wilderness
msg:395265 | 5:49 pm on Jun 2, 2006 (gmt 0) |
resurfaced under same name a few hours after I posted Msg#3
[webmasterworld.com...] Don
|
malachite
msg:395266 | 7:47 pm on Jun 2, 2006 (gmt 0) |
Thanks. On the banned list it goes ;)
|
fusion5
msg:395267 | 8:15 pm on Jun 2, 2006 (gmt 0) |
I orig. posted a similar msg. at abt. this, too.
Guess we got hit at pretty much the same time.
I had it coming from 208.66.195.10. It hit robots.txt, then went through all the main pages. -W
|
Pfui
msg:395268 | 12:45 am on Jun 3, 2006 (gmt 0) |
McColo Corporation. Again. Hardly a week goes by that something bad from WHOIS "MCCOLO" tries to slap us around. Like Don, I started blocking by IPs, but they have a ton. What are they, a gigantic server farm like Hurricane Electric? 208.66.195.11 - - [01/Jun/2006:09:36:43 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.11 - - [01/Jun/2006:09:37:05 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:53:38 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:54:00 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:22 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:44 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone" Clever name (if a bit cutesy). And clearly not programmed to know 403 means "Go AWAY."
|
wilderness
msg:395269 | 3:19 am on Jun 3, 2006 (gmt 0) |
Not all that many ;)
Most are confined to the D Class. McColo Corporation HURRICANE-CE1548-0922 (NET-64-62-243-0-1) 64.62.243.0 - 64.62.243.63
McColo Corporation HURRICANE-CE1548-0925 (NET-64-71-133-128-1) 64.71.133.128 - 64.71.133.191
McColo Corporation MCCOLO (NET-208-66-192-0-1) 208.66.192.0 - 208.66.195.255
McColo Corporation HURRICANE-CE1548-0927 (NET-64-62-228-0-1) 64.62.228.0 - 64.62.228.255
McColo Corporation HURRICANE-CE1548-0922 (NET-64-71-159-192-1) 64.71.159.192 - 64.71.159.223
McColo Corporation HURRICANE-CE1548-0924 (NET-64-71-177-0-1) 64.71.177.0 - 64.71.177.127
McColo Corporation HURRICANE-CE1548-0923 (NET-64-71-167-0-1) 64.71.167.0 - 64.71.167.127
McColo Corporation HURRICANE-CE1548-0921 (NET-64-62-198-128-1) 64.62.198.128 - 64.62.198.191
McColo Corporation HURRICANE-CE1548-0926 (NET-65-19-154-0-1) 65.19.154.0 - 65.19.154.127
McColo Corporation HURRICANE-CE1548-0920 (NET-64-62-171-128-1) 64.62.171.128 - 64.62.171.255
|
youfoundjake
msg:395270 | 8:02 am on Jun 3, 2006 (gmt 0) |
They hit every page on my site. Using ip address 208.66.195.8 On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions? Regardless, after the (not)post, i found the library thread about webmasters robots.txt file and promptly added it to my site, with the addition of the fore mentioned bots, but unfortunately, the psycheclone got everything, with a big bold 200 return code for every page.... sigh...
|
wilderness
msg:395271 | 11:39 am on Jun 3, 2006 (gmt 0) |
| On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions? |
|
ALL new threads are moderated and await Dan's approval.
On occassion if there are multiple submissions, he just passes one through (no need for duplication [or more]).
|
youfoundjake
msg:395272 | 7:10 pm on Jun 3, 2006 (gmt 0) |
okie dokie
|
photoace
msg:395273 | 3:02 am on Jun 11, 2006 (gmt 0) |
whois: McColo Corporation
Digital Infinity LTD Deeper search reveals Digtal Infinity headquarters location in Moscow. Draw your own conclusions
|
gford
msg:395274 | 6:13 pm on Jun 13, 2006 (gmt 0) |
How does one ban, in linux/apache a specific crawler/scaper like this? Only way I know is in httpd.conf add deny from. Is there an easier way? I have virtual hosting setup so going into each and every vhost httpd.conf file sounds awful painful.
|
wilderness
msg:395275 | 8:39 pm on Jun 13, 2006 (gmt 0) |
RewriteCond %{REMOTE_ADDR} ^208\.66\.(19[2-5])\. [OR] Here's two links which may assist you: [webmasterworld.com...] [webmasterworld.com...]
continuation of thread:
[webmasterworld.com...]
[webmasterworld.com...] Some tutorials
[baremetal.com...]
[evolt.org...]
[edginet.org...]
[dimi.uniud.it...]
[webhelpinghand.com...]
[javascriptkit.com...]
[serverwatch.com...]
[verio.com...]
|
gmrthree
msg:395276 | 5:37 am on Jun 16, 2006 (gmt 0) |
I got hit by this bot too.
Why ban based on IP?
The host I use says that I can't ban based on IP, so should this work?: <IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^(psycheclone) [NC,OR]
RewriteRule ^.* - [F]
</IfModule>
|
seoshare
msg:395277 | 1:01 pm on Jun 16, 2006 (gmt 0) |
I just happen to see this psycheclone on my server, spidering web pages. Its from a Russian Company, having 15 IP's starting from 1 to 15. Does any one know more about what is all this up to
|
Pfui
msg:395278 | 4:30 am on Jun 25, 2006 (gmt 0) |
McCOLO again, but hitting a different site where I'd not blocked the heck out of its IPs and UAs -- 208.66.195.2
psycheclone
06/24 13:06:47 /robots.txt
06/24 13:07:17 / So much for the 'let them all see robots.txt even if they're Disallowed' theory. Oh, well!
|
incrediBILL
msg:395279 | 6:43 am on Jun 25, 2006 (gmt 0) |
FYI, if you aren't blocking blank user agents, time to do it as this one has mutated. Used to be: 208.66.195.4 "psycheclone" Now is... 208.66.195.4 "" Also, just block the whole range of 208.66.195.0/24 as I've tracked this on about 12 IPs so far in that block.
|
larryhatch
msg:395280 | 11:06 am on Jun 24, 2006 (gmt 0) |
Hello again .htaccess fans. Got another one. User Agent is given simply as "psycheclone". It sucks down most of my .html pages, never any images.
If you Google for psycheclone, you will find lots of us with the same questions. About all that is known is:
It always uses the same set of DNS numbers A.B.C.* where A, B, and C are constant but D varies.
Those numbers trace back to Russia. Lots of guesses out there, everything from email harvesting to you name it, nothing solid. Several webmasters say they banned by DNS A.B.C.* with * a wild-card. I banned them by name for now. Anybody here have a clue what its about? I'm just curious now, gonna pop a beer. -Larry PS: A GOOD beer from Europe. No cheap sh**. It was hot in California today. Maybe more than one.
|
GMax
msg:395281 | 4:36 pm on Jun 28, 2006 (gmt 0) |
Hi everyone,
i'm also being plaged by psycheclone in a very short time i had 43 requests for 38 pages.
A few days ago it requested 51 pages in 1 hour (funny part is, my site only has 7 pages)
unfortunately i don't really understand how to block bots through the use of a htaccess file.
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" i would very grateful. GMax.
|
wilderness
msg:395282 | 6:23 pm on Jun 28, 2006 (gmt 0) |
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" |
|
GMax,
It's customary and beneficial if you both make some kind of effort at creating your own htaccess and then provide what you created seeking help. The reason for your error (500) or denial to all (yourself included) is that you have a syntax error. The Cpanel on your website access should have an option for making some additions to your active htaccess. (My host names it "IP Deny Manager". Here are some helpful web pages This site will create an htaccess based on IP:
[htaccesstools.com...] The simplist tutorials
[edginet.org...]
[webhelpinghand.com...]
[javascriptkit.com...] More complicated explanations
[evolt.org...]
[baremetal.com...]
[dimi.uniud.it...]
|
GMax
msg:395283 | 8:51 pm on Jun 30, 2006 (gmt 0) |
Thank you wilderness,
this will perhaps get me on the right track.
I hope that with the help of the links you gave i will be able to make a working htaccess file. GMax.
|
|
