Mozilla/5.0 (Version: XXXX Type:XXXX)

[BlueSky]

Today, someone started using random numbers and letters in UA strings like this:

kjecvomqy fvrjkjOecjsOhyaghysO
ejnqjbwqlwteClescevqndbCctojkd
66 rnndcvXweqgXcavuxkffikyx

When I did a search on the IP (66.139.75.45) in my logs, it turns out he's been visiting for a number of days and previously was using the same UA format as described in this thread here: [webmasterworld.com...] The version and type changed on every page accessed as is happening with the gibberish UA's. Mine didn't ask for multiple pages in a row. He accessed one then came back several hours later and pulled another and only 4-5 per day. So, he flew under the radar screen. Looking at the pages accessed, I think he's either part of the hit and run gang or a hijacked server.

The IP goes to a Rackspace dedicated server belonging to a small ISP in Texas. I wrote to them and hopefully they give me a clue on what this thing is.

Question: is the Mozilla/5.0 (Version: XXXX Type:XXXX) UA format used by any legit browsers?

[claus]

The link you posted above goes to the supporters forum now.

>> is the Mozilla/5.0 (Version: XXXX Type:XXXX) UA format used by any legit browsers?

Here's a thread with some valid Mozilla/5.0 useragent [webmasterworld.com]s

Personally I haven't seen one icluding "(Version: XXXX Type:XXXX)" in the UA string. I suppose it's homebrew of some sort, perhaps a bot, although with just 4 pages a day a browser sounds more likely.

/claus