human would get automatically, like .css and .js files, were requested. But it did request the default file for the site which should have triggered a request for my stylesheet and JavaScript include files.

I'm not sure what to make of it. Do you think this is the legit Google Web Accelerator or a faker? Thanks.

[jdMorgan]

"Warmer"? I haven't seen "Warmer" from Google before...

Jim

[jdMorgan]

BTW, does it send the X-moz: prefetch header?

Jim

[Pfui]

I haven't seen it either, but the 1980s called and want those Warmers back.

: )

[GaryK]

Where would I find that information Jim?

[jdMorgan]

You have to log (or check) the HTTP request header %{HTTP:X-moz} to see if it is present.

Examples of checking the variable:

# Set 'getout' environment variable using SetEnvif for use by subsequent 'bad-bot blocker' code
SetEnvIf X-moz prefetch getout
 -or-
# Set 'moz_pref' environment variable using SetEnvif for use in custom log or later mod_rewrite code.
SetEnvIf X-moz prefetch moz_pref=mozpre
 -or-
# BLOCK Mozilla-based browser prefetches using mod_rewrite
RewriteCond %{HTTP:X-moz} ^prefetch
RewriteRule .* - [F]
 -or-
# Set 'moz_pref' environment variable using mod_rewrite for use in custom log or later mod_rewrite code.
RewriteCond %{HTTP:X-moz} ^prefetch
RewriteRule .* - [E=moz_pref:mozpre]

Logging the X-moz header from the HTTP request:

CustomLog /path_to_log_file "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" [b]\"%{X-moz}i\"[/b]"

Logging the 'moz_pref' server environment variable set by our setenvif or mod_rewrite code above:

CustomLog /path_to_log_file "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\" [b]\"%{moz_pref}e\"[/b]"

(You'd use this second logging method if you wanted to log something other that the word 'prefetch', which is what you'd get from the first CustomLog method. Here, we'd see either "mozpre" or "-" in the resulting log file, depending on whether the X-moz:prefetch header was sent in the HTTP request.)

Lots of things you could do...

Jim

[volatilegx]

Just a note: GaryK told me the IP address isn't assigned to Google.

[GaryK]

Dan, if it's a legit toolbar would the IP Address be the customer's or, in this case, Google's?

Thanks Jim. I use IIS but I can do essentially the same thing you described. I'll get back to you once I see this toolbar again. I'm not blocking it for now because I want to see if it comes back, and if it's being used by anyone else.

[volatilegx]

I'm not sure, Gary.