More Multi-National Attempts from Avant Browser and IE 5 on Win 3.1

[incrediBILL]

Don't know why they are so interested in just this one page, it's quite amusing really, but after the Opera invasion [webmasterworld.com...] , they came back as the Avant Browser and then later in the same day took another run claiming to be MSIE 5 with Win 3.1 ....

... can you say LOL?

58.83.224.217,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
207.249.9.128,Mexico,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
116.112.64.226,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
218.74.123.46,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
119.147.146.14,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
79.170.50.38,Saudi Arabia,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
121.13.252.100,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
218.69.96.4,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
122.72.2.184,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/thesamepage.html
122.72.2.190,China,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Avant Browser [avantbrowser.com]; Hotbar 4.4.5.0)",/index.html

219.232.252.244,China,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
218.22.64.244,China,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
24.8.147.77,United States,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
201.38.234.60,Brazil,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
61.152.106.161,China,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
111.184.216.65,Taiwan,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
125.46.55.246,China,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
113.105.85.6,China,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
117.239.40.69,India,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
71.207.53.182,United States,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
190.252.192.118,Colombia,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
222.122.9.3,Korea, Republic of,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html
200.186.179.215,Brazil,"Mozilla/4.0 (compatible; MSIE 5.0; Windows 3.1)",/thesamepage.html

Idjuts.

[edited by: incrediBILL at 12:30 am (utc) on May 31, 2012]

[motorhaven]

Not sure why they are interested in that page, since I don't know it, but I've had the same recent activity and they used it to try to repeatedly register in our forums despite being fed 403.

[enigma1]

Strange they do not have the windows for workgroups 3.11 upgrade...yet

From the logs they specialize in referrer and comment spam. I do not see them fetching the same page though. They keep their options open.

[motorhaven]

Anything with Win 3.x I block by default. I've yet to have a valid Win 3.x visitor in years! 95/98 gets close scrutiny as well.

[incrediBILL]

These mini-'attacks' for lack of a better word are still happening, about once a day, still focused on the same page.

They've repeated some user agents but the one today is amusing:
"Mozilla/4.0 (compatible; MSIE 5.5; Windows 95; BCD2000)"

Suddenly a burst of IPs from around the world, within just a few minutes of each other, all use MSIE 5.5 and Win 95?

Seriously?

Too funny.

You would think if they're using some proxy IP pool and random user agents that they would at least shuffle the user agents per IP and not make it so obvious unless that's the point here, that they WANT me to find them and are taunting me to come out and play.

95/98 gets close scrutiny as well.

Anything less than MSIE 6 on XP should probably get bounced off the site.

[lucy24]

Robots always have a pet page. They used to go straight for my fattest one. After I moved and renamed it to make it a little harder to find, putting a shorter version in its place, they completely lost interest. Now they go for a page that is entirely pointless without its 24 accompanying images.

Ours not to reason why.

Every time I think I've got something flagged as "This UA can't possibly be human" ... I get a human. Most recently, someone on an older version of Camino whose UA string ends with "like Firefox 2." something. Couldn't figure out why the log wrangler had them color-coded as Robot when it was obviously a human visit, but I always hand-check Camino to make sure they haven't changed IPs on me.

I have yet to meet a human using MSIE 4. But I haven't given up. There's probably a Netscape waiting for me too.

[motorhaven]

X2 about something not possibly being human but there are some cases so rare its not worth my time investigating them and determining how to make an exception in my blocking rules.

As a quick test before replying I went back through the last 60 days of logs, and did a lookup of every Netscape hit. Every one of them where either from Chinese, Russian and Ukrainian IPs, server farms or otherwise showed all the marks of spiders. Any UA with Netscape is blocked by us, no exceptions!

The only older browser I make an exception list for is IE 6.x, as I have many corporate users stuck with using it (much to their dislike).

[incrediBILL]

Now they've used maybe the most amusing UA ever...

"Mozilla/0.91 Beta (Windows)"

Really?

What an international list of IPs this time: Poland, United States, Zimbabwe, Venezuela, Thailand, Palestinian Territory, Germany, Taiwan, Ecuador, Brazil, Russian Federation and then some... as we had multiple attacks today.

I seriously don't understand why they would keep doing this, especially to MY site, and exposing their IPs which are being collected and used to block them on other sites.

Stupidest thing I've ever seen.

[wilderness]

I seriously don't understand why they would keep doing this,

A machine doesn't offer the same logic (consequences) as a human mind.

[lucy24]

People always stomp on me when I speculate about the workings of the robotic mind. But somewhere behind that robot is a human programmer who has instructed it to follow a particular course of action.

[motorhaven]

Sometimes it could simply be an out of date (ie, cheap or free) tool they are using, or the idiot using it just went and copied some list of user agents he found on the web without actually knowing much about UAs.