version 1.7 . of what?

[lucy24]

Happened to notice this one recently:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13)

Full stop, end transmission, that's all. Scattered occurrences, all robots, no particular provenance or affiliation.

Obviously the "rv:blahblah" by itself is legitimate; it's how some browsers, notably MSIE, identify their version numbers. Further investigation reveals that truncated form

rv:[\d.\]\)$

(replace $ with " if you're reading Apache logs) only occurs in robots. That includes a few minor but law-abiding bots. In my case I've added it to log-wrangling as one more way to identify robots after the fact, but haven't blocked it outright.

[wilderness]

lucy,
No answer to your question.
I poked around a little and found some references that rv:1.7.13 was relative to versions of FireFox, however the references were rather vague and inconsistent.

On my primary site and for the current month, I've had a mere three instances of 'rv:1.7.13'.

Two were from log spammers with multiple UA's in successive requests.
The third was a solitary root request from a Class A that is denied.

[lucy24]

Heh. I didn't even pursue the question of what this specific set of numbers means. I homed in on the location of the package, hence the [\d.]+ part.

If they really claimed to be Firefox 1.7 they would never have made it in the door :) I'm exceedingly generous w/r/t elderly browsers, but even I draw the line somewhere!

[keyplyr]

IMO these UAs are almost always forged; this one likely a sloppy cut'n paste of a valid UA.