Forum Moderators: open

Message Too Old, No Replies

User-agent with ....../1.0?

Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; ....../1.0 )

         

seindal

10:45 am on Oct 29, 2003 (gmt 0)

10+ Year Member



I have seen several visits with a user-agent of

Mozilla/4.0 (compatible; MSIE 4.0; Windows NT; ....../1.0 )

The dots are there, it is not because I have blanked out anything.

Some of these visits appear legitimate, but others went for the honey pot and got stuck.

Does anybody know what makes the user-agent? Is it some toolbar or BHO? Is it a parasite? I spotted it on an affiliate site.

René.

BlueSky

12:03 pm on Oct 29, 2003 (gmt 0)

10+ Year Member



I saw the same UA last week. He tried accessing three directories without using a trailing slash. The server fed him 301s to go to the same names with a slash, but he never followed so he got no content. Since he didn't follow 301s, I don't think that UA represents any browser.

He came to me from 64.3.224.163. What IP(s) did you see him on? I've been waiting to see if he will ever return.

bull

12:33 pm on Oct 29, 2003 (gmt 0)

10+ Year Member



Botlist says:
2310 [webmasterworld.com]

seindal

12:41 pm on Oct 29, 2003 (gmt 0)

10+ Year Member



Here are the sites that have access one of my sites with this UA, and the number of requests they have made:

1 bdsl.66.15.65.136.gte.net
350 dsl254-029-100.sea1.dsl.speakeasy.net
399 w130.z064003224.sea-wa.dsl.cnc.net
454 dsl254-028-100.sea1.dsl.speakeasy.net
457 w162.z064003224.sea-wa.dsl.cnc.net
475 66.15.65.136
484 dsl254-027-100.sea1.dsl.speakeasy.net
488 dsl254-030-100.sea1.dsl.speakeasy.net

The one you gave corresponds to w163.z064003224.sea-wa.dsl.cnc.net

I'm banning them.

seindal

12:45 pm on Oct 29, 2003 (gmt 0)

10+ Year Member



Thanks, bull, I hadn't found that one.

BlueSky

12:52 pm on Oct 29, 2003 (gmt 0)

10+ Year Member



Aaaah, finally can read it. I think it might be better to ban by the dots instead of IP.