GuzzleHttp/7

[not2easy]

Entire UA: GuzzleHttp/7 from 174.108.115.xxx (Charter Communications Inc)
Not much of a Guzzler - one page.

Last seen around here (afaik) in an earlier version in 2016: [webmasterworld.com...]

[lucy24]

:: obligatory detour to raw logs ::

Oh, willya look at that. Within calendar year 2024 on my primary site:

122 requests, of which
-- 119 blocked (including at least one for a nonexistent page) due to various header deficits, often including bad_range
-- 3 for favicon (not blocked)
-- 2 HEAD
-- 0 for robots.txt

Most of those were from 3.87.245.abc or 54.90.215.abc, aka The Usual Suspects.

Oh, and three for

/wp-content/plugins/shortcode-tumblr-gallery/includes/lib/Guzzle/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

which caused me some grief trying to figure out how 119 + 3 = 125 ;) Each of them was part of what looks like a /wp/ testing-for-vulnerabilities exercise (widely separated dates, each from a different IP with a long list of requests).

[SumGuy]

In May 2021 I had a tag-team hit from

Drupal/8.9.15 (+https://www.drupal.org/) GuzzleHttp/6.5.5 curl/7.29.0 PHP/7.3.28

First hit from 109.207.130.241 grabbed my landing page, then a couple minutes later 185.102.50.78 asked for license.txt (which I don't have).

Later in November 2021 I had a single hit (185.100.72.19) from

GuzzleHttp/7

These hit so far came from Romanian IP's. Four times spread out in the second half of 2022 I had more hits from GuzzleHttp/7, they all came from the same IP (195.15.219.224). Switzerland? I've had no other sightings of any UA containing guzzle. Regarding Drupal -

Nothing in 2022 or 2023, but about 10 times this year, the most recent on October 3, I had hits from:

Custom-AsyncHttpClient

Always asking for:

/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

Different IP each time, mostly asian.