homepage Welcome to WebmasterWorld Guest from 54.242.231.109
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Visit PubCon.com
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
Psycheclone
Anyone heard of this one?
malachite




msg:395264
 11:58 am on Jun 2, 2006 (gmt 0)

Just had "Psycheclone" turn up this morning. Anyone ever heard of it? I haven't, never seen it before, and a search on Google returned absolutely nothing.

It visited robot.txt, then went through the whole site like a dose of salts.

The IP was 208.66.195.3, some US corporation.

Good/bad/indifferent? Should I ban it?

 

wilderness




msg:395265
 5:49 pm on Jun 2, 2006 (gmt 0)

resurfaced under same name a few hours after I posted Msg#3
[webmasterworld.com...]

Don

malachite




msg:395266
 7:47 pm on Jun 2, 2006 (gmt 0)

Thanks. On the banned list it goes ;)

fusion5




msg:395267
 8:15 pm on Jun 2, 2006 (gmt 0)

I orig. posted a similar msg. at abt. this, too.
Guess we got hit at pretty much the same time.
I had it coming from 208.66.195.10. It hit robots.txt, then went through all the main pages.

-W

Pfui




msg:395268
 12:45 am on Jun 3, 2006 (gmt 0)

McColo Corporation. Again. Hardly a week goes by that something bad from WHOIS "MCCOLO" tries to slap us around. Like Don, I started blocking by IPs, but they have a ton. What are they, a gigantic server farm like Hurricane Electric?

208.66.195.11 - - [01/Jun/2006:09:36:43 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.11 - - [01/Jun/2006:09:37:05 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:53:38 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:54:00 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:22 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:44 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"

Clever name (if a bit cutesy). And clearly not programmed to know 403 means "Go AWAY."

wilderness




msg:395269
 3:19 am on Jun 3, 2006 (gmt 0)

but they have a ton

Not all that many ;)
Most are confined to the D Class.

McColo Corporation HURRICANE-CE1548-0922 (NET-64-62-243-0-1) 64.62.243.0 - 64.62.243.63
McColo Corporation HURRICANE-CE1548-0925 (NET-64-71-133-128-1) 64.71.133.128 - 64.71.133.191
McColo Corporation MCCOLO (NET-208-66-192-0-1) 208.66.192.0 - 208.66.195.255
McColo Corporation HURRICANE-CE1548-0927 (NET-64-62-228-0-1) 64.62.228.0 - 64.62.228.255
McColo Corporation HURRICANE-CE1548-0922 (NET-64-71-159-192-1) 64.71.159.192 - 64.71.159.223
McColo Corporation HURRICANE-CE1548-0924 (NET-64-71-177-0-1) 64.71.177.0 - 64.71.177.127
McColo Corporation HURRICANE-CE1548-0923 (NET-64-71-167-0-1) 64.71.167.0 - 64.71.167.127
McColo Corporation HURRICANE-CE1548-0921 (NET-64-62-198-128-1) 64.62.198.128 - 64.62.198.191
McColo Corporation HURRICANE-CE1548-0926 (NET-65-19-154-0-1) 65.19.154.0 - 65.19.154.127
McColo Corporation HURRICANE-CE1548-0920 (NET-64-62-171-128-1) 64.62.171.128 - 64.62.171.255

youfoundjake




msg:395270
 8:02 am on Jun 3, 2006 (gmt 0)

They hit every page on my site. Using ip address 208.66.195.8

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

Regardless, after the (not)post, i found the library thread about webmasters robots.txt file and promptly added it to my site, with the addition of the fore mentioned bots, but unfortunately, the psycheclone got everything, with a big bold 200 return code for every page.... sigh...

wilderness




msg:395271
 11:39 am on Jun 3, 2006 (gmt 0)

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

ALL new threads are moderated and await Dan's approval.
On occassion if there are multiple submissions, he just passes one through (no need for duplication [or more]).

youfoundjake




msg:395272
 7:10 pm on Jun 3, 2006 (gmt 0)

okie dokie

photoace




msg:395273
 3:02 am on Jun 11, 2006 (gmt 0)

whois: McColo Corporation
Digital Infinity LTD

Deeper search reveals Digtal Infinity headquarters location in Moscow.

Draw your own conclusions

gford




msg:395274
 6:13 pm on Jun 13, 2006 (gmt 0)

How does one ban, in linux/apache a specific crawler/scaper like this?

Only way I know is in httpd.conf add deny from. Is there an easier way? I have virtual hosting setup so going into each and every vhost httpd.conf file sounds awful painful.

wilderness




msg:395275
 8:39 pm on Jun 13, 2006 (gmt 0)

RewriteCond %{REMOTE_ADDR} ^208\.66\.(19[2-5])\. [OR]

Here's two links which may assist you:

[webmasterworld.com...]

[webmasterworld.com...]
continuation of thread:
[webmasterworld.com...]
[webmasterworld.com...]

Some tutorials
[baremetal.com...]
[evolt.org...]
[edginet.org...]
[dimi.uniud.it...]
[webhelpinghand.com...]
[javascriptkit.com...]
[serverwatch.com...]
[verio.com...]

gmrthree




msg:395276
 5:37 am on Jun 16, 2006 (gmt 0)

I got hit by this bot too.
Why ban based on IP?
The host I use says that I can't ban based on IP, so should this work?:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^(psycheclone) [NC,OR]
RewriteRule ^.* - [F]
</IfModule>

seoshare




msg:395277
 1:01 pm on Jun 16, 2006 (gmt 0)

I just happen to see this psycheclone on my server, spidering web pages. Its from a Russian Company, having 15 IP's starting from 1 to 15.

Does any one know more about what is all this up to

Pfui




msg:395278
 4:30 am on Jun 25, 2006 (gmt 0)

McCOLO again, but hitting a different site where I'd not blocked the heck out of its IPs and UAs --

208.66.195.2
psycheclone
06/24 13:06:47 /robots.txt
06/24 13:07:17 /

So much for the 'let them all see robots.txt even if they're Disallowed' theory. Oh, well!

incrediBILL




msg:395279
 6:43 am on Jun 25, 2006 (gmt 0)

FYI, if you aren't blocking blank user agents, time to do it as this one has mutated.

Used to be:

208.66.195.4 "psycheclone"

Now is...

208.66.195.4 ""

Also, just block the whole range of 208.66.195.0/24 as I've tracked this on about 12 IPs so far in that block.

larryhatch




msg:395280
 11:06 am on Jun 24, 2006 (gmt 0)

Hello again .htaccess fans. Got another one. User Agent is given simply as "psycheclone".

It sucks down most of my .html pages, never any images.
If you Google for psycheclone, you will find lots of us with the same questions.

About all that is known is:
It always uses the same set of DNS numbers A.B.C.* where A, B, and C are constant but D varies.
Those numbers trace back to Russia.

Lots of guesses out there, everything from email harvesting to you name it, nothing solid.

Several webmasters say they banned by DNS A.B.C.* with * a wild-card. I banned them by name for now.

Anybody here have a clue what its about? I'm just curious now, gonna pop a beer. -Larry

PS: A GOOD beer from Europe. No cheap sh**. It was hot in California today. Maybe more than one.

GMax




msg:395281
 4:36 pm on Jun 28, 2006 (gmt 0)

Hi everyone,
i'm also being plaged by psycheclone in a very short time i had 43 requests for 38 pages.
A few days ago it requested 51 pages in 1 hour (funny part is, my site only has 7 pages)
unfortunately i don't really understand how to block bots through the use of a htaccess file.
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" i would very grateful.

GMax.

wilderness




msg:395282
 6:23 pm on Jun 28, 2006 (gmt 0)

I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots""

GMax,
It's customary and beneficial if you both make some kind of effort at creating your own htaccess and then provide what you created seeking help.

The reason for your error (500) or denial to all (yourself included) is that you have a syntax error.

The Cpanel on your website access should have an option for making some additions to your active htaccess. (My host names it "IP Deny Manager".

Here are some helpful web pages

This site will create an htaccess based on IP:
[htaccesstools.com...]

The simplist tutorials
[edginet.org...]
[webhelpinghand.com...]
[javascriptkit.com...]

More complicated explanations
[evolt.org...]
[baremetal.com...]
[dimi.uniud.it...]

GMax




msg:395283
 8:51 pm on Jun 30, 2006 (gmt 0)

Thank you wilderness,
this will perhaps get me on the right track.
I hope that with the help of the links you gave i will be able to make a working htaccess file.

GMax.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved