Confused ... Useragent Discrepancy

[Talisman]

Our site recorded two hits from an unregistered guest visiting our forum. But the Session table in our database logged conflicting information about these two hits....... though both entries registered at nearly the same time and are from the same visitor.

In both cases, the userid was 0 (an unregistered guest) and the IP address was exactly the same..... but the "useragent" column info for the two clicks doesn't match.

1st hit --> Useragent = "contype"

2nd hit --> Useragent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0"

What does "contype" mean and why didn't the user's system information show up the same way both times?

[Talisman]

As an update.... I received an email from this visitor asking something that will require a reply from us within a short period of time.

The content of that message is a little strange and we have other (unrelated) reasons to suspect that it might be a person who keeps trying to hack our site, our server, personal accounts.... and so on.

So we need to know if that "contype" thing, in itself, is suspicious or if it's really nothing at all.

I've seen what bots look like when they show up on the Session table.... but I'm not sure what to expect if it's someone using a proxy or other method of surfing anonymously. And I've never seen differing useragent system info show up for the same IP address during the same session before.

Any help or advice you can offer would surely be appreciated.

Thanks!

[filburt1]

<a href="http://ktmatu.com/software/contype/" target="_blank">http://ktmatu.com/software/contype/</a>

[MUG]

"Please note that this Contype script is not the user agent identifying itself as "contype" in raw log files and reports created by many log analysis tools. Contype script is not an user agent. It cannot be used to fetch data from other sites."

[filburt1]

Well screwed up on that one

[Brad]

http://www.psychedelix.com/agents.html

contype: Adobe Acrobat Reader w. IE 4

[Talisman]

Okay, good. So it's not some fancy masking utility..... just someone using an old acrobat reader to download a pdf file from our site. That's good to know.

Thanks.