Which of these is a suspect user agent?

Question

Options

• A<> (the null string)
• BWget/1.8.1
• CMozilla/5.0
• DOpera/9.0

• A
  9% (3)
• B
  3% (1)
• C
  74% (26)
• D
  14% (5)

Explanation

Mozilla/5.0 alone is a suspect user agent because legitimate browsers never send such a bare, incomplete string. Real browsers append extensive platform and engine details (e.g., Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...). A stripped-down Mozilla/5.0 is a classic fingerprint of bots, scrapers, and attack tools attempting to impersonate a browser without revealing their true identity.

Why the distractors are wrong:

• A (empty string): Suspicious in practice, but an empty UA suggests a misconfigured or broken client rather than active spoofing - it's not trying to masquerade as anything.
• B (Wget/1.8.1): Wget is honest and transparent about being a command-line download tool. Legitimate automated tools that identify themselves openly are generally not classified as "suspect" in this context.
• D (Opera/9.0): A specific, well-formed browser identifier from a known vendor - not a red flag on its own.

Memory tip: Think "vague = suspect." Real browsers are verbose and specific about their platform and engine. If a UA claims to be a browser but provides no details, something is hiding behind the curtain.

No community discussion yet for this question.