Funny User Agents

fake browser UAs used by bots

[lucy24]

Requesting robots.txt, which is the only way they would ever have got in (there are more, but these were the funniest):

34.226.204.abc - - [27/Jul/2018:10:25:43 -0700] "GET /robots.txt HTTP/1.1" 200 979 "https://www.google.com/" "Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285"
34.207.139.abc - - [27/Jul/2018:19:47:04 -0700] "GET /robots.txt HTTP/1.1" 200 979 "https://www.google.com/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080219 Firefox/2.0.0.12 Navigator/9.0.0.6"

If we were allowed to use smileys, cosgan.de has a couple ROFL variants that would fit the bill nicely.

[keyplyr]

Yeah, most faked UAs are obviously used to get past filters that site owners have installed, or to be covert and blend in with the browsers in those inefficient site stats reports like Google Analytics. Most don't identify version numbers.

Seemingly, the botrunners don't consider their footprints are looked at by anyone who knows what they're doing. In fact, a lot of the internet operates that way :)

[tangor]

I suspect these folks were banking on our amusement at their cleverness to give them a pass in appreciation of all their efforts.

NOT!

[keyplyr]

I like the UAs that attempt to appear benign, all while probing for vulnerabilities: link checkers, bookmakers, validators, etc.

The marketing data scrapers are usually more honest about their intentions.

[lucy24]

Here's another entertaining one, noticed only because it happened to be the very last item on that day's logs:

178.137.95.abc - - [30/Jul/2018:02:23:44 -0700] "GET /rats/ HTTP/1.1" 403 3034 "https://sheer--gibberish--here/" "Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)"

I know Russian* browsers tend to be a bit elderly compared to RIPE and ARIN ranges ... but let's not overdo it.


* 178.137 turns out to be Ukraine, but same difference.