FYI

One of the clients our shorten link service informed us about the inconsistency of statistics. According to his story we double it up at least. The Client is engaged in SMS mailing and accurate statistics is important to him.

We return back Nginx logs from archive and found strange behavior ordinary user-agent, please look:

Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0

It is a just Desktop Ubuntu user with old Firefox released at September 17, 2013. However, this user follow by uniq link three times in the second. Every time, from different IPs, users follows by uniq link three times in the second.

This is not a bot, this is not a young hacker, this is a — SMS Link Rich Preview by Samsung. Okay, we know that everyone lies but it just looks like poor-quality software.

1. Discussion on Stackoverflow: https://stackoverflow.com/q/48068227/1597964
2. Unanswered question from Samsung Dev: https://developer.samsung.com/forum/thread/sms-link-rich-preview/201/346325