4 - - [09/Apr/2016:11:51:35 -0400] "GET /22327 HTTP/1.1" 200 3516 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0#19d5fd" - - [09/Apr/2016:13:58:10 -0400] "GET /17405 HTTP/1.1" 200 3529 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0#f74648" - - [09/Apr/2016:14:38:37 -0400] "GET /1202 HTTP/1.0" 200 21264 "http://example.com/12" "Mozilla/5.0 (Windows NT 6.1; rv:40.0) Gecko/20100101 Firefox/40.0" - - [09/Apr/2016:16:35:11 -0400] "GET /22327 HTTP/1.1" 200 3496 "-" "Mozilla/5.0 (X11; CrOS x86_64 7647.84.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36#28969c" - - [09/Apr/2016:16:50:27 -0400] "GET /22327 HTTP/1.1" 200 5399 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0#4881b0" - - [09/Apr/2016:17:23:43 -0400] "GET /3234 HTTP/1.1" 200 3517 "-" "Mozilla/5.0 (Windows NT 6.1; rv:44.0) Gecko/20100101 Firefox/44.0#932961" - - [09/Apr/2016:17:24:10 -0400] "GET /23455 HTTP/1.1" 200 5581 "-" "Mozilla/5.0 (Windows NT 6.1; rv:44.0) Gecko/20100101 Firefox/44.0#932961" - - [09/Apr/2016:17:26:18 -0400] "GET /1234 HTTP/1.1" 200 3990 "-" "Mozilla/5.0 (Windows NT 6.1; rv:42.0) Gecko/20100101 Firefox/42.0#5ee589" - - [09/Apr/2016:19:56:27 -0400] "GET /11145 HTTP/1.1" 200 5580 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0#9744b4"

I am recently noticing some weird user agents especially Firefox related:


As far as I know Firefox officially does not have hashed versions. So what might be the reason for these kind of user agents? Are these requests to be regarded as being from malicious users?

  • Those would seem to be "hashes" (#), not "dashes" ().
    – MrWhite
    Apr 10 '16 at 16:29
  • 1
    I only checked the first IP address. It is not a subscriber IP, but a hosting IP. You will likely see that they are a bot and that some of these other IP addresses may be bots too.
    – closetnoc
    Apr 10 '16 at 16:30
  • @closetnoc, getting lots of invalid clicks for Adsense by them. So blocked them with mod_write by checking user agent. You many want to add it as an answer and I will accept it.
    – NecNecco
    Apr 11 '16 at 5:11
  • @w3dk, thanks for the edit. totally sleep issue :)
    – NecNecco
    Apr 11 '16 at 5:12
  • 1
    Blocking by user agent is probably fine in this case. However, I never recommend using the user agent for security with a few exceptions. The reason is that the user agent is unreliable. It can and often does change, however, the IP address blocks do not.
    – closetnoc
    Apr 11 '16 at 13:03

I have noticed this on occasion as well. Can't place my hands on the information I had at the time but from what I was able to find it appears to be something like a build number of release candidate number which has been appended on the end of the browser version. From what I have been able to find this is not a danger and is simply a relic from development that does not seem to have been removed. I still see this on a number of sites I work on and nothing suspicious comes from these user agents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.