Welcome to WebmasterWorld Guest from 107.20.34.173

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Anyone else seeing UA Mozilla 28.0

On Bell or HP IP (I think)

     

not2easy

8:20 pm on Jul 17, 2014 (gmt 0)

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month



135.245.48.14 - - [06/Jul/2014:11:25:46 -0500] "GET / HTTP/1.1" 200 13808 "-" "Mozilla 28.0" has visited a few times this month always that same IP which shows:
135.220.0.0 - 135.255.255.255
135.220.0.0/14, 135.224.0.0/11
Alcatel-Lucent
tech contact: somebody-at-hp.com

It does the things a human would do but what the heck is it? So far it hits only the home page there.

aristotle

9:17 pm on Jul 17, 2014 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member Top Contributors Of The Month



Could it be an app?

dstiles

9:37 pm on Jul 17, 2014 (gmt 0)

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member



I have a lot of rubbish on 135.245.48.nn and 135.245.168.nn that I wasn't aware of (13 in total, the former this month, the latter March). Time to look at blocking, I think.

I have the range 135.220.0.0 - 135.255.255.255 listed as Lucent but only those /24s are troublesome so far.

not2easy

12:17 am on Jul 18, 2014 (gmt 0)

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month



I think I will follow your lead, dstiles. I don't care for disguises on visitors, even when they are smiley faced. Thanks!

@aristotle - Yes, I had that thought, I looked at every resource I know of to try to find out what it is, but the Mozilla 28.0 name is only showing up in reference to the Firefox 28 browser, no appps.

Pfui

1:08 pm on Jul 18, 2014 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



Ten hits to PHP honeypots in eight months using the same fake "Mozilla 28.0" UA -- [projecthoneypot.org...] -- equals a blockworthy IP, imho.
 

Featured Threads

Hot Threads This Week

Hot Threads This Month