Weird entry's in log...should I ban IP? What does it mean?

Discussion in 'Traffic Analysis' started by jaeysson, Dec 8, 2006.

0
  1. #1
    I am not familiar with these entries. Does anyone know what they are and whether I should ban the IP or not? The website is regular HTML and there is no WML on the domain. The names of the phones are different as well which makes me suspicious. Also the site is getting hit multiple times throughout the day. Any ideas? Thanks

    203.23.236.98 - - [07/Dec/2006:07:57:10 -0500] "GET / HTTP/1.1" 200 12038 www.buy-chess-set.com "-" "Nokia6030/2.0 (5.11) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6030/2.0 (5.11) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:07:58:41 -0500] "GET / HTTP/1.1" 200 12023 www.buy-chess-set.com "-" "SAMSUNG-SGH-E360/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 SAMSUNG-SGH-E360/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:00:53 -0500] "GET / HTTP/1.1" 200 12023 www.buy-chess-set.com "-" "Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:01:17 -0500] "GET /free-chess-games.html HTTP/1.1" 200 7447 www.buy-chess-set.com "-" "Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:02:20 -0500] "GET / HTTP/1.1" 200 12002 www.buy-chess-set.com "-" "Nokia6060/2.0 (4.10) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6060/2.0 (4.10) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:02:48 -0500] "GET /free-chess-games.html HTTP/1.1" 200 7433 www.buy-chess-set.com "-" "Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6070/2.0 (03.20) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:05:09 -0500] "GET / HTTP/1.1" 200 12002 www.buy-chess-set.com "-" "Nokia6230/2.0 (05.35) Profile/MIDP-2.0 Configuration/CLDC-1.1 Nokia6230/2.0 (05.35) Profile/MIDP-2.0 Configuration/CLDC-1.1 VIA SPRACI WAP TRANSLATOR" "-"

    203.23.236.98 - - [07/Dec/2006:08:09:29 -0500] "GET / HTTP/1.1" 200 12016 www.buy-chess-set.com "-" "Nokia6610/1.0 (5.52) Profile/MIDP-1.0 Configuration/CLDC-1.0 Nokia6610/1.0 (5.52) Profile/MIDP-1.0 Configuration/CLDC-1.0 VIA SPRACI WAP TRANSLATOR" "-"
     
    jaeysson, Dec 8, 2006 IP
  2. hans

    hans Well-Known Member

    Messages:
    2,923
    Likes Received:
    126
    Best Answers:
    1
    Trophy Points:
    173
    #2
    these entries are from surfers using WAP/smartphones to surf the web
    like
    Nokia6030
    SAMSUNG-SGH-E360
    Nokia6070
    Nokia6060
    Nokia6230
    Nokia6610

    these above are the smartphone brands+models
    most smartphones have browsers capable of surfing regular validated html4.01 and xhtml1.x pages like "big" browsers do.
    be happy and make sure you have w3.org validated pages on your site - since these browsers are tiny compared to ffx and others - their built-in error workarounds are nil and hence ONLY clean validated pages display properly and are of any use

    meanwhile i have a regular substantial share of mobile devices visiting my site - i started to offer WAP suitable content some 3-4 yrs ago.
     
    hans, Dec 9, 2006 IP
    jaeysson likes this.
  3. jaeysson

    jaeysson Peon

    Messages:
    2
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Thanks for the reply Hans.

    But why are they all coming from the same IP address? Is it because it is coming from the same website? And why is the time separation between each entry so short? My concern is that there is something weird going on...I just want to make sure there isn't.

    All my pages are W3C validated and XHTML transitional. I haven't really looked into providing WAP content. Any suggestions on where to start?
     
    jaeysson, Dec 9, 2006 IP
  4. hans

    hans Well-Known Member

    Messages:
    2,923
    Likes Received:
    126
    Best Answers:
    1
    Trophy Points:
    173
    #4
    smartphones and similar devices are coming thru a cellphone provider/cellphone network
    companies like Vodafone, Orange or so

    hence usually these are huge companies that have a large IP block for their cellphone customers to go www surfing

    these smartphone/PDA/WAP survers are NOT coming from websites but most of these IPs are from their cell-phone-companies
    catch one of these smartphones and play for a while to get acquainted with modern mobile devices and see how they see your site

    some PDA may come from / thru regular wifi hotspots
    all your mentioned devices look all like regular smartphones

    WAP content is old - stone age old - and no longer needed

    NOW all modern mobile devices are fully html4.01 and xhtml1.x capable
    hence any clean page is displayed in reduced size correctly and proportinally
     
    hans, Dec 9, 2006 IP