For a while now, I got requests triggering our IDS, for their enormous cookie payload. The payload doesn't appear to be an attack, but includes tons of information, that appears to identify the user. These are not cookies we are setting, so some other site or tool is setting them. The content looks a bit like this may be used to pre-fill forms.
Please let me know if you have any idea what is sending all the data. I have no idea if this is legit, or just a denial of service agains the analyst. But so far, it looks like the data is real.
Over the last 10 days, I have seen 50 such requests for 13 different IPs. These are all HEAD requests and they hit various URLs on our site. Some have Google analytics utm strings appended to the URL indicating that they may come from Twitter related services. For example:
All use the same user agent string, implying that they use Apple Safari, but the user agent isn't quite correct for Apple's Safari browser:
User Agent: AppleWebKit/525.13 (KHTML, like Gecko) Safari/525.13.
I am quoting a typical entry below, but I replaced and shortened some of the data
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.