Researchinfo
User Agent Strings Curiosities, (Sun, Oct 4th)
AI summary · grok-4.7Summaries by Vani AI
SANS diary reviews odd honeypot user-agent strings, from masscan variants to Shellshock and NTRIP probes.
Didier Stevens of the SANS Internet Storm Center describes unusual User-Agent strings seen in honeypot logs. Scanners advertise masscan, include contact emails, reuse unsanitized separator lines from a public user-agent list, and still send Shellshock payloads in the header. One request also probed for NTRIP servers that stream GPS correction data.
Key facts
- Honeypot logs show masscan variants and playful or misleading scanner user-agents.
- Shellshock payloads still appear inside User-Agent headers more than ten years later.
- One probe looked for NTRIP servers streaming GPS correction data.
- Organizations
- SANS Internet Storm Center
- Countries
- Belarus
From the original article
1 min read at isc.sans.edu
Sometimes I have to smile, or my interest is triggered, when I review new User Agent Strings in the honeypot logs.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.