odd apple requests

strange requests coming from apple ramge

[dupres01]

Lately i have been getting a bunch of requests like the ones listed below. the 7 requests listed below all come as a group (within 1 second) and all come from 17.161.x.x (the x varying).

what is this all about?


"GET / HTTP/1.1" 200 33491 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
"GET / HTTP/1.1" 200 11737 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1623.0 Safari/537.36"
"GET / HTTP/1.1" 200 11737 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1623.0 Safari/537.36"
"GET / HTTP/1.1" 200 11737 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D163 Safari/9537.53"
"GET / HTTP/1.1" 200 11737 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D163 Safari/9537.53"
"GET /apple-touch-icon.png HTTP/1.1" 404 301 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1623.0 Safari/537.36"
"GET /images/favicon.ico HTTP/1.1" 200 766 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1623.0 Safari/537.36"

[Ocean10000]

I just looked up the range and it belongs to Apple.

They might be testing. And used the different user-agents to see if the html varied at all, and how your site responded.

[dstiles]

I have 17.161.96.0 - 17.161.127.255 blocked with the note "bad hits and stealth IPs" (ie the IPs' ports are semi-blocked to a port scan).

[dupres01]

so far I have seen 17.161.96.x and 17.161.97.x
so that would line up with what stiles has blocked. i may follow suit.

[wilderness]

These an old thread (s) on Apples requesting custom PNG files for their browsers. Some even request specific sizes.

In the event you don't have the custom images, just disregard and they'll be content with 404's.

[dstiles]

I have no problem with those but they seem to come from the same IP as site access.