Message Board

Newbie/Basic Questions

FDM in User Agent - brought me to the site

Author: H.Ross (2 Dec 06 7:56am)

I have signed up and will donate several MX records because I am involved personally in the fight against Spam as well as for my clients.

I started my own Honey Pot for Trojans in the past few weeks because an e-mail address in a group of friends became compromised and it had to be harvested from one of their PCs. My Honey Pot gives users a unique but dummy/never-used e-mail address which they add to their address book and if mail is ever received then it points to their PC as the problem!.

The odd thing is that within a few days someone has registered using the link provided and no-one has owned up to doing this. The user Agent of the browser was weird too - MS IE7 on XP without SP2 and with a code of 'FDM' at the end. I have tracked down FDM to the site Free Download Manager but I suspect they are not directly involved but their code may have been pirated and may be used for harvesting.

I came to 'your' site because I found a reference to FDM in Google but I couldn't find out what data you had recorded about it or it's usage. Can anyone help - even with a short reply to say that I am 'barking up the wrong tree' (sorry for the UK colloquilism if I could spell it)...

Any clues, pointers, URLs etc. very welcome... HR.

(In case anyone is interested - the uA was: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; FDM))

Re: FDM in User Agent - brought me to the site

Author: A.Timmer (11 Dec 06 5:19am)

Hi,

You simply can't rely on the user agent because that's easy to fake! I've got quite some "invisible" links on my site and almost all bots following the links identify themselves as "normal" browsers.
Have a look at my stats on this on http://www.atgp.nl/newap/trapthem.php

There's even a plugin for Firefox that let you switch the user agent. ( http://chrispederick.com/work/useragentswitcher/ ).
I'm using this to check if my .htaccess (blocking by user agent) is working OK.

You could even identify yourself with an impossible user agent string like Windows XP - Safari :-)

Post Edited (11 Dec 06 5:21am)