Forum Moderators: open
In my logs I've found the following:
07/06/2003 10:32:02 PM 65.162.184.5 65.162.184.5 Mozilla/3.01 (compatible;) (no referrer)
07/06/2003 10:32:14 PM 65.162.184.5 65.162.184.5 Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)
Is it not strange for a UA to change in 12 seconds (unless someone is viewing my site with 2 browsers?)
Does anyone have any thoughts (or conclusive answers) on how/why this would happen?
Thank you.
Welcome to WebmasterWorld [webmasterworld.com]!
Mozilla 3.01 is a common UA for a proxy server. It is common to see requests from a user behind his ISP's proxy alternating between his real UA and the Moz 3.01 UA. I wouldn't worry about this too much, unless other behaviour looks suspicious - such as a change to a third UA, or a non-typical pattern of page/image fetches.
ARIN resolves the IP address to an interesting spot, though. Of course, you may expect traffic from that area - it depends on your business.
Jim
Thank you for your quick response. I'm sure you will be seeing me here now and then, this board is unbelieveable. Whenever I do a goodle on suspicious bots in my logs, google returns a post here (8 times out of 10) with excellent info.
Anyway, re my original question, there was 8 hits on my main index page within 10 secs from the ip I mentioned, which I found rather strange; but I am very new to this examining logs stuff, so this may be more common than I think, or have legit reasons.
That, along with no referrer made me suspicious. Had you not had a legitimate explanation for the UA changing, I would have considered more seriously banning it.
As it is, being new and all, I will just watch my logs for a while and see if it returns, and also get used to what is 'normal' behaviour by UA's before I go nuts and ban the world :).
I see what you mean about ARIN. Yemen Sprintlink?
paul
>> 8 hits on my main index page within 10 secs...
That bears watching.
Jim
