Puffin

[lucy24]

Not a black-and-white animal from Google's zoo but a user-agent. Does anyone know anything?

Human (from, weirdly, a CloudMosa/Hurricane Electric range-- aren't those servers?):

Mozilla/5.0 (X11; U; Linux x86_64; en-CA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.114 Safari/537.36 Puffin/4.5.0IP

Multiple favicon requests from a completely different IP (Sympatico) but otherwise part of the same visit (on account of how I don't have the kind of site where two unrelated Canadians with an unusual UA would visit the same page at exactly the same time):

Puffin/13939 CFNetwork/711.5.6 Darwin/14.0.0

A few days later comes an isolated favicon request from a third, entirely unrelated IP, this one in Germany:

Puffin%20Free/13818 CFNetwork/711.3.18 Darwin/14.0.0

(That's a literal % 20 in the UA.)

Delving further into archived logs I find a scattering of Puffins going back to 2013, but what the heck is it? A mobile browser? An add-on of some kind? The favicon request is new; that's what caught my attention.

[keyplyr]

Hurricane Electric range-- aren't those servers?):

Yes, but they lease to ISPs and app companies that may bring humans to your site. I poke holes for several Hurricane ranges. The so-called cloud ranges are most often used for mobile. No longer can a webmaster profile a server farm or hosting company as bad strictly because they port servers.

There are many variants of this UA. It saves your files to the user's local machine or phone. I block CFNetwork which takes care of them all. This is most always found on Apple devices as part of the iCore Services, but I have seen it in a Linux UA, possibly spoofed though. If you do a search for CFNetwork there's a lot of info.

[wilderness]

FWIW, Puffin is a java browser (i. e., Google)

[keyplyr]

FWIW, Puffin is a java browser (i. e., Google)

This is a different Puffin.

[keyplyr]

Coincidentally I just saw this in my logs:

[ip range] - - [07/Sep/2015:00:56:19 -0700] "GET /example.html HTTP/1.1" 403 982 "-" "Puffin/13961 CFNetwork/711.1.16 Darwin/14.0.0"

[ip range] - - [07/Sep/2015:00:56:19 -0700] "GET /example.html HTTP/1.1" 200 9925 "http://t.co/r8zY8yYdmv" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12B440"

The 2 hits were to the same page. As noted above, I block "CFNetwork" so the 1st request was served my 403 page. I suspect this 1st hit was to cache (download) the page in some manner. Unable to do so, the iPhone default browser requested the files. The time stamp suggests these 2 agents ran concurrently.

[dstiles]

I have puffin enabled on tablets and mobiles as
Puffin/.*AT$|Puffin/.*IT$
(yes, I know it could be compacted but this is IIS)

[puffinbrowser.com...]

[dstiles]

Should have added, that was for tablets. The mobile one is
Puffin/.*AP$|Puffin/.*IP$

[lucy24]

You can imagine my immediate reaction to the medial .* --but if the "IP" or "AP" bit always comes at the very end, then the server isn't exactly being overworked, because it has to go that far anyway. But can't it be compressed to

Puffin/.*[IA]P$

in a single expression? It's hard to imagine any RegEx engine that understands .* and $ but not [grouping brackets].

[keyplyr]

I allow the stand alone *browser* Puffin.

The request Lucy (and later myself) posted is not from the browser Puffin.