Yahoo LVLT

[wilderness]

8.12.144.* - - [27/Jun/2008:22:14:26 -0500] "GET /MyFolder/MyPage.html HTTP/1.0" 403 - "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7"

Anybody have a clue what this is?

[edited by: incrediBILL at 7:39 am (utc) on June 28, 2008]
[edit reason] Obscured IPs [/edit]

[incrediBILL]

I can tell you I've seen it on 2 IPs in that range and it first shows in my logs on 01/02/2008 and last seen on 01/08/2008.

It's also coming through a proxy "1.1 [e-mail]:3128 (squid/2.6.STABLE13-20070603)" and Novarra is a mobile technology company.

Not sure what mobile devices use Linux or if that's just the UA being used on their middleware for content adaptation for mobile devices.

However, everything points to something related to Yahoo's mobile portal best I can tell.

[g1smd]

What makes you think it is anything other than a normal copy of Firefox running on a Linux box?

That is what I would have assumed.

I wouldn't have given it a second look (unless it was requesting a lot of files very quickly or something).

[incrediBILL]

The user agent is but only one of many signals to use when processing information about something accessing a server.

The first clue is the IP resolves to "cach*.nov.mobile.re*.yahoo.net" which indicates some sort of mobile service and the fact that their was proxy info, as I explained above, also points to a mobile service.

[g1smd]

Ah. Got it.

[wilderness]

Many thanks Bill and g1smd.

To have "my widget" folks using Linux is quite unusual.

Even with that rarity in mind, I do recall seeing linux from mobile devices in the past. That result does require careful consideration on my part.

This thing grabbed (or attempted) the same page three-times-in -succession seconds apart in a non-peak time.
Then made a duplicate request for a different page.
Then a single request for a third page.
And left after 403's on all.

[jdMorgan]

Another clue on this "Novarra" issue is that if you do a Yahoo! search on a mobile device, it results in two sets of results. The first set of results is "Web pages" and the second set is "Mobile pages." If you hover over one of the "Web pages" results, you'll get something like this:

http://nov1.m.yahoo.net/yng0/I31GaJBLMcv1u3PHeZi1Lw__/1214656254/www.example.com/ 

(domain examplified and key-number munged)

where "www.example.com" is the URL of the target page. Since the searcher is using a mobile device, and the page is not using a content-type or layout suitable for mobile devices, Yahoo! is giving the searcher the URL of a Web-to-mobile format translator and passing the site's URL for translation, instead of a direct link to the site.

In fact, I just tried this on my site, and the translator did a credible job of re-formatting the page to suit a mobile device. I'll post the server access log entry when I find it.

Don, the number of people using mobile devices to surf the Web is growing quite fast, so you may want to plan on changing your 403s to 200s for this type of visitor some time soon... :)

I just wish Yahoo/Novarra would update their Firefox UA to something that isn't two generations behind the current version.

Jim

[wilderness]

Don, the number of people using mobile devices to surf the Web is growing quite fast, so you may want to plan on changing your 403s to 200s for this type of visitor some time soon

Many thanks Jim.
When or IF, mobile devices become the majority of visitors?
I'm done with web pages.

Imagine a mobile device attempting to view a 3-5,000 word article enhanced by images and in-content links.

Don

[jdMorgan]

> Imagine a mobile device attempting to view a 3-5,000 word article...

Don, you'd be amazed what people will do when they're stuck in an airport or on a bus somewhere... :)

It is quite feasible that a person in such a situation might want to read your content, perhaps on their way from Sidney to St. Paul...

That's just an example, I see bored people (at work?) using their phones to read my (long) stuff, and many other scenarios... Point is, the mobile Web is coming on strong -- Don't miss it!

Here's what I got in my logs using the Yahoo mobile translator:

8.12.144.** - - [28/Jun/2008:11:12:08 -0500] "GET / HTTP/1.0" 200 31915 "-" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7" 
8.12.144.++ - - [28/Jun/2008:11:12:08 -0500] "GET /pstyle.css HTTP/1.0" 200 2301 "http://www.example.com/" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.7) Gecko/20060909 Firefox/1.5.0.7" 
<...more requests for images, etc.> 

The last octet of the IP address changed for many of the requests -- I saw four different IP addresses used for a total of 14 requests.

Jim

[edit] fixed side-scroll due to formatting [/edit]

[edited by: jdMorgan at 4:12 pm (utc) on June 28, 2008]