BT-ctrlaltdel and Creative ZENcast

Any info on this user agent?

[grandma genie]

Hi guys,
Could you identify these user agents?

64.114.nnn.nn - - [19/Sep/2010:16:46:36 -0400] "GET / HTTP/1.1" 200 31293 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.8) Gecko/20100722 (BT-ctrlaltdel) Firefox/3.6.8 ( .NET CLR 3.5.30729; .NET4.0C)"

I checked Google and webmasterworld search, but didn't see anything about it. It is this part that I thought was odd: Gecko/20100722 (BT-ctrlaltdel)

And here is another one:

62.31.nnn.nn - - [19/Sep/2010:05:00:14 -0400] "GET arcticfox.jpg HTTP/1.1" 200 9690 "mywebsite.com/fox.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; HPDTDF; Creative ZENcast v2.01.01)"

Just curious about the HPDTDF and the Creative ZENcast.

Thank you for your comments. - Grandma_genie

[Dijkgraaf]

The (BT-ctrlaltdel) could just be a custom theme from [customize.org...] (Found via Google).

And the Creative ZENCast is probably, [ZENcast.com...] which is a video blogging tool of some sort.

[Pfui]

BT-ctrlaltdel may be a home-rolled string... ctrlaltdel = Ctrl-Alt-Del = Control-Alt-Delete on PCs [en.wikipedia.org...]

P.S.
When including IPs, please only obfuscate the numbers after the last dot (not after the last two dots). [webmasterworld.com...] Thanks.

[grandma genie]

Hi Dijkgraaf and Pfui, The IPs are 64.114.127.nnn (Canada) and 62.31.241.nn (United Kingdom). I wondered if the BT-ctrlaltdel was something the user had actually made, or was some kind of error message saying whatever they were trying to do didn't work. I assume a programmer can make their own user agent. So, was the visitor a programmer or just someone who picked up the user agent string when they used a browser with an add-on. I assumed the Creative ZENcast was some sort of browser add-on for collecting media, like sound files, which I do have on my site. Like the sound of a tiger growling, or a dog barking. I believe the user agent string is supposed to reveal information about the visitors browser. So, what do all these odd additions to the user agent string mean? I'm just trying to figure out if I should block these folks or give them a pass. Why do some user agent strings get so long? Mine is very short. I do not add anything to my browser.

One other oddity, the user 64.114.127.nnn had visited about three hours earlier. The entry at that time was different. Here it is:

64.114.127.nnn - - [19/Sep/2010:13:07:00 -0400] "GET /osc/stylesheet.css HTTP/1.1" 304 - "mywebsite.com/osc/index.php?cPath=nn" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB6.5; FunWebProducts; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; AskTbPSI/5.8.0.12304)"

Does that mean they were using a different browser?

- Grandma_genie

[Dijkgraaf]

Some add-ons do add details about themselves to the users agent string even if there is no purpose for them to do so. Most are benign although searching the internet on some will get you warnings about them not possible malware/spyware. FunWebProducts is known to sometimes come bundled with a lot of spyware for example. However even this should NOT affect your site, it might cause the person using it some grief however.

Yes, that visitor used two different browsers, the first time it was Internet Explorer 8, the second time it was Firefox 3.6.8. Again not something I'd worry about unless you see it happening a lot (which may indicate your site has a rendering / usability issue). If you see a different UA each time from the same IP address it gets any file and doesn't behave like a normal browser, then it probably is a stealth bot.
A normal browser will get the main page, and then get any images, javascript, CSS or other embedded contents. Most bots will fetch either the page on it's own (sometimes also the Javascript) or just the other embedded contents on it's own.

[tangor]

Log analysis is becoming more difficult year on year. We do the best we can. That said, the bots are on the rise, making it difficult to count humans... and make sense of the conversions etc.

[grandma genie]

Half my server logs are bots. Most of them are MSN. Yahoo is next, Google is next and Ask is last. I also let The Find come in because they list my stuff on their site and there is always the hope I'll get a sale from them. Then there are a whole bunch of bots that I have banned, but they keep coming back. It is a never ending battle. Thanks for all the comments. This is a great forum for learning new things.

[Dijkgraaf]

Yes, lots of bots. Stats for my site for July, August and September to date.
Non-Bots: 17.1%, 22.5%, 18.3%
Bots: 82.8%, 77.4%, 81.3%
Uncertain: 0.1%, 0.1%, 0.1%

(Note September doesn't equal 100% yet as there is still 0.5% that I've got to go through and catogorise).

Now most of those are well behaved bots, but about 6-10% of the visits to my site are from bad or even hostile bots (attempting exploits).