User-Agent: in User Agent string

Strange undeclared bot

[Dijkgraaf]

I noticed a strange User Agent in my logs of "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 (.NET CLR 3.5.30729)" and yes, the words User-Agent: is part of the User Agent string.
It gets the same two pages on a daily basis, sometimes twice a day.

robots.txt: No
IP: 72.52.96.x

[incrediBILL]

I block everything with "User-Agent:" in the UA string.

Not that many things do this and it's usually junk.

Every now and then you get some real winners like this one:

"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; [bsalsa.com)...] ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET CLR 3.0.30618)"

[Pfui]

@Dijkgraaf: Make sure to code for case insensitive because the blockworthy 'user-agent' phrase varies. For example, if you use mod_rewrite, append the [NC] flag:

RewriteCond %{HTTP_USER_AGENT} (User\ |User-|UserAgent) [NC] 

[keyplyr]

There's also a downloading tool (forget its name) that gives the user the option to choose several UAs, one of which being "User_Agent" so I'm used the following:

RewriteCond %{HTTP_USER_AGENT} ^User[-|_]Ag [NC]

[Pfui]

Thanks for the info. I'll add the variation to my array. FWIW, I rarely see 'user' as a string-starter so I don't ^anchor.