In the beginning there was NCSA Mosaic, and Mosaic called itself NCSA_Mosaic/2.0 (Windows 3.1), and Mosaic displayed pictures along with text, and there was much rejoicing. And behold, then came a new web browser known as “Mozilla”, being short for “Mosaic Killer,” but Mosaic was not amused, so the public name was changed to Netscape, and Netscape called itself Mozilla/1.0 (Win3.1 , One fine day while researching the User-Agent (UA) string of popular web browsers, I noticed a common pattern among them. Apart from the unique strings that identify the browsers like Chrome/43.0.2357.65, Firefox/40.0, MSIE 9.0, almost all of them had a string called Mozilla/5.0 or sometimes WebKit. What are these strings and why do they appear in the User-Agent? I delved into the history and , Figure 3: Top 10 most common user agents seen on a DShield honeypot The "translated user agent" is much easier to understand. The most popular user agent seen is for Windows 7 using Firefox 22. Windows 7 support ended in January of 2020 and Firefox 22 was released in 2013. This could either be a very old and outdated device, that also may be compromised, or it is a falsified user agent string , Understand what information is contained in a user agent string. Get an analysis of your or any other user agent string. Find lists of user agent strings from browsers, crawlers, spiders, bots, validators and others.., Firefox 3.x and many others do. Can you post the full agent string that you're having problems with? As it sounds like it could be a custom script that is generating the request and pretending to be a certain agent. But is incorrectly creating the ident string. Or your check against the agent string is incorrect. Edit: The strings you posted are being url-encoded the +'s in them should be , Can it be assumed that a browser that indicates Mozilla/5.0 (compatible) is HTML5 capable?.