Forum Moderators: open

Message Too Old, No Replies

Is this an invalid UA?

Mozilla/6.0 (compatible; MSIE 6.0; Windows NT 5.2)

         

Wizcrafts

6:07 pm on Nov 2, 2003 (gmt 0)

10+ Year Member



My site was 'visited' on Nov 1, at 09:31, by somebody/thing that requested only Javascripts, CSS files and images from my header. In each case the referer field was the resource being downloaded. There is no usual point of entry visible, and no html files were requested. They went straight to my 'scripts' and 'images' subdirectories, and fetched 13 files, then left. There is no prior log of this visitor.
The User_Agent of the 'visitor' is
Mozilla/6.0 (compatible; MSIE 6.0; Windows NT 5.2)
, which looks invalid to my eye. Is this a valid or invalid UA?

Also, a half hour before this occurred, there was a very odd visit identified as:

localhost - - [01/Nov/2003:09:02:23 -0500] "GET / HTTP/1.0" 200 2163 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) Fetch API Request"

TIA, Wiz

WebJoe

7:00 pm on Nov 2, 2003 (gmt 0)

10+ Year Member



Mozilla/6.0 (compatible; MSIE 6.0; Windows NT 5.2)
looks like a valid UA to me, Windows XP with a standard IE 6.0, no .NET framework, no hotfixes applied. And that makes it a bit suspicious.
The behavior could be explained with the "make available offline"-functionality, but to my knowledge IE adds
MSIECrawler
to the UA-string. I don't know what referer it uses.

bull

8:18 pm on Nov 2, 2003 (gmt 0)

10+ Year Member



This is NOT a valid UA string IMO. The right ones for MSIE 6.0 are e.g.:

Mozilla/[b]4.0[/b] (compatible; MSIE 6.0; Windows NT 5.0)

Anything above Mozilla/5.0 is likely to be something else, see my compiled bot list in the library, too (see especiall "Mozilla/5.0 (Version: ... Type: ...)" and "Mozilla/8"). Slurp e.g. identifies itself with Mozilla/5.0..., and the latest Mozilla-Netscape family too.
Windows NT 5.2 is not XP AFAIK but Windows 2003 Server.

Wizcrafts

9:07 pm on Nov 2, 2003 (gmt 0)

10+ Year Member



Bull, that is my take on it also. I looked at every UA I could find in my logs, and I have never seen anything else claiming to be Mozilla 6.0. I did a RDNS lookup on SS and discovered a Hong Kong Datacentre. I have now denied both the IP range 218.102. and the Domain name, which, for everyone's enlightenment, is netvigator.com.

Wiz

WebJoe

5:04 pm on Nov 3, 2003 (gmt 0)

10+ Year Member



Oops...didn't see that 6. You're right bull. (Note to self: Next time read it carefully)

FineWare

11:33 pm on Nov 3, 2003 (gmt 0)

10+ Year Member



Not only all that but NT 5.1 is XP, and NT 5.0 is Windows 2000. Just wondering if 5.2 is a beta for Windows 2003?

Lord help us.

Mark.

bull

6:39 am on Nov 4, 2003 (gmt 0)