App3leWebKit

[lucy24]

Look what I found while looking up something else:

Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1

I am not the first person to find it, judging by the number of search-engine hits even after I convinced g### that it wasn't a typo. But it doesn't seem to have been mentioned here, so let's add it to the list.

Obviously the significant part is

App3leWebKit/53.1

with displaced 3. That's the part that goes in your UA blacklist .

:: pause here for blacklist vs. whitelist argument ::

But what's equally interesting is that every single UA-- spanning the past 6 months, with isolated older examples-- is identical to the full string quoted at the beginning. Could swear I once read an SF story on this theme. Or was it a comic book?

Huh.

[edited by: Ocean10000 at 10:34 pm (utc) on Aug 10, 2013]
[edit reason] Fixed Typo - upon Request [/edit]

[keyplyr]

What ever you do, don't fall asleep!

[dstiles]

Thanks, Lucy. An odd one!

[motorhaven]

Hit us 622 times in the past 30 days, detailed headers passed for something legit. But upon searching for this UA in our logs I find nothing but crawling activity, no legit users. Good catch.

[bhukkel]

I was hit 48 times yesterday with this UA from 3 different subnets. Most of the requests were 404.