TI-2026-066B — The Browser Costume

Series: The Allowlist · Part B · Classification: HIGH · Confidence: HIGH

Part A showed the attackers ride the clouds you trust. This part is about the second identity they borrow. When a request arrives, it announces itself — I am Chrome on Windows; I am Googlebot; I am an iPhone. That announcement is the User-Agent header, and it is written entirely by the sender. It is not an identity. It is a name tag the visitor fills in themselves. This is what the attackers write on theirs.

Executive Summary

Across the web-threats corpus, attackers wear three costumes — and each is defeated by the same move: ignore what the request says it is and measure what it does and where it is from.

• The crawler costume. 57 IPs present Googlebot/bingbot user-agents from ASNs that are provably not Google or Microsoft — a 14.6% impostor rate among all crawler-identity IPs (57 fake vs 333 real). Several are attacking while wearing it.
• The browser costume. Hundreds of datacenter IPs run credential harvest behind stale, uniform desktop-browser strings — 541 on one Windows-Chrome UA, clusters on Mac OS X 10_13_6 and Windows NT 6.1 that no server farm actually runs.
• The empty costume. 294 IPs send no user-agent at all; 252 (86%) are hostile. The absence of a costume is itself the tell.

Real Googlebot only comes from Google's own address space. A Googlebot from Hostodo is not a hard call — it is a forgery, full stop. The costume fools the log reader and the WAF rule; it does not fool the ASN and it does not fool the behavior.

I. The Crawler Costume — The Cleanest Forgery on the Internet

Most identity fraud is a judgment call. This one is not. Google publishes the IP ranges its crawler uses; Googlebot is verifiable by origin. So when a Googlebot/2.1 or bingbot/2.0 user-agent arrives from a low-cost VPS host, there is no innocent explanation — the name tag is a lie, and the lie is machine-checkable.

One WebNX IP fired 300 requests dressed as Googlebot. Against 333 legitimately-verified crawler IPs, 57 are impostors — nearly one in seven "crawlers" is lying about being one.

And the costume is not passive camouflage. At least ten of these fake crawlers carry live attack intents:

They wear Googlebot not to sit quietly in your logs but to walk past the WAF rule that says allow Googlebot — and then harvest credentials on the other side.

II. The Browser Costume — Stale Faces in the Server Room

The second costume is subtler because it is not, by itself, a lie: a datacenter can send a Windows NT 10.0 ... Chrome user-agent. The tell is in the aggregate. Real human browser populations are diverse and current; 541 server IPs presenting the identical Windows-Chrome string, with sizeable clusters frozen on Mac OS X 10_13_6, 10_14_5, Windows NT 6.1, are not a cross-section of humanity. They are a bot fleet reading from a hard-coded list of plausible-looking strings — many of them years out of date. No server farm runs High Sierra. The costume is convincing to a UA parser and absurd to anyone who asks what actually runs there.

Laid against behavior it collapses entirely: these are the IPs running the credential_harvest and shell_upload of Part A. A browser string on a datacenter IP sweeping /.env is a costume with the seams showing.

III. The Empty Costume — The Tell That Cannot Lie

The third is the strangest: no user-agent at all. 294 IPs send an empty UA, and 252 of them — 86% — are hostile. A real browser cannot help announcing itself; the header is automatic. Sending nothing takes deliberate omission, and almost the only things that bother are scripts, scanners and harvesters that never expected a human to look. The empty costume is the one that gives itself away: where a forged browser tries to blend in, the empty UA simply forgot to dress, and 86% of the time there is a weapon underneath.

IV. Unmasking — WHO From WHAT

The through-line of this platform is a single rule: the user-agent is what a request claims; the ASN and the behavior are what it is. The claim is attacker-controlled; the other two are not. An attacker can write Googlebot and rent Google-adjacent-sounding hosting, but cannot make FranTech's ASN into Google's, and cannot make a credential sweep look like a crawl to a scorer that reads paths and effective status.

The worked example is 104.244.77.108. Its costume: Googlebot. Its ASN: PONYNET / FranTech Solutions. Its behavior here: vhost_enum. And in the entity graph its identity resolves further — a multi-vector operator that also strikes the SSH honeypot. Three data points, three different answers to "who are you," and only one of them — the costume — is flattering. The graph keeps the other two.

V. The Seven Questions

Who is this? Attackers wearing borrowed web identities. Why the costume? To pass UA-based allow rules and to be miscounted in logs. Who do they claim to be? Googlebot, Chrome, an iPhone — or nothing. Who are they really? Datacenter tenants running credential_harvest, resolvable by ASN and conduct. Whom are they related to? Sometimes cross-layer operators (104.244.77.108). Where is the money? In the allow-rule the costume unlocks (Part A). What is the official anchor? Google's and Microsoft's published crawler ranges — the ground truth the forgery cannot touch.

VI. Steelman — "UA Spoofing Is Trivial and Known"

The strongest objection: everyone knows user-agents are forgeable; this is Security 101, not a finding. And plenty of legitimate things send odd UAs — headless test rigs, uptime monitors, scrapers — so a datacenter browser UA is not inherently malicious.

Both true, and neither rescues the UA as a trust signal. Yes, spoofing is trivial — that is precisely the argument: an input this cheap to forge should never gate trust, yet WAF allow-rules, bot-management products and analytics dashboards key on it every day, which is why documenting the forgery at scale still matters. And yes, some odd UAs are benign — which is why we do not judge on the UA at all. We pair it with behavior: a headless monitor does not run credential_harvest; an uptime probe does not sweep /.env. The costume is only ever damning in combination with conduct, and it is the conduct, not the costume, that we ban on. The narrow claim: the UA is unfit to grant trust, it is forged at measurable scale (14.6% of crawler identities), and identity must be resolved from signals the sender does not control.

VII. Read Between the Lines

• A costume is aimed at an audience. The forged Googlebot is not trying to fool the origin server — it is trying to fool the analyst reading the access log and the rule that trusts the log. Behavior-based defense simply is not in the audience.
• The empty UA is the honest lie: it claims nothing and therefore reveals the most. The elaborate browser string is the dishonest one, and it is the one defenders believe.
• Verification beats parsing. "Is this really Googlebot?" has a free, deterministic answer (check the ASN). The entire crawler-costume class is solved by asking origin instead of reading string.

VIII. The Human Layer

Somewhere a marketing dashboard is reporting healthy "Googlebot" crawl volume, and a slice of it is a VPS in a rack harvesting logins. Somewhere a WAF has an allow Googlebot rule written in good faith to keep SEO working, and it is holding the door for a credential sweep. Nobody misconfigured anything; they trusted a name tag, the way we are all trained to. The costume works because reading the label is what humans and tools were built to do — and the fix is the small, unnatural discipline of checking the badge against the door it came through.

IX. Verdict

Web attackers forge identity at measurable scale — a 14.6% impostor rate among crawler identities, hundreds of datacenter IPs in stale browser costumes, and 294 empty-UA IPs that are 86% hostile — and every layer of it is defeated by resolving identity from ASN and behavior rather than the user-agent string. Confidence: HIGH (deterministic crawler verification; quantified populations; a worked cross-layer unmasking). The name tag is not the visitor. The badge and the door are.

X. Defensive Response

Live: ua_category records the claim but never grants trust; crawler UAs are verified against published Google/Microsoft ranges; effective_bad_rate/probe_intent drive the CrowdSec ban regardless of costume; and the entity graph resolves cross-layer identity. A fake Googlebot at a 1.0 hostile rate is banned as fast as a naked scanner.

Crosslinks

• ← TI-2026-066A — Trusted by Default — the trusted ASN; here, the trusted identity. Two costumes, one allowlist.
• → TI-2026-066C — Behind the Orange Cloud — a third borrowed identity: the reverse proxy's own IP.
• Reference — the entity graph — the "who is whom" authority that resolves 104.244.77.108 and every other costume to its operator.

Sources: LSN web-threats requests/ip_intel — crawler-UA-vs-verified-ASN split (57/333), fake-crawler hosts and their attack intents, browser-UA clustering, empty-UA hostility (252/294), and entity-graph resolution of 104.244.77.108. Method: judge origin + behavior, never the self-declared string. TLP:WHITE.