During HTTP-based attacks, the bot uses a random
HTTP user-agent header selected from a list of 65 user agent
strings with various combinations of device, operating
system, and web browser. This feature is meant to
impede the differentiation between an attacking bot and
a legitimate client. The list includes exotic user-agents
that are unusual to produce a lot of requests (e.g., Nintendo
Wii, Nokia Symbian smartphones, or old software
like Microsoft Windows 95 in combination with Internet
Explorer 4). With the knowledge of this specific list of
user-agents and the noisy request frequency carried out
by the bot during attacks, it is straightforward to identify
attacking clients in access logs.