Ywo new- and different- ones spotted today

[carfac]

Hi:

Found these two today:

lc-ez-63-96-179-187.bea.com - - [06/Oct/2002:00:13:52 -0600] "GET /card.html HTTP/1.1" 200 10152 "-" "Sat Oct 05 22:00:13 EDT 2002Mozilla/4.72 [en] (WinNT; I)"

Note the UA has a dynamic field wich displays the current time- and this does change!

210.83.113.15 - - [06/Oct/2002:08:26:50 -0600] "GET /data/Disney/ HTTP/1.1" 403 3711 "-" "Mozilla/4.0(compatible; MSIE 5.0; Windows 98; DigExt)"

Note the No Space between Mozilla/4.0 and (compatible...

The first grabbed robots.txt, the second did not. Both grabbed a no-no file which got my attention. Both tried to grab 10+ pages a second. Both did not get far!

dave

[jdMorgan]

Dave,

Well, I'll try these (Note: Remove line breaks preceding the "\" characters in second and third lines!)

RewriteCond %{HTTP_USER_AGENT} ^(Mon¦Tue¦Wed¦Thu¦Fri¦Sat¦Sun)
\ (Jan¦Feb¦Mar¦Apr¦May¦Jun¦Jul¦Aug¦Sep¦Oct¦Nov¦Dec)
\ [0-3][0-9]\ [0-2][0-9]\:[0-5][0-9]\:[0-5][0-9]\ ..T\ 2[0-9][0-9][0-9]Mozilla/[0-9]\.[0-9][0-9] [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[0-9]\.[0-9]\(compatible [OR]

Clever, that time-of-day UA ploy...

Jim

[bird]

If you have any listing in the Zeal directory, make sure not to globally block UAs with no space before the "(compatible":

"Mozilla/4.0(compatible; Zealbot 1.0)"

[jdMorgan]

bird,

Thanks for pointing that out! Off to test again...

RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0\(compatible\)\ MSIE [OR]

Jim

[carfac]

Bird:

See, THAT is why I post here- I would have NEVER known that!

dave

[jdMorgan]

Ok, after testing, this works to avoid blocking Zeal:
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0\(compatible\;\ MSIE [OR]

(Note the ";" change from what I posted above)

Jim