Mac Finder 1.0.39

How about this crawler?

[kewlbeezer]

Mac Finder 1.0.39 is the UA... Coming from 66.250.133.117...

Here's the server logs:

2003-04-07 20:39:37 66.250.133.117 - 192.168.20.11 80 GET /Default.aspx - 200 Mac+Finder+1.0.39

2003-04-07 20:39:37 66.250.133.117 - 192.168.20.11 80 GET /guestbook/ - 302 Mac+Finder+1.0.39

2003-04-07 20:39:38 66.250.133.117 - 192.168.20.11 80 GET /guestbook/Default.asp - 200 Mac+Finder+1.0.39

I don't like that it didn't request robots.txt *and* it went straight to our guestbook (which doesn't output email addresses thankfully, in case this was a spambot.)

ARIN whois returns:
OrgName: Cogent Communications
OrgID: COGC
Address: 1015 31st Street, NW
City: Washington
StateProv: DC
PostalCode: 20007
Country: US

Anyone ever see this one before?

[pendanticist]

Well, according to most of the results from googling 'Mac Finder [google.com]' it appears to be something related to a Mac OS [macos.about.com]?

Pendanticist.

[kewlbeezer]

I think you're thinking of Mac's "Finder" application... This is different I think...

I'm pretty sure this is a spambot... but does anybody have info about this bot?

[wilderness]

I believe this UA contains three different softwares.

Time2Help is one result from a google search on that portion of the UA.
Version 1.0.39 Release Notes

BTW I might add that Cogent has been a thorn for some time.
I have portions denied.

[Jaf]

"Mac Finder" is a guestbook sniffer. It's one of a number I've seen in the last few weeks. See the thread I've just started on "guestbook spammers".

Of course, the Mac Finder is also part of the Macintosh OS, but as you'll see in the other thread, most of the names being used recently are innocuous.

Sorry, I can't work out how to link to that thread. I can't even work out smilies in this forum :-)

(if someone tells me how, I'll edit this message)

[pendanticist]

Hey Jaf, 'Ya done good.

:)

Pendanticist.

[edited by: pendanticist at 12:31 am (utc) on April 14, 2003]

[Jaf]

Okay, here goes nothing.

The guestbook spammers [webmasterworld.com] thread is the one I started earlier [:)]

Oh well... a partial success (no smiley)