"Moblie" ?

New "Mozlila" typo in UA from MSFT in Redmond

[Martin Potter]

Today from IP 20.109.91.153 (MSFT, Redmond), this UA :

Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

He was looking for /wp-content/plugins/seoplugins/mar.php and similar files that don't exist on my site. Guess they never proof-read their own stuff.

[Martin Potter]

Ooops! Just remembered that this typo was part of the original instance. False Alarm. Sorry.

[not2easy]

That's the one I call "Bulid", it is full of typos so it is easy to block their UA no matter the IP. Mozlila...

[lucy24]

Ah, good ol’ MOZLILA. And “Bulid” continues to sound like a medical condition that really should be looked at.

At least they had the foresight to put one of the three typos at the very front of their UA string, allowing the server to process the request a nanosecond faster ;)

[tangor]

Makes it easier --- and ip addressing is not required!

Sadly, our comments here might----eventually----alert the bad actors and we will have to find a different method.

[lucy24]

The kind of botrunner who puts three separate typos in their UA string doesn't seem like the kind of botrunner who pays close attention to how their brainchild is received.

:: detour to archived logs ::

I find “Mozlila” going back to May 2019. And, while looking it up in order to update “Malign Robots” section of At Home with the Robots directory, I find that most occurrences of this user-agent come with the referer

www.google.com

[sic] and-that’s-all.