Web Security

User Agent Parser

Web logs are full of User-Agent strings, and half of SOC triage is deciding whether one is a real visitor, a search crawler or a scanner pretending to be a browser.

Parsing uses local pattern matching only. Your own User-Agent is read from navigator.userAgent in your browser and never transmitted.

Treat User-Agent as a claim, not evidence

  • Anyone can send any User-Agent, so never use it as an access-control decision.
  • Legitimate crawlers can be verified with forward-confirmed reverse DNS on the source IP.
  • Empty, very short or default library strings (curl, python-requests) in web logs usually mean scripting.
  • Very old browser versions appearing suddenly can indicate a headless tool with a stale hardcoded string.