Has anyone spotted this before?

Forum Moderators: DixonJones

Message Too Old, No Replies

Has anyone spotted this before?

_wc_end_

Rugles

6:35 pm on Jan 16, 2002 (gmt 0)

A company that is into legal corporate espionage has a crawler that hits my site frequently.

Today I noticed that the crawler is requesting a file called "/_wc_end_".

This file does not exist on my server and I was wondering if anyone can clue me in as to what is going on here.

Thanks

ralnikov

11:06 am on Jan 17, 2002 (gmt 0)

I have seen several times crawlers which tries to access 'standard' files with known bugs. These are popular scripts, MS frontpage extensions and so on. Maybe that request is the same one.

Rugles

4:38 pm on Jan 17, 2002 (gmt 0)

I do not know if it is a mistake, a hidden Frontpage file or some sort of virus.

I just find it strange, it concerns me because of the company involved.

bird

5:39 pm on Jan 17, 2002 (gmt 0)

Would you mind giving away their IP/UA?

That's the kind of thing most of us would probably love to feed some "special" content... ;)

Rugles

5:53 pm on Jan 17, 2002 (gmt 0)

Here is the IP
209.73.228.163

This is all you get as a UA
Webclipping.com

If that gets deleted I apologize in advance.

bird

8:48 pm on Jan 17, 2002 (gmt 0)

Compare this: [webmasterworld.com...]

Webclipping rings a bell.
During the last two and a half years, I have seen them with the following signatures:

209.207.168.68 "AE/2.1 (linux)" (not sure, but most likely the same)
209.207.168.250 "testspider"
209.207.168.250 "Webclipping.com"
209.73.228.163 "test"
thor.webclipping.com (209.73.228.165) "Mozilla"
209.73.228.165 "Webclipping.com"
209.73.228.167 "Webclipping.com"
209.73.228.167 "Mozilla/4.77 [en] (X11; U; Linux 2.2.18 i686)"

Ah yes, and I also recorded a Nimda attack from one of their machines... ;)
They ignore robots.txt, which alone would be enough to earn them a blocking. The last one is also unlikely to be a human user, as it follwed exactly the same access patterns as the others.
Note that the "Mozilla" string normally is used by some kind of link checker software, which appears to behave nicely.

Rugles

9:17 pm on Jan 17, 2002 (gmt 0)

Yes, I have read that thread in the past.

The thing that concerns me most is that non-existant file they are requesting. I think they might be up to something that can't be good for me. Plus, you should see/hear the attitude you get when you contact them.

Thanks for all the info Bird.