Intersting UA

[wilderness]

Note the trailing blank space.

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

[incrediBILL]

That's why sloppy fakers don't even get the first page from my site thanks to ^Mozilla

[wilderness]

It should be noted that forum posting omitted the trailing space.

Modified for forum posting:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"

edited by wilderness.

After repeated attempts the blank space fails.

Blank space after last semi-colon.

[wilderness]

That's why sloppy fakers don't even get the first page from my site thanks to ^Mozilla

Bill could you expand on this?

Unless you add multiple conditions or even redirect?
Your insght is quite deceptive.

Don

[incrediBILL]

Your insght is quite deceptive

Not really, I anchor Mozilla so if it's messed up with any prefix like "user agent:" or a "+" from naive Windows users or even an errant space it all gets the boot.

On the trailing side I boot anything with mismatched parens so if there's an "(" there must be a ")" or boot.

Likewise, trailing space would be considered sloppy as well deserving of a boot.

[wilderness]

more crap.

89.248.162.zzz - - [17/Nov/2008:16:41:45 +0000] "GET / HTTP/1.0" 403 1012 "-" "Mozilla/1.22 (compatible; MSIE 2.0d; Windows NT)"

[jdMorgan]

OK, I'm confused between the descriptions of "trailing" and "after the last semicolon," which would be a ";"

So is there an extra space after the semicolon in "5.1;" like this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;<space><space>SV1)" 

or is there a space at the end, like this:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)<space>" 

?

Anything interesting about the IP address?

Jim

[wilderness]

My apologies Jim.
Your line below correct.

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;<space><space>SV1)"

I don't normally pay the least bit of asttention to RIPE IP's or UA's (except to confirm that they are getting 403's), however due to the rash of fake googles (another thread) I saw this UA from the IP:

81.169.154.zz

[wilderness]

and yet another.

"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; BookmarkSync; Acoo Browser; GoogleT5; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 1.1.4322; MEGAUPLOAD 1.0; .NET CLR 3.5.20404; .NET CLR 3.5.20706; .NET CLR 3.5.21022; FDM; .NET CLR 3.0.30729; SPC 3.1 P1 Ta)"

[GaryK]

I've had two people contact me today with similar type user agents and wondering how come my files don't ID it as, using your example, WinXP. And then they got upset when I told them it's not even a valid user agent. Sheesh. I need a vacation.

[wilderness]

Hey Gary,
These thing catches at least four UA denials from my htaccess.

Unfortuantely the IP from a concentrated widget locale, which nearly prevents for me restirction by IP. Their provider is one of the few that offers diverse sub-nets through ARIN.

I suppose in a squeeze I could use multi-conditional rewrites, however in this instance it wasn't necessary :)

Don

[keyplyr]

...repeated attempts the blank space fails.

Wilderness, if you manually hit the space key twice you'll achieve one space. The forum software only removes the first space.

[wilderness]

Many thanks keplyr.

The last edit attempt I made (prior to my comment), I used the space bar three times and the result was still a single space.
I was confused by the result as it had worked successfully in the past.

Jim's solution worked.

Dom