Help Center/ Content Delivery Network/ Best Practices/ Preventing Traffic Theft/ Preventing Traffic Theft by Blocking User Agents
Updated on 2026-05-20 GMT+08:00
View PDF
Share

Preventing Traffic Theft by Blocking User Agents

Many attackers use forged user agents (UAs) to access accelerated domain name resources. You can analyze logs to identify and filter out these UAs and block access from them.

What Is UA?

A user agent (UA) is a special string sent by a client to a server. It identifies the client's software and hardware configurations, such as its operating system, browser version, and rendering engine. This information helps servers adjust page layouts or functionality accordingly. The UA format is usually as follows:

User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
  • Browsers: starting with "Mozilla/5.0" by default
  • PCs and mobile devices:
    • PCs: usually carrying system identifiers such as "Windows NT", "Macintosh", or "Linux"
    • Mobile devices: usually carrying identifiers such as "Android", "iPhone/iPad", or "Mobile"
  • Browser kernels: usually carrying "Chrome", "Safari", "Edge", or "Firefox"

Identifying UAs from Attackers

Different from normal UAs, UAs forged by attackers may have the following problems:

  1. Abnormal or malformed UAs: These include UAs that resemble automation tools (such as Python), have obviously incorrect formats (for example, Mozilla///), or contain obviously invalid values (such as www.example.com).
  2. Improper UAs: For example, for HTML5 pages promoted by WeChat, normal users should initiate access through WeChat. It obviously does not make sense if the request UA comes from a Windows desktop browser (for example, MSIE 6.0).

You can use the logging and reporting feature provided by CDN to analyze and identify abnormal UAs. You can use the following methods to analyze and identify abnormal UAs:

  1. Analyze offline logs in the attack period, check HTTP request information, identify abnormal IP addresses and anti-leeching information, and set protection rules accordingly. For details, see Analyzing Malicious Access Addresses Through Logs.
  2. Download and analyze custom operations reports such as popular URL, referer, UA, and client IP address reports. These reports are available if you have customized them for the domain name before an attack. For details, see Operations Reports.

    Set operations reports beforehand. If attacks cause a high bill before you configure them, you have to rely on offline logs for past data analysis.

Blocking UAs

After identifying abnormal UAs, you can block access from these UAs using the following method:

  1. Configure a UA blacklist to filter out suspicious UAs.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. In the domain list, click the target domain name or click Configure in the Operation column.
    4. Click the Access Control tab.
    5. In the User-Agent ACL area, enable the function. The Edit User-Agent ACL dialog box is displayed.

      Type: Select Blacklist.

      You can select Block requests with blank user agents if needed.

      Rule: Enter the identified UA (www.example.com in this example).
      Figure 1 Configuring a User-Agent ACL
  2. Configure the rules engine to block access from the IP addresses.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. Click the Rules Engine tab and click Create Rule.

      Condition: Select User-Agent.

      Operator: Select Include any value.

      Value: Enter the identified UA (www.example.com in this example).

      Case sensitive: disabled.

      Actions: Select Access Control, with Type set to Reject.

      Figure 2 Configuring the rules engine
  3. Enable Edge security protection. You can use the precise protection feature provided by EdgeSec to block access from abnormal UAs, preventing traffic theft.
Parent topic: Preventing Traffic Theft