| MSOffice 12
What were they thinking? |
blend27
msg:4537178 | 5:54 pm on Jan 18, 2013 (gmt 0) |
Some chump from Indian(IN) IP range was trying to open the site in MS Word I guess, got blocked(UA and headers), then tried using different IP to do so 2 minutes later, got blocked again.
Seems like the requests come in pairs with about 5-6 seconds in between:
time: {ts '2013-01-18 07:41:58'}
method: HEAD
protocol: HTTP/1.1
User-Agent: Microsoft Office Existence Discovery
Few seconds later
time: {ts '2013-01-18 07:42:04'}
method: GET
protocol: HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.2; MSOffice 12)
Second pair was the same thing pretty much.
Looking at the logs for prior days, seems like they were trying to scrape the site with libwww-perl/6.04.
I just tried to do the same thing(open url in Microsoft Office Word 2007) and got pretty similar results as far as UAs go. The system has IE9 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) but the UA from Word 2007 says MSIE 7.0
|
|
