mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36

[[TODO: MAP ONE SENTENCE SUMMARY]]

Category: [[TODO: MAP CATEGORY]] Avg 4.5 req/min Seen on 129 systems 6,584 observed requests 2 exact variants First seen August 3, 2026 Last seen October 19, 2026

[[TODO: MAP INTRODUCTION PARAGRAPH 1]]

[[TODO: MAP INTRODUCTION PARAGRAPH 2]]

What is mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36?

[[TODO: MAP DEFINITION SUMMARY]]

[[TODO: MAP SHORT REFERENCE SUMMARY]]

Analyst summary: [[TODO: MAP ANALYST REPORT SUMMARY]]
User-agent
mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36
Observed source IPs
0
Observed requests
6,584
Source networks
618
Exact variants
2
Latest hit count
7,092
Latest miss count
19,645
Latest 404 count
0
Unique paths
133
Related campaigns
[[TODO: MAP RELATED CAMPAIGN COUNT]]

Observed exact user-agent strings

mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36 First seen August 3, 2026 · Last seen October 19, 2026
mozlila linux android bulid applewebkit khtml like gecko version chrome moblie safari First seen August 11, 2026 · Last seen September 30, 2026

Behavior profile

[[TODO: MAP BEHAVIOR PROFILE INTRO]]

Category
[[TODO: MAP CATEGORY]]
Average request rate
4.5 requests per minute
HTTP and HTTPS support
[[TODO: MAP HTTP HTTPS SUPPORT]]
HTTP version support
[[TODO: MAP PROTOCOL SUPPORT SUMMARY]]
Redirect behavior
[[TODO: MAP REDIRECT BEHAVIOR]]
Robots.txt behavior
[[TODO: MAP ROBOTS TXT BEHAVIOR]]
Crawl-rate behavior
[[TODO: MAP CRAWL RATE BEHAVIOR]]
JavaScript execution
[[TODO: MAP JAVASCRIPT SUPPORT]]
Form submission activity
[[TODO: MAP FORM SUBMISSION ACTIVITY]]
Malformed URL requests
[[TODO: MAP MALFORMED URL BEHAVIOR]]
HTTP/1.0: [[TODO: MAP HTTP 1.0 SUPPORT]] HTTP/1.1: [[TODO: MAP HTTP 1.1 SUPPORT]] HTTP/2: [[TODO: MAP HTTP 2 SUPPORT]] HTTP/3: [[TODO: MAP HTTP 3 SUPPORT]] [[TODO: MAP HEADER ORDER FINGERPRINTED]]

Source distribution

[[TODO: MAP SOURCE DISTRIBUTION INTRO]]

Top countries

Country Networks Site sightings Share
United States 245 720 32.2%
Netherlands 89 495 29.8%
Pakistan 26 156 11.7%
Germany 44 175 6.4%
Iran 4 71 5.6%
United Kingdom 25 99 4.1%
Poland 11 73 2.0%
France 15 46 2.0%
Unknown 75 79 1.9%
Cyprus 4 21 0.8%

Top ASNs

ASN Organization Networks Share
AS8075 [[TODO: MAP ASN ORGANIZATION]] 75 17.4%
AS210558 [[TODO: MAP ASN ORGANIZATION]] 39 14.0%
AS401626 [[TODO: MAP ASN ORGANIZATION]] 10 13.9%
AS205759 [[TODO: MAP ASN ORGANIZATION]] 14 10.5%
AS215930 [[TODO: MAP ASN ORGANIZATION]] 4 5.6%
AS212238 [[TODO: MAP ASN ORGANIZATION]] 26 3.7%
AS14061 [[TODO: MAP ASN ORGANIZATION]] 101 3.5%
AS62633 [[TODO: MAP ASN ORGANIZATION]] 7 3.3%
AS8560 [[TODO: MAP ASN ORGANIZATION]] 19 2.5%
AS49981 [[TODO: MAP ASN ORGANIZATION]] 7 2.1%

Top datacenters

Provider Type Snapshots Share

Representative source IPs

[[TODO: MAP REPRESENTATIVE IPS INTRO]]

HTTP fingerprint and request characteristics

[[TODO: MAP HTTP FINGERPRINT INTRO]]

Observed header order
[[TODO: MAP HTTP HEADER ORDER SUMMARY]]
Common headers sent
[[TODO: MAP COMMON HEADERS SUMMARY]]
TLS and HTTPS behavior
[[TODO: MAP TLS HTTPS SUMMARY]]
URL normalization behavior
[[TODO: MAP URL NORMALIZATION SUMMARY]]
Malformed request patterns
[[TODO: MAP MALFORMED REQUEST SUMMARY]]
[[TODO: MAP OBSERVED HTTP HEADERS]]

Observed sample requests

[[TODO: MAP SAMPLE REQUESTS INTRO]]

GET
/wp-includes/core.php
Status pattern: HTTP 403
Seen 3 times, Last seen October 12, 2026
GET
/wp-admin/about.php
Status pattern: HTTP 403
Seen 1 times, Last seen September 13, 2026
GET
/images/images/cache.php
Status pattern: HTTP 403
Seen 60 times, Last seen September 6, 2026
GET
/cache/cache/cache.php
Status pattern: HTTP 403
Seen 9 times, Last seen September 5, 2026
GET
/blogs/media/media/cache.php
Status pattern: HTTP 403
Seen 9 times, Last seen September 5, 2026
GET
/assets/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026
GET
/wp-content/plugins/plugins/cache.php
Status pattern: HTTP 200
Seen 5 times, Last seen September 5, 2026
GET
/images/images/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026
GET
/images/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026
GET
/images/images/images/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026
GET
/images/images/images/images/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026
GET
/images/images/images/images/images/images/images/cache.php
Status pattern: HTTP 403
Seen 8 times, Last seen September 5, 2026

Related campaigns and associations

[[TODO: MAP RELATED CAMPAIGNS INTRO]]

[[TODO: MAP RELATED CAMPAIGN NAME]]

[[TODO: MAP RELATED CAMPAIGN SUMMARY]]
Related IPs: [[TODO: MAP RELATED CAMPAIGN IP COUNT]], Systems seen: [[TODO: MAP RELATED CAMPAIGN SYSTEMS SEEN]]
Confidence: [[TODO: MAP RELATED CAMPAIGN CONFIDENCE]]

Detailed analyst report

[[TODO: MAP ANALYST REPORT PARAGRAPH 1]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 2]]

[[TODO: MAP ANALYST REPORT PARAGRAPH 3]]

Frequently asked questions about mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36

What is mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36?

[[TODO: MAP FAQ WHAT IS ANSWER]]

Is mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36 considered malicious?

[[TODO: MAP FAQ MALICIOUS ANSWER]]

Does mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36 respect robots.txt and crawl-rate controls?

[[TODO: MAP FAQ ROBOTS ANSWER]]

What infrastructure is commonly associated with mozlila/5.0 (linux; android 7.0; sm-g892a bulid/nrd90m; wv) applewebkit/537.36 (khtml, like gecko) version/4.0 chrome/60.0.3112.107 moblie safari/537.36?

[[TODO: MAP FAQ INFRASTRUCTURE ANSWER]]