Welcome to WebmasterWorld Guest from 184.108.40.206 , register , free tools , login , search , pro membership , help , library , announcements , recent posts , open posts Become a Pro Member
Anyone else seeing UA Mozilla 28.0 On Bell or HP IP (I think) not2easy msg:4688563 8:20 pm on Jul 17, 2014 (gmt 0) 220.127.116.11 - - [06/Jul/2014:11:25:46 -0500] "GET / HTTP/1.1" 200 13808 "-" "Mozilla 28.0" has visited a few times this month always that same IP which shows: 18.104.22.168 - 22.214.171.124 126.96.36.199/14, 188.8.131.52/11 Alcatel-Lucent tech contact: somebody-at-hp.com It does the things a human would do but what the heck is it? So far it hits only the home page there.
aristotle msg:4688583 9:17 pm on Jul 17, 2014 (gmt 0)
Could it be an app? dstiles msg:4688584 9:37 pm on Jul 17, 2014 (gmt 0)
I have a lot of rubbish on 135.245.48.nn and 135.245.168.nn that I wasn't aware of (13 in total, the former this month, the latter March). Time to look at blocking, I think. I have the range 184.108.40.206 - 220.127.116.11 listed as Lucent but only those /24s are troublesome so far. not2easy msg:4688626 12:17 am on Jul 18, 2014 (gmt 0)
I think I will follow your lead, dstiles. I don't care for disguises on visitors, even when they are smiley faced. Thanks! @aristotle - Yes, I had that thought, I looked at every resource I know of to try to find out what it is, but the Mozilla 28.0 name is only showing up in reference to the Firefox 28 browser, no appps. Pfui msg:4688867 1:08 pm on Jul 18, 2014 (gmt 0)
Ten hits to PHP honeypots in eight months using the same fake "Mozilla 28.0" UA -- [ ...] -- equals a blockworthy IP, imho. projecthoneypot.org