Feeds

AVG disguises fake traffic as IE6

Where's the ham and cheese?

High performance access to file storage

Exclusive AVG has rejiggered the fake traffic it's spewing across the internet, causing new headaches for the world's webmasters.

In late February, AVG paired its updated anti-virus engine with a real-time malware scanner that vets search engine results before you click on them. If you search Google, for instance, this LinkScanner automatically visits each address that turns up on Google's results page.

According to the company, more than 20 million people have downloaded the new AVG 8, and this has caused a huge up-tick in traffic on sites across the web, including The Register. Because the scanner attempts to disguise itself as a real live human click, webmasters who rely on log files for their traffic numbers may be unaware their stats are skewed. And others complain that LinkScanner has added extra dollars to their bandwidth bill.

Daniel Brandt, who runs Wikipedia Watch, estimates that LinkScanner traffic to the site has outstripped legitimate clicks by nearly ten times. In this graph, the pink line represents suspected LinkScanner scans, the blue line legitimate clicks:

LinkScanner meets Wikipedia Watch

LinkScanner meets Wikipedia Watch

When we first told the tale of AVG's fake traffic earlier this month, we pointed out that if webmasters were wise to the problem, they could filter LinkScanner visits from their log files. Each scan left a unique user agent: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)."

But over the weekend, the company changed this user agent on the for-pay version of AVG 8. It appears that scans now use these agents as well:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813)

Judging from the log files of two separate web sites, including Wikipedia Watch, the first agent is by far the most common. Which is bad news for webmasters. That's also the Internet Explorer 6 user agent. Unlike the other two - and the original "1813" agent - it's a perfectly valid agent that may turn up with real clicks.

AVG's chief of research Roger Thompson says the for-pay LinkScanner is only using the IE6 user agent. Presumably, the company believes this is more likely to fool malware exploits. "There are still ways for concerned web masters to filter LinkScanner requests out of their statistics," he told us over email. But he did not divulge these methods and did not say whether they might clip legitimate traffic as well.

Many webmasters may have no choice but to abandon log file analysis, adopting alternative tools from companies like Google, Yahoo!, comScore, or Nielsen NetRatings. And these tools have their drawbacks. comScore's service tends to underestimate traffic from daytime work machines. And if you go with Google Analytics, you have to tag your pages with JavaScript - and share your traffic numbers with Google.

Plus, these tools won't solve the bandwidth issue.

High performance access to file storage

More from The Register

next story
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
Skype pimps pro-level broadcast service
Playing Cat and Mouse with the media
Beat it, freetards! Dyn to shut down no-cost dynamic DNS next month
... but don't worry, charter members, you're still in 'for life'
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.