If it come from Hetzner, try to get the reverse hostname of the IP address and I think it's likely to be trendiction.de.
Our experience with this User Agent is that it's mostly used by the Trendiction robot. They sign most of the requests with their legit User Agent but they do also use fake browser identities, mostly old versions of Firefox.
Sometime the activity can also come from the AWS us-east-1 region but it's likely the same company behind it.
[edited by: keyplyr at 8:16 pm (utc) on Sep 10, 2017]
[edited by: znarfor at 8:22 pm (utc) on Sep 10, 2017]
keyplyr
8:14 pm on Sep 10, 2017 (gmt 0)
Yes znarfor I am well aware of that.
I think you may be misunderstanding the purpose of the User Agents forum
This forum is not here to indict but to document.
Also, please stop posting active links to these companies. We are not a traffic source for them.
znarfor
8:21 pm on Sep 10, 2017 (gmt 0)
Sorry, I was just trying to give you some input on what was behind this particular combination of User Agent and IP Address, in that case likely the Trendiction robot.
If that input was not useful, can you give me some highlight on the purpose of documenting User Agents? Given your answer, I might be effectively misunderstanding something.
lucy24
10:49 pm on Sep 10, 2017 (gmt 0)
the purpose of documenting User Agents?
Information. 95% of the time, it comes down to “this thing exists”. The other 5% involves “Yes, but what do they do?”
znarfor
7:43 am on Sep 11, 2017 (gmt 0)
Sorry, I was just trying to share useful insight on this agent hoping this would be interesting. Looks like it was not. In future posts, I'll try to stick to "documenting".
