2

I'm seeing an odd pattern in my HTTP access log. Sometimes a mobile Chrome browser makes dozens of seemingly redundant HTTP requests to get the same page.

What could cause this behavior?

  • A buggy app that uses the default User-Agent string?
  • Browser bug? Seems unlikely, since this spans at least Chrome 34 to 45.
  • Android bug? Seems unlikely for the same reason (at least 4.4.4 to 5.1.1.).
  • Something on the site, eg. JS code that causes the redirect - but only on these user agents? This has happened on multiple sites (having the same CMS though), but over 99 % of the sites do not show this behavior.
  • User, intentionally? How do you even press reload 20 times/second with a touch screen? :) (Of course one could have a bluetooth keyboard, but seems unlikely)
  • Something else?

Here's one log extract from one occasion. One IP address, anonymized: (time, response code, request, referrer)

19:01:33 404 "GET /6/ HTTP/1.1" "-"
19:01:34 404 "GET /favicon.ico HTTP/1.1" "-"
19:01:36 200 "GET /7/ HTTP/1.1" "http://www.example.com/6/"
19:01:41 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:01:42 200 "GET /1.jpeg HTTP/1.1" "http://www.example.com/8/"
19:01:42 200 "GET /2.jpeg HTTP/1.1" "http://www.example.com/8/"
19:01:42 200 "GET /3.jpeg HTTP/1.1" "http://www.example.com/8/"
19:01:44 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:01:45 200 "GET /10/a.css HTTP/1.1" "http://www.example.com/9/"
19:02:02 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:02:13 200 "GET /12/ HTTP/1.1" "http://www.example.com/11/"
19:02:13 200 "GET /4.jpeg HTTP/1.1" "http://www.example.com/12/"
19:02:28 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:02:29 200 "GET /5.jpeg HTTP/1.1" "http://www.example.com/13/"
19:02:34 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:09 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:11 200 "GET /15/ HTTP/1.1" "http://www.example.com/14/"
19:03:18 200 "GET /16/ HTTP/1.1" "http://www.example.com/15/"
19:03:18 200 "GET /17/b.js HTTP/1.1" "http://www.example.com/16/"
19:03:18 200 "GET /17/c.js HTTP/1.1" "http://www.example.com/16/"
19:03:18 200 "GET /17/d.js HTTP/1.1" "http://www.example.com/16/"
19:03:21 200 "GET /18/ HTTP/1.1" "http://www.example.com/16/"
19:03:26 200 "GET /16/ HTTP/1.1" "http://www.example.com/15/"
19:03:26 200 "GET /16/ HTTP/1.1" "http://www.example.com/15/"
19:03:26 200 "GET /16/ HTTP/1.1" "http://www.example.com/15/"
19:03:27 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:27 200 "GET /15/ HTTP/1.1" "http://www.example.com/14/"
19:03:27 200 "GET /15/ HTTP/1.1" "http://www.example.com/14/"
19:03:27 200 "GET /15/ HTTP/1.1" "http://www.example.com/14/"
19:03:27 200 "GET /15/ HTTP/1.1" "http://www.example.com/14/"
19:03:28 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:32 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:36 200 "GET /18/ HTTP/1.1" "http://www.example.com/16/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:44 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:45 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:46 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:46 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:46 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:46 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:46 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:47 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:48 200 "GET /16/ HTTP/1.1" "http://www.example.com/14/"
19:03:49 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:49 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:49 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:49 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:49 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:50 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:50 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:50 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:50 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:50 200 "GET /14/ HTTP/1.1" "http://www.example.com/8/"
19:03:51 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:51 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:03:51 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:51 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:51 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:52 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:52 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:52 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:52 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:52 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:53 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:54 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:54 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:55 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:56 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:57 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:58 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:03:59 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:00 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:01 200 "GET /8/ HTTP/1.1" "http://www.example.com/13/"
19:04:02 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:03 200 "GET /12/ HTTP/1.1" "http://www.example.com/11/"
19:04:03 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:03 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:03 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:03 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:04 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:04 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:04 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:04 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:04 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:05 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:05 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:05 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:05 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:05 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:06 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:06 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:06 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:06 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:06 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:07 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:07 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:07 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:07 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:07 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:08 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:08 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:08 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:08 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:08 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:09 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:09 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:09 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:09 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:09 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:10 200 "GET /13/ HTTP/1.1" "http://www.example.com/12/"
19:04:10 200 "GET /12/ HTTP/1.1" "http://www.example.com/11/"
19:04:14 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:15 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:15 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:15 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:15 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:15 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:16 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:16 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:16 200 "GET /11/ HTTP/1.1" "http://www.example.com/9/"
19:04:16 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:17 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:17 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:17 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:17 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:17 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:17 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:18 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:19 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:19 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:19 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:19 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:19 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:20 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:20 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:20 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:20 200 "GET /9/ HTTP/1.1" "http://www.example.com/8/"
19:04:21 200 "GET /7/ HTTP/1.1" "http://www.example.com/6/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:21 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:22 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:23 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:24 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:24 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:24 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:24 200 "GET /8/ HTTP/1.1" "http://www.example.com/7/"
19:04:24 200 "GET /7/ HTTP/1.1" "http://www.example.com/6/"
19:04:25 404 "GET /6/ HTTP/1.1" "-"
19:25:16 404 "GET /6/ HTTP/1.1" "-"
19:25:17 404 "GET /favicon.ico HTTP/1.1" "-"
19:43:38 404 "GET /favicon.ico HTTP/1.1" "-"
20:24:39 404 "GET /favicon.ico HTTP/1.1" "-"

Apart from the odd "resting my finger on F5" thing all seems legit human browsing, not a runaway bot:

  • the user advances from a page to another, loads images and js/css assets (not all are shown here, since some are loaded from an asset domain)

  • ip addresses are domestic mobile operator addresses (multiple operators)

  • Referer field looks ok

The User-Agent strings encountered so far with this behavior:

Mozilla/5.0 (Linux; Android 4.4.4; SM-G357FZ Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.94 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 4.4.4; SM-G357FZ Build/KTU84P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.94 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG GT-I9506 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 5.1.1; SAMSUNG SM-G920F Build/LMY47X) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/3.2 Chrome/38.0.2125.102 Mobile Safari/537.36
Mozilla/5.0 (Linux; Android 5.0.1; SAMSUNG GT-I9506 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/2.1 Chrome/34.0.1847.76 Mobile Safari/537.36
tuomassalo
  • 738
  • 2
  • 8
  • 22
  • Why do you care? Is it causing problems? On very busy web servers, I've seen all sorts of unusual requests. There's usually no point in tracking them down unless there is some kind of issue. – Ryan Babchishin Oct 05 '15 at 12:28
  • @RyanBabchishin - good question. Mostly I'm just curious. But sometimes this kind of traffic causes performance issues (that are hard to overcome on a legacy server). Temporarily blocking the IP address seems a bit hard in this case. – tuomassalo Oct 05 '15 at 12:32
  • Do you use img tags on your website with empty src tags? Those cause the image trying tot load the requesting page as image – Ferrybig Oct 09 '15 at 13:42
  • @ferrybig Thanks, but doesn't seem to be the reason here. Besides, empty src tags would trigger this behavior in most browsers, not just there few mobile Chrome ones. – tuomassalo Oct 09 '15 at 14:08

0 Answers0