OpenX Ad Server Script Causing 404s On Server

Some Odd User Agents Requesting URIs

[incrediBILL]

Ever since I started using OpenX.org's ad server I'm getting a rash of hits that look like this:

"GET /'http://d1.openx.org/avw.php?zoneid=****&cb=INSERT_RANDOM_NUMBER_HERE&n=******* HTTP/1.1" "Mozilla/4.0 (compatible;)"

First, the malformed GET shows me something is having a problem parsing the OpenX code which uses a single quote instead of a double quote and then mucks up the GET request sending it back to my server instead of OpenX.

The server response is obviously a 404, but I'm getting 100s of these a day now.

However, what tool is going this under the guise of "Mozilla/4.0 (compatible;)"?

Most of the UA's using "Mozilla/4.0 (compatible;)" I see like this seem to be coming from .MIL and .GOV which points to something specific for their installations.

I'm also seeing the same problem coming from UAs claiming to be iPhone, Apple Webkit on other devices, Firefox and even Table PCs, etc.

It this some ad blocker or virus scanner tool?

I'm going to try patching the openx.org code to use double quotes instead of single and hope the problem goes away, but to the untrained eye the rash of 404s hitting the server for no reason almost looked like an attack.

Anyone else using OpenX ad server and their script see this and figure out what's failing to interpret their scripts properly?

Sure would be nice to tell everyone how to solve this bug and stop it.

[incrediBILL]

Another clue, it's the <NOSCRIPT> portion of their code causing the problem so whatever is happening it's not in the Javascript itself.

Sample snippet:

<!--/* OpenX Javascript Tag v2.8.5 */-->
<script type='text/javascript'>...bunch of code....</script>
<noscript><a href='http://d1.openx.org/ck.php?n=****&amp;cb=INSERT_RANDOM_NUMBER_HERE' target='_blank'><img src='http://d1.openx.org/avw.php?zoneid=****&amp;cb=INSERT_RANDOM_NUMBER_HERE&amp;n=****' border='0' alt='' /></a></noscript>

It's the <img src=''> causing the problem, but what tools would malfunction like this?

It's quite the epidemic on my server since switching to their ad server.

Obviously I can fix the code to use double quotes but it sure seems others will have the same problem out of the box.

[dstiles]

I suspect you already check for such things but I find Mozilla/4.0 (compatible;) is often the stupid bluecoat "proxy". It's used a lot by large companies - got a whole load insterspered in a high-speed scan from a major UK bank today - no idea why.

The UA arrives with the header field HTTP_X_BLUECOAT_VIA set (can't recall to what).

That combination always gets a 405 and a note saying bluecoat is dumb - though I doubt anyone actually sees it: it's more a satisfaction thing. :)

[incrediBILL]

Changing the OpenX code to use double quotes in the <NOSCRIPT> portion has resolved most of the 404 flood, but not all, still getting a couple of these a day which is a mystery how it's still happening since I fixed all instances of that code in my site.

Maybe it's stuck in some cache proxy or something.

[dstiles]

Don't use any form of ads so can't comment on that. I still have a few framed sites and bluecoat (if that's what you're seeing) acts a bit odd around them, double-fetching frames, but no 404s apart from the odd picture which may or may not be missing.