Welcome to WebmasterWorld Guest from 54.159.19.75

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Anyone else seeing UA Mozilla 28.0

On Bell or HP IP (I think)

     
8:20 pm on Jul 17, 2014 (gmt 0)

Moderator from US 

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month

joined:Dec 27, 2006
posts:2563
votes: 48


135.245.48.14 - - [06/Jul/2014:11:25:46 -0500] "GET / HTTP/1.1" 200 13808 "-" "Mozilla 28.0" has visited a few times this month always that same IP which shows:
135.220.0.0 - 135.255.255.255
135.220.0.0/14, 135.224.0.0/11
Alcatel-Lucent
tech contact: somebody-at-hp.com

It does the things a human would do but what the heck is it? So far it hits only the home page there.
9:17 pm on July 17, 2014 (gmt 0)

Senior Member

WebmasterWorld Senior Member aristotle is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:Aug 4, 2008
posts:2682
votes: 94


Could it be an app?
9:37 pm on July 17, 2014 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:May 14, 2008
posts:3091
votes: 2


I have a lot of rubbish on 135.245.48.nn and 135.245.168.nn that I wasn't aware of (13 in total, the former this month, the latter March). Time to look at blocking, I think.

I have the range 135.220.0.0 - 135.255.255.255 listed as Lucent but only those /24s are troublesome so far.
12:17 am on July 18, 2014 (gmt 0)

Moderator from US 

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month

joined:Dec 27, 2006
posts:2563
votes: 48


I think I will follow your lead, dstiles. I don't care for disguises on visitors, even when they are smiley faced. Thanks!

@aristotle - Yes, I had that thought, I looked at every resource I know of to try to find out what it is, but the Mozilla 28.0 name is only showing up in reference to the Firefox 28 browser, no appps.
1:08 pm on July 18, 2014 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Nov 5, 2005
posts: 2038
votes: 1


Ten hits to PHP honeypots in eight months using the same fake "Mozilla 28.0" UA -- [projecthoneypot.org...] -- equals a blockworthy IP, imho.