Educational Unit

took 52 files - one image only - the contact image

[Ken_S]

<> Downloaded 51 html files @ 10 sec --

took only one image,

which was my contact

131.216.0.0/16 = 131.216.0.0 - 131.216.255.255
131.216.29.xxx - - [09/Nov/2012:09:12:11 -0800] "GET / HTTP/1.1" 200 3791 "-" "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"

Ken

[wilderness]

There was a time when "UA ends with 5.1" was a valid browser, however that's not so today.

Also note leading space before semi-colon.

[dstiles]

I think NT 5.1 (XP) is still valid. However MSIE 6.0 is defintely past its sell-by date.

[lucy24]

I hate those Early Registration blocks. You never know what you're going to find.

:: shuffling papers ::

Making up a random number for ddd gets me the Nevada System of Higher Education for the whole /16. Which can be anything from legitimate research to a computer-science class to unauthorized activity on the side.

[wilderness]

I think NT 5.1 (XP) is still valid.

I agree, just NOT "ends with".

[keyplyr]

I think NT 5.1 (XP) is still valid.

I agree, just NOT "ends with".

I block UAs that end with 5.1.

[Ken_S]

Thanks for the input
Much appreciated - Ken

[dupres01]

What about a UA ending in 5.0?

For example (from my logs):
"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)"

[wilderness]

That UA (ends with Trident) is fairly common these days, however I use it in some instances as a dual condition with an IP.

[thetrasher]

I think NT 5.1 (XP) is still valid.

Not without SP2 or SP3

an SV1 token appears in the user-agent string of a Windows XP user who has installed Windows XP Service Pack 2 (SP2)

[msdn.microsoft.com ]

[wilderness]

For the 3rd time in this thread ends with 5.1

thrahser,
from your msdn page:

SV1
Internet Explorer 6 with enhanced security features (Windows XP SP2 and Windows Server 2003 only).

Trident token
Trident/5.0 Internet Explorer 9

IE 8 or above requires installation of SP3 on an XP machine.

[Ken_S]

TrendMicro has used the same UA on my site for around 3 yrs.

150.70.0.0 - 150.70.255.255 - Trendmicro (USA)

150.70.64.xxx - - [27/Aug/2011:07:24:33 -0700] "GET / HTTP/1.0" 200 3968 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

150.70.172.xxx - - [17/Sep/2012:21:00:58 -0700] "GET / HTTP/1.0" 200 3999 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Ken

[wilderness]

TrendMicro has used the same UA on my site for around 3 yrs.

Ken,
If you wish to allow an exception for Trend than just add an IP line with a leading exclamation point.

Personally, I've gone to great lengths for more than a decade to prevent my site from being cached.
Most content filter tools that are greedy are going against the grain.
Trend is the worst offender.

I'm sure there's old threads on Trend ;)

Don