207.31.251.130 massive hits... Im thinking email harvester

[Chalupee]

207.31.251.130 massive hits... Im thinking email harvester.

whois didn't reveal anything..

logs show this mydomainnanme.com/javascript:openWin2()
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.

Chalupee

[BlueSky]

All the links say javascript:openWin2()? What is he getting 404's?

[ncw164x]

ISP is VERIO.NET

without any further information it could be anything
email harvester
home made spider

ncw164x

[Chalupee]

Bluesky -
I was checking my main logs for something else and saw the massive string of hits from the IP... many many at the same time (to the second), or just a second a part.
I then checked it against a program I run that reports all the errors to my server... I guess it's like a spider trap and shows me all the 404s useragent etc.
I found the mydomain.com/javascript:openWin2() 404 error with the IP . Thought the info might give somebody an idea what is going on (no javascript:openWin2() on my main page to create the error). There was only one of these 404s.

Oh yeah.. it did look for the robots.txt file ...... for some funky reason this thing smells like Interseer (internetseer)

Chalupee

[BlueSky]

Like nwc said, could be almost anything. There's a lot of hit and run bots out there which aren't email harvesters. It's pretty weird to see one using javascript in a url request. If you only got one 404, were the rest without javascript giving 200's?

I recommend you send a complaint to Verio at: [e-mail]. Send them a copy of this activity from your raw logs and ask them to investigate and stop it. If you're on an apache server, you might want to consider adding a bot trap to your pages. It helps put a short leash on these types of bots.