Request for same image via various wireless networks

Mozilla/4.0, No-Referrer, Repeated 1-3 image requests

[mslina2002]

Recently looked at my logs and noticed that there has been repeated requests for just 3 specific images via one specific User-Agent. All with No-Referrer. All from various wireless cell phone networks all over the US, some abroad.

(a) REQUESTS
Only 3 images requested. Image1.jpg, Image2.jpg, Image3.jpg
Some networks only request only requests only one, e.g. Image1.jpg but would request it from various IPs within their network.
While others request the same image from the same IP but about 7-20 minutes apart.

(b) REFERRER
None

(c) USER-AGENT
Mozilla/4.0

(d) IPs
Various cellphone networks. There were multiple requests from all of these networks from either 1+ IPs.
Small sample of some specific IPs, but there are tons more.

174.254.71.230 - United States West Hollywood Verizon Wireless
166.182.3.111 - Wireless Data Service Provider
1.200.229.83 - Vibo Telecom Inc. (Taiwan)
174.141.208.106 - United States Jacksonville Metropcs Wireless Inc.
208.54.36.176 - United States Cleveland T-mobile Usa Inc.

(e) ROBOTS.TXT
no


Not sure if I am understanding what is going on but I am trying to serve them a 403 but doesn't seem to work.

RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0$
RewriteCond %{REQUEST_FILENAME} \.(jpeg|jpg|gif|png)$ [NC]
RewriteCond %{HTTP_REFERER} ^-$
RewriteRule .* - [F]

See anything wrong with the code?

Anyone see this on their logs as well? Why are they all requesting the same image.
Note: These images are nothing special and not even the popular ones on my site so that was also one of the reasons I noticed this. Thanks a bunch.

[wilderness]

There are hundred of examples of anti-hotlinking at Webmaster World.

See this 2004 thread and ONLY used jDmorgan's syntax [webmasterworld.com]

[keyplyr]

If they are exclusively mobile networks, it's most likely an app that is using the image. I have thousands of musician photos. Media players are always scraping and/or hot-linking to these images for their album cover art.

I check for referrer, and if the request comes from a source other than my own domain, I switch the image to an image file with a warning message.

I also use a mod_rewrite condition that blocks several UAs from getting image files (but allow them to play my media.)

BTW - IMO you'd be blocking a large percentage of human users with the code in your post. They will view your site with NO images. You have to allow your own site (all versions) as referrer.

[lucy24]

RewriteCond %{REQUEST_FILENAME} \.(jpeg|jpg|gif|png)$ [NC]
...
RewriteRule .* - [F] 

I can't think offhand of a situation where this configuration would be appropriate. Put it into the body of the rule:

RewriteRule \.(jpe?g|gif|png)$ - [F]

Then your server only has to stop and evaluate the conditions when there is a request for an image.

There's some kind of caching setup whose UA is a bare
Mozilla/4.0 (compatible;)
I'm currently getting them in a context where I know they're human-- that is, there was a human to start with. Most are from places in northern Canada where it's satellite or nothing. (Dialup is meaningless because the phones too are satellite.)

:: taking forums' word for it that smiley will disappear on request even though it still shows up in preview ::

[Bewenched]

I've been getting a lot of them as well even though our site isn't really set up for phone traffic.

Haven't blocked them yet and I don't really want to prevent all hotlinking... I like when a forum uses an image or someones little home page... those are fine.... I track them, and add a small banner to the bottom of it after a while so anyone viewing knows where it came from and hopefully I get some traffic out of it.