'compatible'

[wilderness]

Ia anybody seeing this term (compatible;) used in a UA that is NOT a bot?

I went through one-days logs (it's a bit of nightmare due to frequency) and all I saw was bots.

[dstiles]

From memory, I think it's a bluecoat proxy if it has just that and a moz identifier; I let it go with a warning but I don't think it gets much anyway. Probably just looking at the site prior to a proper view. I also have blocked with harsher methods...

^Mozilla/[0-9]\.[0-9] \(compatible;\)

(note \ escapes)

[lucy24]

Is that

compatible;)

with semicolon followed immediately by close-parenthesis? It isn't enough to disable smileys in your own prefs; you also need to disable them for an individual post so other people don't get them either.

:: disgruntled because I've just spent a lot of time poring over logs, studying the "compatible" pattern, before I realized what you meant ::

(note \ escapes)

If you're using this in mod_rewrite, don't forget to escape the space as well. (This is currently my most common fatal htaccess error.) In mod_setenvif you can use quotation marks instead.

[wilderness]

a few from today

compatible; bingbot
compatible; Yahoo
compatible; Googlebot
compatible; DomainAppenderr (wouldn't make it thru other filters)
compatible;Baiduspider (wouldn't make it thru other filters)
compatible; MSIE 6.0; (kinda doubt this is legit)
compatible; MSIE 8.0; (this is legit)
compatible; DuckDuckGo-Favicons-Bot

[lucy24]

Oh, you did mean "compatible;" without parenthesis, so my time wasn't wasted ;)

In addition to the bingbot and Googlebot, MSIE 6-8 say
Mozilla/4.0 (compatible; MSIE {number}
while 9 and 10 have 5.0 ditto. MSIE 11 doesn't say "compatible". (On account of it's a real browser and no longer has to say it knows how to fake it? Ahem.) I think "compatible" was also a legitimate part of the MSIE 4-5 UA string, but at this point it's kind of an academic question.

Most legitimate search engines-- and plenty of illegitimate ones, which I guess was your original question-- use it. You can search your raw logs for something like
Mozilla/[45]\.0 \(compatible; (?!bingbot|Google|MSIE|Yandex|MJ12|Exabot|Seznam)
to pull up others. It definitely isn't an "unwanted visitor" flag.

Edit:
Oh, oops, I'd forgotten about this one.

Mozilla/4.0 (compatible;)

and that's all is some kind of archiver. Someone may know more; I see it sometimes after a legitimate human visit. But that's the only thing I've ever seen that goes straight from semicolon to parenthesis.

[dstiles]

Oddly I do not see smileys in this thread - the UAs are correct for me.

Mozilla/4.0 (compatible;) is the one I was referring to earlier - the bluecoat firewall thingy.

[lucy24]

I do not see smileys in this thread

Have you set your global prefs to not show smileys at all? For me, each

;)

turns into ;) (wink)

[dstiles]

Ah. That's probably the case. :)