Osborne

[wilderness]

Question (regarding provider) and heads up.

63.80.56.zz - - [21/Mar/2009:15:45:05 -0500] "GET /MyFolder/MyPage.html HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3"
70.164.231.zzz - - [21/Mar/2009:15:45:05 -0500] "GET /SameFolder/SamePage.html HTTP/1.1" 200 34498 "http://www.google.com/search?hl=en&rls=com.microsoft%3A*%3AIE-SearchBox&rlz=1I7DKUS&q=on+topic" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"

63.80.233.zzz - - [21/Mar/2009:15:47:25 -0500] "GET /ImageFolder/ HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3"
63.80.233.zzz - - [21/Mar/2009:15:47:35 -0500] "GET / HTTP/1.1" 403 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3"

Returned on two additional visits approx., six hours each later.

The first two lines seem to be some kind of content filter?

Anybody know for sure as I was without success locating any info on the provider (ARIN provides Santa Clara, Cal. I did find a reference to a book publisher on networks, however fail to determine in logic in the possible association)?

2006 was part of a UUNET subnet:
63.80.56.32 - 63.80.56.63

2007 range (63.80.56.32 - 63.80.56.63) reassigned to MCI/Verizon Business.

The last two lines and the subsequent six-hour intervals are new ranges to me from this provider. A direct request for an image directory is almost like a bomb exploding.

Apparently I've something that catches the "1.0.3" UA, however I was unable to locate the cause. Perhaps a syntax error. In any event had it not been for the undetermined cause, I may have never noticed the new range.

[dstiles]

I've got that IP range blocked but I have no idea why. It must have upset me at some time in the past, unless I picked it up in a warning elsewhere.

[jdMorgan]

> Apparently I've something that catches the "1.0.3" UA,

No closing ")" on that UA.

I've had Todd's network blocked for years. Notes say "Invalid UA & headers, switched UA after deny"

Jim

[wilderness]

I've got that IP range blocked but I have no idea why.

dstiles,
the 233-Class C is a newly used IP.

the 56-Class C was doing complete crawls (or at least attempting)during 2006.

Thank Jim.
I noticed the missing close, however was unable to locate a line in the gobbly-gook which denied for lack thereof.
Based soley on recollection, I seem to recall quite a few others getting through absent a close.

[thetrasher]

Address: 1st fl RJ45

There is only one RJ45 socket on the first floor of Microsoft's data center ("SC6 building")?

[dstiles]

Sorry, Wilderness, I was referring to the IPs in the synopsis at the end - I missed the earlier 63.80.233.nnn reference.