Forum Moderators: phranque

Message Too Old, No Replies

Which part of Explorer's UA is the 'favicon collector'?

MSNbMSNI? MSNmen-us? MSNcIA?

         

Pfui

10:35 pm on Mar 1, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Actually, here's the entire UA:

Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90; MSN 9.0;MSN 9.1; MSNbMSNI; MSNmen-us; MSNcIA)

There are similar others, like --

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MSN 9.0;MSN 9.1; MSNbQ002; MSNmen-us; MSNcOTH; MPLUS)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; MSN 9.0;MSN 9.1; MSNbVZ02; MSNmen-us; MSNcOTH; MPLUS)

-- but the top one's my newest aggravation and therein, somewhere, lies my solution.

I'm a Netscape/Mac person so I really don't have a clue about which part of the top MSIE/Win string is 'responsible' for collecting and/or checking (apparently bookmarked?) "favicon.ico" files.

Hopefully somebody knows because suddenly I've got a whopper of a Microsoft Net range (65.52.0.0 - 65.55.255.255) AND a related but less hungry local MSN proxy requesting my top-level favicon.ico file every day -- 1 to 3 times/second, 10 to 20 times/session, over and over and OVER again, round the clock. And that's all they're hitting.

I'm glad somebody's a happy bookmarker but this is getting ridiculous.

So I'd like to rewrite the IPs+Host+UA so the automated process is thwarted, but that real people can still access everything else if/when they come back. Like:

## If these IPs -- 
RewriteCond %{REMOTE_ADDR} ^65\.54\.$ [OR]
## Or this Host (eg: proxya.msn.com; proxyb.msn.com) --
RewriteCond %{REMOTE_HOST} ^[^.]+\.msn.com
## Using this UA --
RewriteCond %{HTTP_USER_AGENT} ^Mozilla.*MSNcIA
## Asks for favicon.ico -- say NO:
RewriteRule ^\.ico$ - [F]

(I hope my code echoes my comments. Please correct me if it doesn't!)

TIA for any/all info about which part of the MSIE UA is told, "No way."

jdMorgan

1:20 am on Mar 2, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I had this same thing showing in my logs a while back. I just blocked the MSNcIA thing like you show.

It didn't seem to accomplish anything -- they just kept trying, so I dropped the code.

I note that your REMOTE_HOST cooments indicate an MSN proxy -- interesting...

Jim