Windows 200X

Referrer spam pattern

[Ilsevel]

I couldn't find a thread about this UA. Maybe I'm bad at searching, or it's just that russian bots really like me for some reason.

UA: Mozilla/X.0 (compatible; MSIEX.00; Windows 200X)
Protocol: HTTP/1.1
Robots.txt: No
Host/IP: Various. Usually russian VDS services and example.com, which are from ISPs from Netherlands and Ukraine

The X in the UA stands for random digits. Example:

[11/Jan/2018:20:46:47 -0600] "HEAD / HTTP/1.1" 403 - "REF SPAM1" "Mozilla/6.0 (compatible; MSIE2.00; Windows 2003)"
[11/Jan/2018:20:46:47 -0600] "HEAD / HTTP/1.1" 403 - "REF SPAM2" "Mozilla/3.0 (compatible; MSIE3.00; Windows 2008)"
[11/Jan/2018:20:46:47 -0600] "HEAD / HTTP/1.1" 403 - "REF SPAM3" "Mozilla/6.0 (compatible; MSIE2.00; Windows 2007)"

I'm using a 0-9 digit regex to catch it, though so far I've only seen "Mozilla/(2-8).0, MSIE(2-7).00 and Windows 200(2-9)". The referrer URLs are mainly .ru, with a sprinkling of .kz, .ua, .su, but I've also spotted .io, .com, .net and .org.

It hits at least 60 times/day, and the number of requests made in a row is also randomized.

[wilderness]

FWIW, MSIE should be followed by a blank space before the Version # and that should be enough to kick the user.

[keyplyr]

Blocking by IP address is likely to prove futile as these compromised ISP accounts are often used for a few days then discarded for new ones.

Are they sending any GET requests or just HEAD?

[lucy24]

MSIE should be followed by a blank space before the Version #

Hey, Don, long time no see :)

Cursory log search, past year only, turns up a fair number of MSIE\d hits--every last one* with a gratifying 403 response--notably this version, which would probably trigger at least four separate alarms on your site (where “you” = wilderness, not OP or keyplyr):

Mozilla/5.0(compatible;MSIE9.0;WindowsNT6.1;Trident/5.0)

On my site most of them use auto-referers rather than referer spam, though.

I don't think I've met a Mozilla>6 yet. I do categorically block Mozilla/[0-36] but that's just belt-and-suspenders, since they are not likely to pass header tests.

:: further log check ::

Oh, looky here, I found a few "Mozilla/8,0" --that's the full UA string--with a comma, suggesting that they haven't got the hang of their Decimal Separator function (came from an ARIN range, I think a Romanian server farm).


* I re-checked and found ONE 200 response. That was a request for robots.txt--with auto-referer--and nothing else.

[edited by: lucy24 at 11:56 pm (utc) on Jan 15, 2018]

[Ilsevel]

Yeah, blocking by IP would be more trouble than it's worth. I'm blocking by UA and hoping they go away and stop filling my logs with trash.

I've seen only HEAD requests in the last 15 days. If they tried something else I missed it because I've not been following it closely and the older logs are gone.

[lucy24]

older logs are gone

Get in the habit of downloading them regularly so you can keep them forever. My server keeps them for 15 days, and that's only because I've changed it from the default 3 days. I park them on my HD and zip them after a year or so but keep them in the same place; that way I can tell the text editor to do either a comprehensive search, or just the not-compressed ones.

[keyplyr]

...so you can keep them forever

Say what now?

[lucy24]

Don't you keep your raw access logs somewhere? I thought for sure you would. And that “somewhere” certainly isn’t on a shared-hosting server.

[keyplyr]

Nope... I keep my raw logs for a few days, then delete them.

I do keep notes. I also keep my custom Analog history ( now 20 years, 2 weeks.)

[Ilsevel]

I know, I should give the logs a little more attention. The affected domain is a low key portfolio, it seldom sees attacks so I'm just not in the habit of keeping up with the logs or backing them up. I only looked at them trying to figure out pinterestbot's obsession with a long gone page and caught the russian spammer bot by accident.

The good news is that this bot seems to be doing fewer requests since I blocked it and might be moving on. Given that badly conceived UA I didn't have high hopes, but reasoned that maybe, just maybe they'd be clever enough to give up after enough 403s because hey, if the target knows what they're up to the target won't click any links, therefore any resources spent on it are completely wasted. There's a lot of other low hanging fruits out there.

Let's not delve too deeply into the fact that someone who is tech-savvy enough to check logs usually knows better than visit a bulk of suspicious-looking referrer sites so this type of spam is incredibly inefficient anyway...