homepage Welcome to WebmasterWorld Guest from 54.227.141.230
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Subscribe to WebmasterWorld
Visit PubCon.com
Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
Forum Library, Charter, Moderators: Receptional & mademetop

Website Analytics - Tracking and Logging Forum

    
TranSGeniKBot
looks like log spam
coyote




msg:898269
 3:10 am on Jan 13, 2004 (gmt 0)

My main page was hit by this a few times today -
IP: 213.186.38.**
UA: TranSGeniKBot http ://www.tsgk.net

I visited the website thinking this may be a new SE's spider. I was wrong. The site was not a search engine and there was no info on the bot, at least not on the English pages.
The IP belongs to a French webhost. I've blocked the entire range to prevent this critter from coming back and sucking up my bandwidth.

 

pendanticist




msg:898270
 4:07 am on Jan 13, 2004 (gmt 0)

I wish the one that is hounding me, (no pun intended) :) would realize that no matter what he/she does, no matter how long he/she does what he/she does, my hidden stats won't be seen by him/her or anyone else. <Grrr!>

I've written to an Italian ISP, but something gets lost in the translation....

Oh, let me add that I also banned by IP Number in my case. When he/she discovered the 403 they doubled their lines of spam and increased the visits per week. :o

coyote




msg:898271
 3:07 am on Jan 14, 2004 (gmt 0)

I wish the one that is hounding me, (no pun intended) :) would realize that no matter what he/she does, no matter how long he/she does what he/she does, my hidden stats won't be seen by him/her or anyone else.

Yep, that's how it is with my site; the stats are only viewed by me, Googlebot's not gonna come spidering and giving them another "link" in the SERPs.

I think most sites have private logs/stats so log spamming is pretty much a waste of time for the spammer and a waste of bandwidth for the spammee...

dcrombie




msg:898272
 3:51 pm on Jan 14, 2004 (gmt 0)

TranSGeniKBot is systematically working through our sites (7 since it started on Jan 12).

It requests robots.txt as "TranSGeniKBot (http://www.tsgk.net)", then a random page as "TranSGeniKBot http://www.tsgk.net".

So IMHO it's an annoyance but not worth blocking (yet).

BohrMe




msg:898273
 12:54 am on Jan 15, 2004 (gmt 0)

This band is advertizing their website by spidering the web. Web site admins will visit the site listed in their logs and see what the band has to offer. Their method of advertizing is no different than email spam, IMO.

I going to go ahead and ban them since they are providing no benefit whatsoever. They aren't loading my site because my IP tracking software does not detect them. I did find it curious that they are only downloading 73 bytes of information with a http response of 200 loading the / URL.

What kind of information query only returns 73 bytes?

pendanticist




msg:898274
 3:12 am on Jan 15, 2004 (gmt 0)

Maybe that is the least this 'off-the-shelf (?)' critter can download before meeting the criteria, then move to the next one on the list? Just guessing there. :)

Lately, I've been searching on 'log spamming' and 'log spammers'. Unreal what all has been going on over in the Blog Communities. Seems as though all this Log File/Referrer/Guestbook spamming was started by the porn industry in an effort to garner PR and traffic via files accessible by webmasters, etc. I guess we're the untapped source these days.

I'll tell you this much of what I found. One individual put up a page that actually will log spam anyone you want simply by inputting the url. That's the extremes to which log spamming has gone in the Blog Community.

There are also posting there that speak to actual wages that can be made doing this uh, work. It described the pay per impression scale too. That is very suggestive of growth potential.

Now I know we should all have our stats pages hidden, but we don't. Worse than that, the log spammer does not know that either and subsequently keep right on a commin while all the time thinking he/she's doing well. Yeah, right.

These tactics have been proven and the porn industry isn't the only places spamming. Those that hit my eduational site are of bogus re-directed to Search Engine links or Lotto sites.

(Lately, some of those are checking out to be 404s, so maybe those complaints levied upstream of the website being spammed, have been read. Dunno.)

Anyway, I know it's possible to re-direct lots of things and before too awful long, I'm gonna learn how to send these guys back to their own ISP (or stand-alone clone machine) and let them spam their own logs.

Hey, one thing for sure. If it's their ISP and they happen to check their own access_log files, I can just about promise you log spammers will be looking for a new connection reaall soon.

So, let's direct them back to their ISP and see how long this practice lasts.....

"Ahhhhhhh, the power of .htaccesssssss"

BohrMe




msg:898275
 4:05 am on Jan 15, 2004 (gmt 0)

I just looked through my www root and saw that my index.html file is 73 bytes. It contains:

<script>document.location = 'http://www.esnider.net/index.php';</script>

pendanticist




msg:898276
 8:15 pm on Jan 15, 2004 (gmt 0)

So, 'ya getting much traffic from the URL drop?

bcolflesh




msg:898277
 3:23 am on Jan 16, 2004 (gmt 0)

Information from TranSGeniKBot folks:

- TranSGeniKBot understands the robots.txt and takes care of it.

- TranSGeniKBot requests one page each 30 secondes on a same website (No rapid- fire).

- TranSGeniKBot looks only for HREF and follows it (no 'mailto:' SPAMBOTS sucks).

- TranSGeniKBot is coming from ns3417.ovh.net and its IP address is 213.186.38.67.

jmccormac




msg:898278
 3:44 am on Jan 16, 2004 (gmt 0)

I instinctively deepsixed them. My main site is a directory with over 72K pages to do with Irish domains and websites. Somehow I don't think that a lot of that would be relevant to a French SE unless they were planning a trans-Europe search engine. (Whoa - weird auditory flash back to Kraftwerk :) ).

Regards...jmcc

keyplyr




msg:898279
 6:32 am on Jan 17, 2004 (gmt 0)

I received a polite response when I emailed them and asked the purpose of the crawl. Just building a directory.

BohrMe




msg:898280
 7:32 pm on Jan 20, 2004 (gmt 0)

That index file was only a temporary fix while I was doing some maintenance. I normally have a rewrite in .htaccess that takes care of it.

The only URL drops I noticed in my logs were no value added bots.

Arianna




msg:898281
 12:02 am on Jan 21, 2004 (gmt 0)

Hi I found these forums searching for info on TranSGeniKIBot. Thanks!

In the past few days I've gotten 358 reqs/357 pages from TranSGeniKIBot. This is a lot more than the index and one random page and annoys me enough to disallow it.

Also, I'm seeing an even greater number of reqs from "Netscape (compatible)" which looks to be different than the Netscape browser, which is listed separately. It makes me think it's a bot of some sort since the reqs/pages are roughly equal: 508/502. (not loading images?) Anyone know about this? Does Netscape have a spider? I thought their search was Google powered....

pendanticist




msg:898282
 3:51 am on Jan 21, 2004 (gmt 0)

I don't know Arianna, but Welcome to WebmasterWorld [webmasterworld.com] :)

From what's been posted here, if it is indeed a bot launched by a band, then I'm gonna get tough....

GaryK




msg:898283
 8:55 pm on Jan 30, 2004 (gmt 0)

I sent them an e-mail asking for clarification of their bot's purpose one week ago. To date I have not received a reply from them. I'm sending another e-mail right now. If I don't hear anything by Sunday I'm going to assume they're log spammers and ban them.

bcolflesh




msg:898284
 8:59 pm on Jan 30, 2004 (gmt 0)

GaryK - message #9 is paraphrased from their email response to me - they haven't been back, but take it for what it's worth.

pendanticist




msg:898285
 9:17 pm on Jan 30, 2004 (gmt 0)

To allow a bot just because of some self-disclosure without it's intended purpose being known does NOT seem prudent.

There are other bots I've touched on that say they only come by once-in-awhile too. Like, ah, Expired Domain Sleuth [webmasterworld.com]? Yeah, right. That one touts only one visit, but I see them with regularity.

Is the Internet so fluid that someone has to send me this bot repeatedly? Is ownership of domains in suck a state of flux that bots now have to peruse in search of dead domains on a regular basis? I do NOT think so.

Just too damned many of them to allow full and unteathered access.

Nah. I don't trust 'em.

bcolflesh




msg:898286
 9:24 pm on Jan 30, 2004 (gmt 0)

Nah. I don't trust 'em.

Me neither - wasn't trying to imply that I did -

In this particular case, I think the dude got more than he bargained for after his maiden crawl - I don't think we'll be seeing him again - at least not w/a recognizable UA ;)

GaryK




msg:898287
 9:29 pm on Jan 30, 2004 (gmt 0)

bcolflesh: Respectfully, not that I distrust you, but I will feel better once I see their reply for myself. I need to use the rational and gut reaction I get from that e-mail to decide if this bot is worth banning. If I put a bot in my banned category there will soon be thousands of websites banning it so I need to proceed carefully. :)

pendanticist




msg:898288
 9:30 pm on Jan 30, 2004 (gmt 0)

I can go with that. :)

Somewhere in the back of my mind lies a nagging feeling there will be other ones to take his/her mis-guided place.

One of these days, I'll get figure out that .htaccess coding to send them all back to their ISP and let them Log Spam a bit closer to home. <lol> If they pay no attention to the 403, they might be more inclined to back-off this ploy when re-directed to the local ISP hosting them.

Yup, one day...

bcolflesh




msg:898289
 9:38 pm on Jan 30, 2004 (gmt 0)

Off the top of my head, wouldn't something to the effect of:

RewriteCond %{HTTP_USER_AGENT} Whatever
RewriteRule %{REMOTE_HOST} [L]

Work for that?

GaryK




msg:898290
 9:09 pm on Jan 31, 2004 (gmt 0)

I got a reply from their webmaster. Perhaps it was because I included a link to this thread.

bcolflesh, the stuff you quoted above is exactly what they sent me, and exactly what they include in a link from their home page to an About TranSGeniKBot page. Note, it's a very small link at the bottom of the page. That page has been updated recently to make the purpose of the bot a bit more clear and to announce it was shut down as of January 22, 2004.

In their e-mail to me they claim their purpose is not to spam log files in order to promote their band. Rather, they are scouring the web for music links in order to make those links available to their website visitors.

I do not know if by "links" they really mean music files or if they are seriously trying to build a directory of links to stuff about music.

Either way, I have no reason to give up bandwidth to their bot.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / WebmasterWorld / Website Analytics - Tracking and Logging
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About
© Webmaster World 1996-2014 all rights reserved