For a while now, I got requests triggering our IDS, for their enormous cookie payload. The payload doesn't appear to be an attack, but includes tons of information, that appears to identify the user. These are not cookies we are setting, so some other site or tool is setting them. The content looks a bit like this may be used to pre-fill forms.

Please let me know if you have any idea what is sending all the data. I have no idea if this is legit, or just a "denial of service agains the analyst". But so far, it looks like the data is "real".

Over the last 10 days, I have seen 50 such requests for 13 different IPs. These are all "HEAD" requests and they hit various URLs on our site. Some have Google analytics "utm" strings appended to the URL indicating that they may come from Twitter related services. For example:

User Agent: AppleWebKit/525.13 (KHTML, like Gecko) Safari/525.13.

I am quoting a typical entry below, but I replaced and shortened some of the data with 'xxxxx'

charitydine[repeatad]=yes;
default_location[offset]=-4;
default_location[city]=ASHBURN;
ua-device[look]=web;
default_location[region_name]=VIRGINIA;
default_location[lat]=39.xxxx;
default_location[country_name_code]=US;
default_location[lng]=-77.xxxx;
default_location[country_name]=UNITED+STATES;
lsd=AXxxx_Jq;
pid.guid=xxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx;
ua-device[mobile]=0;
ua-device[setDate]=134291xxxx; 
www.marykay.com=5711xxxxx.xxxxx.xxxx;
NSC_gbsfcvaa.dpn=ffffffff09091cc14xxxxxxxxxxxxx;
default_location[postal_code_number]=20146;
pds%5Fsess=d=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
default_location[locality_name]=ASHBURN;
www.apache.sid=bd28e6405d09ce1f263d9040bbae88db;
default_location[ip]=[IP address of request]
runkeeper.channel=web.activity.shorturl;
datr=ixELUAbi2WAU-IBZ34yrGE5v;
BIGipServerWWW.3NEWS.CO.NZ=1113893056.20480.0000;
default_location[lang]=US;
_shuffler.web_session=xxxxxxx[long URL encoded string]; 
vglnk.Agent.p=8645d6bf081026933xxxxxxxx; 
WP_SessionId_wishpot.com=3b0kpjwunqqkvexqgtbrbdt4; 
CB%5FSID=0f54b689a5314dbbbc1bff1eb8b68cbb-396224260-12-6; 
general%5Fmaturity=1; 
BIGipServerPOOL-xxx.xxx.x.xx-COMPLEX=xxxxx.20480.0000; 
locale=en-US; BIGipServerPOOL-xx.xxx.9.45-80=1392xxxx0.20480.0000; 
BIGipServerwebpool.microsites.prod=2xxxxx50.20480.0000; 
BIGipServerPOOL-94.236.9.5-80=3305285824.20480.0000; 
CakeCookie[user_uid]=xxxxxxxx
app.session=xxxxxxx--xxxxxxxxxx; 
BIGipServerwww-lb.informatica=xxxxx.20480.0000;
BIGipServerpool_www.briargatemedia.com_80=xxxxxx.20480.0000;
reg_fb_gate=http%3A%2F%2Fapps.facebook.com%2Ftopface%2Fhoroscope%2F%3Fref%3Dastro;
_trance-mixes.com_session=xxxxx; 
.ASPXANONYMOUS=ypvS7qCGzgEkAAAAYTxxxxxxGM1MTU5KOC9Bdg1cTmhf2I-v1VzJ8JuBtA1; 
jive.server.info=\"serverName=scn.sap.com:serverPort=80:contextPath=:localName=localhost.localdomain:localPort=9001:localAddr=127.0.0.1\"; 
BIGipServerPOOL-94.236.9.97-80=3422726336.20480.0000; 
derStandard%2Eat=MGUID=3507f291-5b32-4a36-8941-014aa483b475&Timestamp=2012-07-22T07:09:17; 
BIGipServerPOOL_198.101.142.28_80=4010062602.20480.0000; 
framework.security_id=e5003d6c6cef93db59e92c852aa37766; 
next=http%3A%2F%2Fwww.facebook.com%2Fpages%2FMy-Vault-Card%2F408213029194706%3Fref%3Dstream; 
next_path=%2Fpages%2FMy-Vault-Card%2F408213029194706%3Fref%3Dstream; 
gnm.m.u=On7_FOVzE7gcRS1hhjrvkwhl5cknme_4u1CVwx-62PSD_JY7vJm7IA; 
ASP.NET_SessionId_4=R1342036983; 
ASP.NET_SessionId=xsanyvzyuql4m245mkprzl45; 
=true; 
ax-sess-www.allfacebook.com=xxxOAEAK; 
connect.sid=LXjcpJkARqE4fNMmCGtL5o6Y.04kX5MkuGDxxxxxbSFgwi6gkWMj0vNnEH38; 
rack.session=7dca39e61fe4e8483f6740bedc6c68a6eebf3aacdf941bf8afbc0a06efe54140; 
_swombat.com_session=aba737b1ef62c56e8102e829ecb7d; 
cnetuk%3Aproduction%3Asid=kn1iu3s75pe6mulnopc2gafnh0; 
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fphoto.php%3Fpid%3xxxxxx21304754582841; 
pds%5Flife=d=AQAC%2BDOCwhxxx=5; 
_session_id=1fa55bffc2162773f73d947ad45f243f; 
_bit=500be69b-00340-06202-441cf10a; 
cpsession=ff2f611c-d3f1-11e1-9a88-1231381f8344; 
SITE=FLPET; SECTION=HOME; 
ZDEDebuggerPresent=php,phtml,php3; 
snowball=xxxxxx-cf9e-43f8-b5fc-210449bd06bd; 
CAKEPHP=xxxxx; 
__cfduid=dc11c055eed8c7124c5686f5143e7f63f1342957212; 
spsite_sid=mgv7401bt5hadkhr733apu87g3; 
zdregion=xxxx; 
edition=us; 
session-zdnet-production=k9ia8jlxxxxxxxxbbes3hs3; 
NID=62=xxxxxx-jFcgLhqWQKx1D1z9_WRjn_xxxxxx-e5SnM0uw4mEwK;

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter