[Gllug] Wierd UserAgent string in apache access_log

[Richard Jones]

On Thu, Nov 27, 2003 at 01:05:12AM +0000, Bruce Richardson wrote:
> On Wed, Nov 26, 2003 at 11:04:46PM +0000, will wrote:
> > I have noticed a couple of these wierd access log entries:
> > 
> > 61.103.86.71 - - [27/Nov/2003:00:38:03 +0100] "GET 
> > /humour-direct-banner2.jpg HTTP/1.1" 200 4690 
> > "http://www.humordirect.com/links/" "Mozilla/4.0 (compatible; MSIE 5.5; 
> > Windows 98; \xbe\xc6\xc6\xae\xb9\xcc\xb5\xf0\xbe\xee)"
> > 
> > Of particular interest is the string:
> > 
> > \xbe\xc6\xc6\xae\xb9\xcc\xb5\xf0\xbe\xee
> 
> Those are hexidecimal digits.  Possibly the string is in some exotic
> charset and being rendered like this in your logs.

The IP address is Korean, so possibly it's in some sort of Korean
encoding. If you go to this address:

http://annexia.org/tmp/korean.txt

You'll find those bytes, so you can play with the char encoding in
your browser until you find something which isn't mojibake[1]
(assuming you have a Korean friend!)

Rich.

[1] http://www.debian.or.jp/~kubota/mojibake/

-- 
Richard Jones. http://www.annexia.org/ http://freshmeat.net/users/rwmj
Merjis Ltd. http://www.merjis.com/ - improving website return on investment
"One serious obstacle to the adoption of good programming languages is
the notion that everything has to be sacrificed for speed. In computer
languages as in life, speed kills." -- Mike Vanier
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
URL: <http://mailman.lug.org.uk/pipermail/gllug/attachments/20031127/259963d9/attachment.pgp>
-------------- next part --------------
-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug