The AD Provider needs secure html with a site/server certifacate (https:) did you use it ?

Hello.
Dnn site that I support and develop is site of internet provider.
When I saw this problem at first time , these errors came from
external IP but from disibled user (payment expire) so provider blocked this IP.
But now it continues for active users but for local address.
>Kirill, is the same IP that starts the process everytime?
>Are they external IP addresses?
I get errors from local addresses (192.168.165.76 , 192.168.164.249 , 192.168.165.34 , ...) .
For example only on 192.168.165.76 i get around 100 errors, that I put at my previous post.
>Have you tried tracing the IP back to see where it might be coming from (it might give us a clue e.g. a web search crawler).
I will try to trace it .
Also maybe it will be usefull ,
if I open (W2003Server)Computer Management =>
System Tools=>Event Viewer =>Application
I can see:
*******
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 13.09.2009 14:50:47
Event time (UTC): 13.09.2009 11:50:47
Event ID: a23c3a4da737436f8f6a9c8d061ae3a7
Event sequence: 2615
Event occurrence: 269
Event detail code: 0
Application information:
    Application domain: /LM/W3SVC/1/ROOT-1-128972598821562500
    Trust level: Full
    Application Virtual Path: /
    Application Path: C:\Inetpub\wwwstikonet\SOURCE\Website\
    Machine name: BIGFOOT
Process information:
    Process ID: 3184
    Process name: w3wp.exe
    Account name: NT AUTHORITY\NETWORK SERVICE
Exception information:
    Exception type: NullReferenceException
    Exception message: Object reference not set to an instance of an object.
Request information:
    Request URL: http://www.stikonet.od.ua/Default.aspx
    Request path: /Default.aspx
    User host address: 192.168.165.34
    User: 
    Is authenticated: False
    Authentication Type: 
    Thread account name: NT AUTHORITY\NETWORK SERVICE
Thread information:
    Thread ID: 33
    Thread account name: NT AUTHORITY\NETWORK SERVICE
    Is impersonating: False
    Stack trace:    в DotNetNuke.Authentication.ActiveDirectory.HttpModules.AuthenticationModule.OnAuthenticateRequest(Object s, EventArgs e)
   в System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   в System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
*******
So only today I have more than 100 same errors at server from 192.168.165.34.

Thanks,
Kirill.

We've found the cause of the error on our side. DNN was calling he AD Authentication module when a user hit the site with a blank UserAgent set during their HTTPWebRequest, but this isn't handled properly.

In our case, one of our developers wrote a tool that pings the site to see if it's alive. He never specified a UserAgent, and it will filling up our logs with that AD error. He connected the dots and figured out what was happening, and has added a UserAgent to resolve our issue.

However, I think this is a bug, and although in the normal case, no user should be visiting a DNN site with a blank UserAgent, the result seems like an unhandled exceptional situation, and one which is exploitable as well.