Huge Trident UserAgent String

trident user agent string

[cyberdyne]

Hi all,
Can anyone please advise as to whether the following is normal? Seems ridiculously oversized to me.

Many thanks.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; YPC 3.2.0; SearchSystem6829992239; SearchSystem9616306563; SearchSystem6017393645; SearchSystem5219240075; SearchSystem2768350104; SearchSystem6919669052; SearchSystem1986739074; SearchSystem1555480186; SearchSystem3376893470; SearchSystem9530642569; SearchSystem4877790286; SearchSystem8104932799; SearchSystem2313134663; SearchSystem1545325372; SearchSystem7742471461; SearchSystem9092363703; SearchSystem6992236221; SearchSystem3507700306; SearchSystem1129983453; SearchSystem1077927937; SearchSystem2297142691; SearchSystem7813572891; SearchSystem5668754497; SearchSystem6220295595; SearchSystem4157940963; SearchSystem7656671655; SearchSystem2865656762; SearchSystem6520604676; SearchSystem4960161466; .NET CLR 1.1.4322; .NET CLR 2.0.50727; Hotbar 10.2.232.0; SearchSystem9616306563; SearchSystem6017393645; SearchSystem5219240075; SearchSystem2768350104; SearchSystem6919669052; SearchSystem1986739074; SearchSystem1555480186; SearchSystem3376893470; SearchSystem9530642569; SearchSystem4877790286; SearchSystem8104932799; SearchSystem2313134663; SearchSystem1545325372; SearchSystem7742471461; SearchSystem9092363703; SearchSystem6992236221; SearchSystem3507700306; SearchSystem1129983453; SearchSystem1077927937; SearchSystem2297142691; SearchSystem7813572891; SearchSystem5668754497; SearchSystem6220295595; SearchSystem4157940963; SearchSystem7656671655; SearchSystem2865656762; SearchSystem6520604676; SearchSystem4960161466; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

[Pfui]

It's definitely not normal. And weighing in at 1,544 characters and spaces, it's also log-bloatingly huge. (Lesser whoppers mentioned by GaryK here [webmasterworld.com], post #3959827.)

If you haven't already blocked the Host/IP, I would.

[cyberdyne]

Thanks. Thought as much. Presumably, the only way to block this would be via an IP block? (which unfortunately is dynamic).
Blocking Trident would presumably block a lot of genuine users too?

Thanks again

[jdMorgan]

You could simply block based on two or more occurrences of "SearchSystem in the User-Agent string.

Or even just one, if you want...

Jim

[cyberdyne]

Ah, yes, great idea.
would you mind giving me some pointers on the sytax please? I'm familiar with .htaccess blocking.

Many thanks

[keyplyr]

This would work:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} SearchSys
RewriteRule .* - [F]

However, you may wish to allow access to robots.txt. If so, the 3rd line would look like this:

RewriteRule !^robots\.txt$ - [F]

If you also use a custom 403 page, then use this as the 3rd line:

RewriteRule !^(example403\.html¦robots\.txt)$ - [F]

Note: This forum's software breaks the vertical pipes (¦) so repair before using in your code.

You may wish to consider if this issue is a chronic nuisance or not before using any rewrite rules, which have the potential to cause yet unforeseen problems of their own, i.e. blocking whom you didn't intend to block.

[cyberdyne]

Many thanks for your help keyplyr.

[cyberdyne]

keyplr, how would that line need to be edited if I want to block two or more instances of 'SearchSys' as opposed to just the one?
Many thanks

[jdMorgan]

If you only want to block two or more occurences, then the pattern could be:

 (;\ SearchSystem[0-9]+){2} 

(I'm being cautious here only because I have no idea what "SearchSystem" may be. It might be a legitimate application with a very, very poor installer, or it might be a scraper tool ... I've no idea, myself.)

Jim

[cyberdyne]

OK, I'll go with the two or more rule for now and let you know if I find anything out.
Thank you.

[Pfui]

Sounds/looks familiar:

A Sept., 2009, WW post by dstiles "User-agents get longer and. [webmasterworld.com]" mentions a UA with an incredible 5367 characters, including: "214 numeric variations on the basic stem searchsystem - eg searchsystem1039995106; of which 106 were duplicated. ..."

FWIW:

"Class SearchSystem [sptci.com]" is connected to Apache Lucene [lucene.apache.org], a high-performance, full-featured text search engine library written entirely in Java..."

[cyberdyne]

Many thanks Pfui, that does indeed look and sound exactly the same as my 'visitor'.

[Pfui]

Whatever it is, whatever it's doing, whatever built it, whatever's using it, it's still out there, today entwined w/ bsalsa's already too long/wonky string...

genkt-051-00*.t-mobile.co.uk
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SearchSystem9962323893; SearchSystem4461197469; GTB6.3; Embedded Web Browser from: http://bsalsa.com/; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; SearchSystem9962323893; SearchSystem4461197469; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

robots.txt? NO

[dstiles]

> post by dstiles "User-agents get longer and" mentions a UA with an incredible 5367 characters...

And I had an even longer one today: a total of 6235 characters, of which 6111 characters were 263 searchsystem words. Funwebproducts also featured, so that tells you the kind of person using searchsystem. :(

[dstiles]

And another weird searchsystem one today, nowhere near as long but nested UAs.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0;
SearchSystem7786881516; SearchSystem6913979999; SearchSystem5256473524; SearchSystem3548658380; SearchSystem7004861987;
GTB6.4; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 1.1.4322; Dealio Toolbar 3.4;
SearchSystem7786881516; SearchSystem5256473524; .NET CLR 3.5.30729; .NET CLR 3.0.30618; SearchSystem3548658380; SearchSystem7004861987;
WinTSI 26.01.2010)

Does anyone know what searchsystem actually is? There seem to be a few possibilities from a library to seo.

And what is WinTSI? Again, no real info found. Google's best guess is aomeone on facebook called Win-tsi.