17

From Cloudfront report I can see a few thousands download requests on one file attributed to the referrer "android.clients.google.com", any idea about what is behind this referrer?

Joël
  • 1,563
  • 1
  • 18
  • 31
  • 1
    We can see the same for our application. This referer does only appear with the download requests. And always with the same user agent (that does not fit the user agent the user has in this session). We assume it has to be some malware on android. But this is just a guess right now. – schouk Nov 21 '17 at 13:37
  • 1
    @schouk That could be it because I found this referrer associated with only a unique IP from Japan with Windows XP as User-Agent. This IP tried to download our file 17k times in a few minutes. – Joël Nov 21 '17 at 15:58
  • 1
    same here. Always the same User-Agent "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9.2.8) Firefox/3.6.8". But unfortunately different IPs. We also see many many downloads per minute... – schouk Nov 22 '17 at 12:56
  • 2
    @Joël We are experiencing the same problem from some days ago. The same user agent and android.clients.google.com. Any news on this? We are investigating it too. – Marc Cals Dec 01 '17 at 11:13
  • @MarcCals No news.. It only happened once here. It looks suspicious for sure – Joël Dec 01 '17 at 18:25
  • 3
    We're seeing the same pattern here. Same referrer, same user agent. I thought it might be some badly written malware which tries to hijack file downloads from other apps. – Bart van Wissen Dec 05 '17 at 10:29
  • 1
    When I block this domain, I can no longer use google play. – OutOfThisPlanet Jun 04 '19 at 20:00

0 Answers0