mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 2.6 req/min Seen on 153 systems 4,321 observed requests 1 exact variants First seen August 3, 2026 Last seen October 19, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0
Observed source IPs
0
Observed requests
4,321
Source networks
1,497
Exact variants
1
Latest hit count
1,225
Latest miss count
14,664
Latest 404 count
0
Unique paths
94
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0 First seen August 3, 2026 · Last seen October 19, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
2.6 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 585 739 46.5%
United Kingdom 98 116 7.5%
Netherlands 55 58 5.8%
Unknown 192 192 4.7%
Germany 43 50 3.7%
Hungary 31 34 2.7%
Australia 60 60 2.6%
Slovakia 12 13 2.2%
Malaysia 19 21 1.9%
Brazil 28 28 1.8%

Top ASNs

ASN Organization Networks Share
AS13335 [[TODO: MAP ASN ORGANIZATION]] 50 11.2%
AS36183 [[TODO: MAP ASN ORGANIZATION]] 104 9.1%
AS54113 [[TODO: MAP ASN ORGANIZATION]] 71 8.9%
AS6167 [[TODO: MAP ASN ORGANIZATION]] 73 4.2%
AS7922 [[TODO: MAP ASN ORGANIZATION]] 24 2.2%
AS2856 [[TODO: MAP ASN ORGANIZATION]] 14 2.1%
AS21928 [[TODO: MAP ASN ORGANIZATION]] 36 1.9%
AS14593 [[TODO: MAP ASN ORGANIZATION]] 35 1.9%
AS7018 [[TODO: MAP ASN ORGANIZATION]] 33 1.8%
AS137409 [[TODO: MAP ASN ORGANIZATION]] 5 1.8%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

GET
/itinerary/amsterdam-spring-itinerary-4-days-of-tulips-canals-keukenhof/
Status pattern: HTTP 200
Seen 1 times, Last seen October 1, 2026
GET
/itinerary/amsterdam-spring-itinerary-4-days-of-tulips-canals-keukenhof/
Status pattern: HTTP 403
Seen 1 times, Last seen October 1, 2026
GET
/itinerary/amsterdam-spring-itinerary-4-days-of-tulips-canals-keukenhof/?utm_source=copilot.com
Status pattern: HTTP 200
Seen 2 times, Last seen October 1, 2026
GET
/video-nadzor/
Status pattern: HTTP 200
Seen 1 times, Last seen September 26, 2026
GET
/apple-touch-icon-precomposed.png
Status pattern: HTTP 404
Seen 98 times, Last seen September 14, 2026
GET
/suende-was-die-bibel-wirklich-meint/
Status pattern: HTTP 200
Seen 1 times, Last seen September 14, 2026
GET
/suende-was-die-bibel-wirklich-meint/?fbclid=IwcGRvZgFmZGlkFlDmQdnBjLm8SZxBzT9UEA5tEgwzIcFleHRuA2FlbQIxMQBzcnRjBmFwcF9pZAo2NjI4NTY4Mzc5AAEeMfv5U5iEHNAF_dN6cW9D5NmfqiTF5dgIq5af5loIwiOxXAsohshqy
Status pattern: HTTP 200
Seen 1 times, Last seen September 14, 2026
POST
/wp-json/bitfire/v1/browser-verify?_fn=xhr&_bfa=1d7c616e45a93e29fc8c3b2c.0kk6yevtnuhx.1789416000&per=0&_bfg=%7B%22fbclid%22%3A%22iwcgrvzgfmzglkfldmqdnbjlm8szxbzt9uea5tegwzicflehrua2flbqixmqbzc
Status pattern: HTTP 200
Seen 1 times, Last seen September 14, 2026
GET
/yardi/
Status pattern: HTTP 200
Seen 2 times, Last seen August 31, 2026
GET
/yardi/
Status pattern: HTTP 403
Seen 2 times, Last seen August 31, 2026
GET
/
Status pattern: HTTP 200
Seen 52 times, Last seen August 30, 2026
GET
/
Status pattern: HTTP 403
Seen 54 times, Last seen August 30, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0

What is mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0 considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0 respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with mozilla/5.0 (macintosh; intel mac os x 10_11_1) applewebkit/601.2.4 (khtml, like gecko) version/9.0.1 safari/601.2.4 facebookexternalhit/1.1 facebot twitterbot/1.0?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]