where old browsers go to die

Netscape hits bottom

[lucy24]

Has anyone met these guys recently?

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

First noticed them a couple of days ago, but had to go all the way back to 2005 [webmasterworld.com]* to find that distinctive "NS8/0.9.6" component. I then scanned the raw logs and found that my Ukrainian friends-- the ones who have now met the Ultimate Doom**-- started using it a few weeks ago in their repertoire of forged UAs and bogus referers. So have a couple of others, ranging from beyond-the-shadow-of-a-doubt to almost-certainly robots.

For the time being, I'm sending this UA to the "I don't like your face" page in the rare case that they're not already locked out for IP or other reasons. I mean, someone in eastern Europe could still be using a browser dating from 2005, but I have definite doubts about Tampa (where I first noticed it).


* Using g### search. Our site-internal search wouldn't play nice, though it will admit to having heard of Netscape.
** 127.0.0.1. This is Not Nice, but it's not outright illegal. I don't think, anyway.

[Pfui]

Fifteen attempted hits from this variation on a theme thus far this month:

MSIE 6.0 spoofing as Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) NS8/0.9.6

FWIW, my array o' hoops to jump through includes a 403 page with a link to an off-site page with info and "#echo var=" details and a reCAPTCHA (insert breath here) Mailhide link to an e-mail address for real people.

(Aside: I 403 the iffy ones, 127.0.0.1 the newly pestilent, and firewall-killfile the infernally relentless. Final destinations may be mood-dependent:)

Another recent LOL-worthy 403'd oldie was:

Mozilla/1.22 (compatible; MSIE 2.0; Windows 95)

That traveled from an OVH France IP familiar to Project Honey Pot. Scroll down this [projecthoneypot.org] page to see its other faked UAs, including this super oldie:

Mozilla/0.6 Beta (Windows)

Merde.