Mozilla/5.0 (Version: 1334 Type:216)

seemingly random numerals

[bird]

Just noticed that I had a few instances of this UA in my logs over the last few months. There's an old thread from July (when it appears to have started) here:
[webmasterworld.com...]

There's a different IP per session, mostly dialups. During each session, it primarily fetched the same page about a dozen times over the course of the day, with one or two neighbouring pages in between. Another annoying habit seems to be that it appends both absolute and relative links to the URL of the link page, which either results in invalid paths or in paths containing "/../".

My guess is a lousily written spider for whatever purpose. I can't see any legitimate use for its crawling pattern, so there's another entry for by block list...

[BlueSky]

I have the same thing happening but mine is coming from a dedicated server: [webmasterworld.com...] He switched from using Mozilla/5.0 to random number/letter UAs. Even though he's gotten 403's, he continues to visit requesting different pages in the middle of my site. So, he's been there before using another disguise.

[pendanticist]

I've seen similar:

Loner:

66.98.152.53 - - [06/Oct/2003:03:09:25 -0700] "GET /Blahblah.html HTTP/1.1" 200 5938 "-" "Mozilla/5.0 (Version: 1614 Type:3480)"

Loner:

65.50.37.216 - - [08/Oct/2003:12:54:08 -0700] "GET /Blahblah.html HTTP/1.1" 200 9895 "-" "Mozilla/5.0 (Version: 339 Type:3515)"

Visited Twice:

66.139.75.45 - - [06/Oct/2003:15:59:22 -0700] "GET / HTTP/1.1" 403 480 "-" "Mozilla/5.0 [b](Version: 3900 Type:2310)[/b]"

66.139.75.45 - - [08/Oct/2003:13:32:55 -0700] "GET /Blahblah.html HTTP/1.1" 403 480 "-" "Mozilla/5.0 [b](Version: 2976 Type:4755)"[/b]

Visited Twice:

65.50.38.225 - - [09/Oct/2003:11:29:14 -0700] "GET /Blahblah.html HTTP/1.1" 200 5938 "-" "Mozilla/5.0 [b](Version: 4152 Type:2077)"[/b]

65.50.38.225 - - [09/Oct/2003:23:03:07 -0700] "GET /Blahblah.html HTTP/1.1" 200 5938 "-" "Mozilla/5.0 [b](Version: 521 Type:4237)"[/b]

Anyone got anything conclusive?

Pendanticist.

[jdMorgan]

> Anyone got anything conclusive?

Yes:

RewriteCond %{HTTP_USER_AGENT} ^Mozilla/5\.0\ \(Version\:\ [0-9]{2,4}\ Type\:[0-9]{2,4}\)$
RewriteRule .* - [F]

This is pretty conclusive for me... :)

Jim

[pendanticist]

Jim, Thank You. :)

Pendanticist.

[BlueSky]

The host I wrote to stopped the activity but never wrote back to tell me what this was. It didn't help much because this bot is now coming in from three more small hosts in Texas. So, I'll write to them next.