Unusual IP format: anyone seen it before?
-
Looking at some data stored in an IP Address column, and I found these two entries (with user agents):
- U0120962
Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; Microsoft; Lumia 640 XL LTE) like iPhone OS 7_0_3 Mac OS X AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537
- U0151012
Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; Microsoft; Lumia 640 LTE) like iPhone OS 7_0_3 Mac OS X AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537
Anyone ever seen anything like this before?
- U0120962
-
At first I thought it was just a long-number form, but that is not a correct IP address if so.
No idea...
-
@tsaukpaetra I don't know if it's revelant that the webserver is IIS. Probably not, but just thought I'd mention it anyway.
-
Could it be that an internal reverse proxy fails to put extra information of the original source IP in a header?
-
@jbert I don't think so: these are the only two entries in hundreds of thousands of records. If it is a load balancer or internal reverse proxy issue though, then there's not much I can do about it, because Azure Web Apps don't let you fiddle with that stuff.
-
Maybe it's also revelant that the addresses are
U0120962;10.136.183.64
andU0151012;10.136.183.188
? The actual IP addresses are obviously in the10.0.0.0/24
private IP range.
-
@raceprouk Might be some sort of proxy server id set in a
by
parameter? Or possibly an obscuredfor
. RFC 7239 §5.1 §5.2 §6.3
-
@dkf Could be. I've seen a few entries for
unknown
as well, which seems to be a similar thing.
-
@raceprouk Ah yes,
unknown
is definitely one of the options. (The RFC explicitly mentioned it, or maybe it was one of the other resources I looked up whilewaiting for my tests to runlooking this up.)
-
@raceprouk said in Unusual IP format: anyone seen it before?:
Looking at some data stored in an IP Address column, and I found these two entries (with user agents):
- U0120962
Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; Microsoft; Lumia 640 XL LTE) like iPhone OS 7_0_3 Mac OS X AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537 - U0151012
Mozilla/5.0 (Mobile; Windows Phone 8.1; Android 4.0; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; Microsoft; Lumia 640 LTE) like iPhone OS 7_0_3 Mac OS X AppleWebKit/537 (KHTML, like Gecko) Mobile Safari/537
Anyone ever seen anything like this before?
Obviously, these are request made by you. Nobody else bought Windows phone
- U0120962
-
@timebandit said in Unusual IP format: anyone seen it before?:
Windows phone
FUcking user agents. I saw mobile Safari and assumed they were iOS
-
@jaloopa said in Unusual IP format: anyone seen it before?:
FUcking user agents. I saw mobile Safari and assumed they were iOS
I saw “
like
” and assumed it was Facebook…
-
@timebandit Can't have been me: I've never had a Lumia 640 (I had a 920 before my current 950).
-
@jaloopa said in Unusual IP format: anyone seen it before?:
FUcking user agents. I saw mobile Safari and assumed they were iOS
It's even worse:
- Mozilla/5.0, Trident/7.0, IEMobile/11.0, AppleWebKit/537, KHTML, like Gecko, Mobile Safari/537
Which one is it ??
- Windows Phone 8.1, Android 4.0, iPhone OS, Mac OS X
-
@dkf I don't understand why they still haven't officially deprecated them.
-
@anonymous234 /me officially deprecates Facebook
-
It's almost as if whoever is accessing it is intentionally trying to be as obscure as possible.
-
@the_quiet_one Or they're putting in everything because of sites that do useragent sniffing in order to present a 3px wider version to some browsers but not others.
-
@hungrier said in Unusual IP format: anyone seen it before?:
@the_quiet_one Or they're putting in everything because of sites that do useragent sniffing in order to present a 3px wider version to some browsers but not others.