Blocking Navigator 98 User Agent and NT 4.0

[incrediBILL]

I finally decided the handful of people still using Netscape Navigator 98 we're getting cut off because some distributed crawlers were using that UA to bypass bot blockers.

"Mozilla/4.76 [en] (Win98; U)"

Bye bye Win98 surfers.

End of an era ;)

[edited by: incrediBILL at 8:03 am (utc) on Jan 29, 2011]

[Mokita]

I've been blocking Win98 UAs for up to two years. Basically, anyone who is either too poor or too stingy to upgrade their computer, will not be prepared to pay for what we have on offer.

I haven't kept a very close eye on it, but what I have seen bounced, bears all the hallmarks of bot activity, not human.

[blend27]

same goes for "....NT 4.0", I pulled a plug about a year ago after a scraper bot claimed to be IE8 on NT 4.0 system.

[incrediBILL]

Since you mentioned NT 4.0, which I've yet to block, I checked my logs and the weirdest thing:

195.127.173.171 "GET /button.png HTTP/1.1" 200 491 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot)"
194.153.113.7 "GET /button.png HTTP/1.1" 200 491 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot)"
195.127.173.169 "GET /button.png HTTP/1.1" 200 491 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; obot)"

What the hell is obot and why does it only want button.png?

[Mokita]

obot has been around since at least 2002:

[webmasterworld.com...]

No idea why it only wants a button - probably the same reason that annoyingly persistent crawlers from amazonaws only seem to ask for favicon <shrug>.

[blend27]

oBot:

inetnum: 194.153.113.0 - 194.153.113.255
netname: IBM-PI-NET
descr: IBM Deutschland GmbH

I always thought that it has something to do with IBM AI projects, but who knows.

[caribguy]

obot is cobion, not allowed to play in my sandbox. Relevant thread from 2003: [webmasterworld.com...]

[dstiles]

That IP range looks like another set of /24 ranges, split into loads of different countries. I usually block that type of range out of hand but in this case I've only so far blocked 194.153.113/24.

I've had obot blocked for years. I wonder, if the bot is only hitting button.png, if the image is being used as some kind of avatar in a forum of some kind (if it's a fancy button), otherwise some kind of lazy site designer?