Oct 17, 2006

mozilla/4.0 (compatible; msie 6.0; windows nt)

mozilla/4.0 (compatible; msie 6.0; windows nt) ::elnsb50::000061100320025802a00111000000000507000900000000
83.167.112.156

mozilla/4.0 (compatible; msie 6.0; windows nt) ::elnsb50::000061100320025802a00111000000000507000900000000
66.110.119.170 gauntlet.angolatelecom.com

mozilla/4.0 (compatible; msie 6.0; windows nt) ::elnsb50::000061100320025802a00111000000000507000900000000
219.153.13.45


Agent: mozilla/4.0 (compatible; msie 6.0; windows nt) ::elnsb50::000061100320025802a00111000000000507000900000000
83.167.112.156

mozilla/4.0 (compatible; msie 6.0; windows nt) ::elnsb50::000061100320025802a00111000000000507000900000000
201.21.208.95 C915D05F.poa.virtua.com.br

The above bot came in claiming to be Windows NT. Windows says no such useragent was ever built. When they were blocked they tried again using several other IPS thinking it was a ip ban.

gauntlet.angolatelecom.com is a open proxy.
virtua.com.br is identified with guestbook spamming

1 comment:

Anonymous said...

This useragent is for Earthlink IE users; however, in my experience it is almost certainly used by non-human processes more often than human ones. For instance, it appears in 10 consecutive entries in my logs, but each entry comes from a *completely* different IP address yet it is simply reloading the same page over and over.