| PowerPoint as User Agent
|
lucy24
msg:4512484 | 1:25 am on Oct 26, 2012 (gmt 0) |
Can anyone shed some light on this pattern?
141.233.cc.dd - - [17/Oct/2012:20:26:25 -0700] "GET /ebooks/perez/Perez.html HTTP/1.1" 200 35273 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X) PowerPoint/12.32.0"
141.233.cc.dd - - [17/Oct/2012:20:26:27 -0700] "GET /ebooks/perez/Perez.html HTTP/1.1" 200 11205 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"
141.233.cc.dd - - [17/Oct/2012:20:26:28 -0700] "GET /ebooks/perez/Perez.html HTTP/1.1" 200 35273 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X) PowerPoint/12.32.0"
141.233.cc.dd - - [17/Oct/2012:20:26:29 -0700] "GET /ebooks/perez/Perez.html HTTP/1.1" 200 11204 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/536.26.14 (KHTML, like Gecko) Version/6.0.1 Safari/536.26.14"
They always come two by two as quoted here, though the sets are not always so close together. The PowerPoint UA gets only the main file, and is followed immediately by the Safari UA picking up the complete package.
The IP is a perfectly respectable American university. The earliest visit was Safari coming in through a search; PowerPoint came by itself later in the day. There have been a few other individual visits from Safari by itself.
The filesize attached to PowerPoint is the real filesize. The one attached to Safari is much smaller, even on the first visit. (Uhm... gzip stuff that I don't understand?)
One exact IP predominates, but there have been others. I'm thinking computer lab, library, something like that. But what's with the PowerPoint UA?
|
keyplyr
msg:4512488 | 1:50 am on Oct 26, 2012 (gmt 0) |
PowerPoint can be used as a ripper, same as other Office tools.
|
lucy24
msg:4512570 | 8:42 am on Oct 26, 2012 (gmt 0) |
If they're trying to swipe this specific text they are being terminally silly because
(a) it's in the public domain and can be picked up anywhere
and
(b) it's a picture book and therefore pointless without the illustrations
|
keyplyr
msg:4512585 | 9:21 am on Oct 26, 2012 (gmt 0) |
Just one scenario for the PowerPoint UA.
Personally, I block the entire M$ suite of tools. From my point of view, there's no reason any of them should be used when surfing my sites.
|
|
|
