Konqueror

[keyplyr]

UA: Konqueror/3.0-rc4; (Konqueror/3.0-rc4; i686 Linux;;datecode)
Protocol: HTTP/1.1
Robots.txt: No
Host: AWS
52.0.0.0 - 52.31.255.255
52.0.0.0/11

File manager, can be used from server to run vertical requests.
konqueror.org

[lucy24]

Linux;;datecode

Wasn't it Wilderness who used to have a Block list made up entirely of questionable punctuation and/or spacing?

[keyplyr]

I'm sure of it.

In fact, that's my answer for anything that begins "Wasn't it Wilderness who ..."

[graeme_p]

How does the UA string differ from real Konqueror (apart from the ancient version number), especially given that Konqueror allows users to select what goes in the UA string (e.g. whether to show OS or not).

[keyplyr]

"real Konqueror" ?

Well there are potentially many Konqueror UA strings that could be found in your site logs, including command line HTTP requests, or FTP connections using links from the file manager on a personal computer or from a web server.

I don't personally keep track of them, I'm just documenting the UAs I find in various site logs.

If you've seen other Konqueror UAs, please post them graeme_p.

[graeme_p]

BY real, I mean legitimiate. I assume the one posted here is a bot'

[lucy24]

BY real, I mean legitimate. I assume the one posted here is a bot'

The words “legitimate” and “bot” aren't mutually exclusive. Did you mean “human”?

:: log search ::

Um. I thought there was a legitimate human browser called Konqueror, but I can't find it. Searching for favicon requests from “Konqueror” turns up nothing. Searching for css requests from “Konqueror” leads to

Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)

--a UA I had previously been unaware of, since Exabot (French search engine) is on my Ignore list. Fancy that.

Even a search of older logs, going back to 2011, doesn't turn up anything human.

[phranque]

Konqueror is (among other things) KDE's KHTML (or WebKit) web browser.
i used it for cross-browser testing a while ago.

[graeme_p]

In fact Konqueror is quite a nice, if not much used, browser, and webkit is a fork of KHTML which is Konqueror's rendering engine (although current versions of Konqueror can use either).

As Konqueror is a human browser, any bot claiming to be Konqueror is unlikely to be legitimate/real (unless someone is doing something weird like scripting Konqueror to act as a bot).

[keyplyr]

graeme_p - don't think anyone said the UA in the OP is a bot and not a browser.

[graeme_p]

I thought they did - for one thing it is coming from AWS. It could be someone remotely accessing desktop software on AWS, of course, but they are unlikely to use such an old version (Konq 3 is many years old). Possibly a human using a fake UA.

[keyplyr]

The Konqueror browser powered by the KHTML rendering engine is part of the Konqueror File manager suite for KDE with Webkit, although it can be installed separately.

I have seen this UA run from servers several times before. I'm assuming the user is accessing a list of web addresses (sites) from the file manager using the browser.

The definition of a browser really needs to include a wide variety of HTTP tasks and not just selective to a human surfing webpages.

As noted in the OP, this tool can also access via FTP.

I included the homepage URL in the OP.

Of course UAs are often faked, usually a bot is faking a human. No way to tell until adequate research is done, often over a period of time.

This is why I document the What and How. The Who and Why are often ambiguous.

[graeme_p]

I have seen this UA run from servers several times before. I'm assuming the user is accessing a list of web addresses (sites) from the file manager using the browser.

Are you saying that in some way explains why it comes from a server?

The particular Konqueror UA posted here is suspicious at the least. Konqueror 3.0, RC4? I do not know the release dates, but I found a review of Konqueror 4.4 dates 2010 which means 3.0 must be about a decade old.

Konqueror can do a LOT of things - ftp, sftp, SMB shares.... It can also transparently browse archives, and it is a document viewer.

As a web browser it can use either webkit or KHTML. You get some extra features with KHTML (I forget what). I think version 3 is too old to use Webkit though.

[keyplyr]

Yes graeme_p. As stated in the OP (and in the Konqueror documentation) this suite of tools, including the Konqueror browser, can be run from a server.

[graeme_p]

Can you point me to where the Konqueror documentation says it can be run from a server? I am curious as to how it can be done without installing a full GUI environment on a server.

[keyplyr]

No, all I'd be doing is web searches the same as you can do, but all indication points to a Linux server, maybe Debian.

[graeme_p]

@keypleyr, sorry I seem to have misinterpreted your previous comment which suggested you had seen mention of running Konq on a server.

I think it unlikely that someone is
1) using Konqueror on a server, as it would require a lot of libraries (a large chunk of KDE) that would be of little use on a server, and,
2) doing all that but using a very old version of Konqueror.

I would think it more likely

1) They are using KHTML to let a bot to render pages (like phantomjs) and it either defaults to Konqueror of they are using it as the best match, or,
2) it is just a fake UA
3) it is a proxy, possibly an anonymising proxy that is changing the UA.