NerdyBot and the Google Cloud

Google range with strange referrer

[dupres01]

this showed up in my logs:

162.222.176.2 - - [04/Apr/2014:10:05:50 -0600] "GET / HTTP/1.0" 200 8501 "-" "NerdyBot"

that is the entire entry; no user agent. the ip address appears to be Google. What is going on here?

[not2easy]

Isn't the

"http://www.google.com/search"

bogus as a referrer? If I paste it in my browser it 301s to https: so I consider it some kind of bot. (I am not logged in to anything Google when it does that.)

I've seen another one with /blank.html instead of /search as the referrer and consider that to be bots because

"http://www.google.com/blank.html"

returns a 404.

UA for that was

"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/534.59.10 (KHTML, like Gecko) Version/5.1.9 Safari/534.59.10"

My suspicions lean toward proxies on some of their "hosting solutions".

[lucy24]

Sent using PPC Mac FF 3.5.9 entering second decade and still towing barges

3.5? Really? Do I need to poke a hole for you? I block FF 1-7 except 3.6 and 4. For some reason I do see the occasional human using FF 4, as well as 3.6 (mainly but not exclusively in the Camino UA string).

I've seen another one with /blank.html instead of /search as the referrer

That's mobile search. I remember when they started using it. The word "blank" is probably not a useful search string in the present forum ;) or I'd suggest looking for the thread where it was discussed.

[keyplyr]

I've not seen "/blank.html" as a mobile search referrer, but I have seen it as the referrer to my images that are in Google Image Search.

[lucy24]

Oops, sorry, that's what I meant. Mobile image search. I was able to replicate it by searching with the iPad.

[dstiles]

> Sent using PPC Mac FF 3.5.9 entering second decade and still towing barges :)

Ah. A tendency to suicide. :(

[Angonasec]

FF 3.5.9 is the final version a Mac PPC can use. So if you want visitors who use ten-year-old Mac, then open up Lucy :)

Incidentally, the newest Safari version a PPC Mac can run is 4.1.3 (I think), and I recently posted in the Apple forum using it, but discovered I cannot reply in my own thread, no ban, just a js bug, but no great loss :)

Mr. Retro is hanging on for the 12" Retina Air touted for 2015.

[lucy24]

the newest Safari version a PPC Mac can run is 4.1.3 (I think)

And the newest version OS 10.6 can run is 6. I've complained elsewhere about being locked out of a site purely because I wasn't using the latest version of Safari. Someone must have told the developer that Safari auto-updates-- but neglected to mention that it's constrained by your OS. I guess that means I add "PPC" to the list of exemptions (currently featuring a clutch of Qiniq/Northwestel IPs).

Unless, of course, the user is inexplicably devoted to MSIE. The UA string for MSIE 5 (the final Mac version) says "PPC", presumably because Intel wasn't introduced until after MSIE-for-Mac was no longer being developed. Or possibly it's an artifact of Rosetta.

I cannot reply in my own thread

Hee. I can still use Camino in apple forums. But for some venues I have to use Safari. It isn't always easy to tell whether it's something the browser genuinely isn't able to do, vs. the site making wrong assumptions.

[dstiles]

I have no reference details for early firefox but in the past couple of years (I think) FF and other browsers have advanced to higher security factors for SSL and dropped seriously obsolete methods. It is possible that anything older than, say, three years may not work on SSL sites from here on in. I'm not sure. It's worth checking if you use obsolete browsers. Obviously this does not apply for non-SSL traffic.

[lucy24]

FF and other browsers have advanced to higher security factors for SSL and dropped seriously obsolete methods.

Sometimes Camino will put up a message saying the site's security certificate is expired. I tend to assume this has something to do with the browser no longer updating. If I'm buying from an unfamiliar site (speaking as a user) I'll switch to Safari or Firefox.

Once in a blue moon I'll get a Russian human using a Presto version of Opera (i.e. <= 12). But not-- haha-- "Bork-edition".

[Angonasec]

Camino... that brings back memories!
There's also the TenFourFox version of FF for PPC users.

We have blocked all Opera traffic for years, (all Blackberry too) for ethical reasons.

[dstiles]

Cert expiry can be viewed in various ways. If it's a site I know, I allow it (I use linux so the danger is low in any case). But it can mean that a site has been taken over by someone dangerous. I think it's unlikely that the browser is not updating, since the browser only requires the root and, sometimes, the intermediate certs - the site cert is presented and accepted/rejected purely at the moment of connection.

You may come across a self-signed cert but on public sites that's dangerous.

No problem with Opera (non-Bork!) as long as it has all its proper credentials. I don't block any more of those, in proportion, than of any other "browser".

Blackberry is usually ok; no worse than any other "mobile".

[lucy24]

We have blocked all Opera traffic for years, (all Blackberry too) for ethical reasons.

Opera? Ethical reasons?! Is there something about Norway I need to know?

[Angonasec]

Q/
...mobile versions of Opera were the most used in some countries such as Nigeria (64.81%), Belarus (64.47%), Ukraine (58.39%), Russia (42.2%), and Haiti (31.41%).
/Q

If you have ever had the misfortune to communicate with Opera Staff, you will understand completely why it's the most popular software with the nefarious.

Nuff sed.

[keyplyr]

Just because a couple guys in a Nigerian internet cafe used Opera mini to hit your site you block the world's Opera users?

[lucy24]

mobile versions of Opera were the most used in some countries such as ...

I had to look it up. The quote is from wikipedia. I was all set to wonder about the author's native language, because this line is subject to half a dozen different readings, especially if you start tweaking the comma placement.

Besides, it's trivial to lock out Opera Mini while leaving desktop Opera alone. Or vice versa.

[Angonasec]

Far from the mark KeyP/

Apply more quiet reflection folks ...nuff sed :)

[keyplyr]

Put up a [R=301] to one of my sites. I have no problem selling to Opera users.

[Angonasec]

quod erat demonstrandum :)

[keyplyr]

e pluribus unum :)

[lucy24]

Quousque tandem abutere, Catilina, patientia nostra?

I win.

[keyplyr]

Quousque tandem abutere, Catilina, patientia nostra?

+1

[Angonasec]

A Merry Christmas and a Happy New Year to both our readers :)

[lucy24]

both our readers

:: irritably wishing that the Apache subforum next door had more than one daily reader, because I swear I've been making up answers out of the clear blue sky ... which becomes increasingly hard to find in these parts at this time of year ::

[Angonasec]

Well, be encouraged Loose; We're all glad you've taken up Jim's baton, if not his mantle, for the occasions when the RegEx demon dares manifest.