3

I have some pages that require a case sensitive input in the URL. Like /page/MT with 'MT' being the param. I've noticed lots of error reports lately where 'MT' is converted to 'mt', which is unexpected and currently unsupported.

All of these requests seem to be from a version of IE9 that reports its user-agent as 'Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)'. Lots of different IPs, so it's not unique to just one user.

My first guess was maybe just bad external links, which seems to happen a lot. However, all the requests show internal pages as the referrer.

I tried testing with the IE9(9.0.8112.16521) I had available with no luck. It behaved as I would expect. This is a proxied wsgi webapp, but the only common thread between all the problems is IE9.

Has anyone else seen this before?

Improve this question
2
  • Just as a sanity check, have you made sure there isn't anything on your server configured to force URLs to lowercase that might be triggering only in specific situations? See this previous comment of mine for one case that involved three separate things coming together in just the wrong way. The UA involvement in your case makes this less likely, but it might be worth a quick look.
    – Su'
    Aug 7, 2012 at 16:25
  • @Su' Interesting idea. After some testing, that does not appear to be the case here, though.
    – Mike Shultz
    Aug 7, 2012 at 16:43

2 Answers 2

Reset to default
6

That UA string suggests it isn't Internet Explorer at all, supporting ionFish's theory that it's a bot.

Windows NT 9.0 gives it away. Even Windows 8 only calls itself Windows NT 6.2. It also makes no reference to Trident, IE's rendering engine.

It should be more like Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0). See this MSDN blog.

Improve this answer
2
  • Interesting. This UA does seem to be widely used but I'm not finding any software that specifically uses it. Thanks for the info.
    – Mike Shultz
    Aug 8, 2012 at 18:17
  • 1
    Do you have WebsiteDefender on your servers at all? I ask because googling that UA string brought this up: tomoconnor.eu/blogish/appearance-can-be-deceptive
    – Olly Hodgson
    Aug 9, 2012 at 8:38
4

Checking the IE9 website, this is the ONLY thing relating to URL case.

400 BAD FILE REQUEST: This error occurs due to input of incorrect URL by the user, like we unknowingly use uppercase letters while specifying a URL rather than lower case letters and sometimes use of incorrect punctuation causes this error.

I do have a hunch though: since they're all the same user agent, and different IPs, someone could be using bots to send automated requests to your pages. The bots wouldn't actually use IE9, they just do simple requests and therefore ignore the case, and send IE9 as their user-agent. The referrers could also easily be spoofed to previous pages on the site.

Perform a few lookups on the IP addresses, and see if they lead to residential networks or hosted servers (usually by having a hosting company as the reverse host). This is NOT a definite way to check, because many many home computers are infected with viruses, which are also physically capable of doing that.

Is it possible NOT to use case-sensitive URLs? That would be a better solution.

Improve this answer
4
  • The IPs are oddly just residential spanning two ISPs(today). The patterns of traffic show a specific data interest, which could very well point to a bot. I'm mostly leaning towards bot at the moment, but want to be sure.
    – Mike Shultz
    Aug 7, 2012 at 16:37
  • @Mike - I would be glad to help you investigate this. If you like, you can contact me (click username, homepage, contact page).
    – ionFish
    Aug 7, 2012 at 16:44
  • @ionFish For reference, what "the" IE9 website is the source of that quote? The only place I can find that text is definitely not from Microsoft.
    – Su'
    Aug 7, 2012 at 17:13
  • @Su' - I was mistaken: tips.internet-explorer9.com I believed it was just another case where Microsoft bought a separate domain for their product.
    – ionFish
    Aug 7, 2012 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.