Ban User Agent

Posted: Mon Oct 29, 2007 4:40 pm

I had in my logs an entry with only "User-Agent" this was an IP listed in a spam data base.
So I decided to ban the "User-Agent" via htaccess.
Do I ban normal visitors ?
Later on I found entries in my logfiles like this from different IPs:

"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Posted: Mon Oct 29, 2007 6:17 pm

Well a User-Agent with "User-Agent" in it is definitely suspicious. Usually its badly-written software that tries to hide itself by rewriting the User-Agent. No harm blocking it.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
I think that's probably a real browser, though can't say it hasn't been spoofed.

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
is probably faked though.

Posted: Wed Oct 31, 2007 7:26 am

Think you wouldn´t believe what stranges names of user agents I have in tracked user agents the last today was "cHAINsAW massacre" Smile

Happy Halloween !
I let my entry in the .htaccess because just "User-Agent" is suspect and I couldn´t find out more about.