Any info about False IE6 detection?

each day I have multiple challenged request with rule triggered of False IE6 detection [Type B]

is there any info about it? why bad request want to disguise itself as ie 6? and what security holes they try to exploit with that?
they are all being sent to URI /

just want to understand the risks as they all just being Challenged and if its not bots they will pass the challenge easily(I cant see if they pass or failed the challenge right?)

These are typically bots/scrapers (or very occasionally internally written scripts which pass a user agent string) but are missing other identifiers which a true IE 6 client would send along with them. I’m not aware of any security holes per se with regards to this rule, but it’s highly unlikely to be a legitimate browser request and so will almost certainly fail a challenge and be prevented from hitting the origin/consuming additional resources.


thanks make sense, does anyone know a real use case for this? if you are bot\scrapper, would be a lot more easier to give a valid chrome\firefox\edge user agent.

anyone else also get daily hits from this fake ie6 bots?
only option that I can think of is “legit” scrapper that uses some old code from github that defaulted to ie6 browser as an example and they never change the default