Welcome to WebmasterWorld Guest from 107.21.16.70

Forum Moderators: Ocean10000

Message Too Old, No Replies

VoilaBot is a Spambot

Though it supposed to run for a search engine

     
11:03 pm on May 1, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 6, 2003
posts:193
votes: 0


A couple of days ago I noticed that VoilaBot (as mentioned in [webmasterworld.com...] and [webmasterworld.com...] hit my page quite hard...I checked my logs and noticed that it didn't obey robots.txt

So I banned the UA and the IP-range...but too late! Today I got SPAM/UCE on the email adresses mentioned on most pages (as proprietor/designer contact..webmaster@ etc.) as well as brute-force attacs on adresses as info@ and the like.

Just thought maybe somebody'd like to know...

11:23 pm on May 1, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member heini is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Jan 31, 2001
posts:4404
votes: 0


Well... just wanted to point out Voila is the provider for Wanadoo, which is a huge portal in France and one of the biggest european ISPs.
Voila itself is one of the best known web brands in France.
Don't mean to discard you charges but it somehow strikes me as unlikely.
11:26 pm on May 1, 2003 (gmt 0)

Preferred Member

10+ Year Member

joined:Mar 2, 2003
posts:398
votes: 0


heini is right web joe
12:02 am on May 2, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5496
votes: 3


which is a huge portal in France and one of the biggest european ISPs

In my ever-growing lists of "determined" pests?
APNIC,
BT of the UK, now resolved at least to my sites,
Wanadoo and France.

Of course I would have to place Level 3 in the US far above these three.
Just to be fair :-)

Don

1:34 am on May 2, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 15, 2003
posts:169
votes: 0


You mean Level3 the ones that are related to a company that rhymes with Google from a company that denied it was their router?
1:47 am on May 2, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5496
votes: 3


are related to a company that rhymes

I haven't a clue about ryhmes or their deceptions.
Level 3 is the backbone provider for many reoccurring pests.
Most recently the bunch from Colorado.

Level 3's only interest is in raising their bandwith.

Level 3 Communications, Inc. (NET-LEVEL5-CIDR) LEVEL5-CIDR
166.90.0.0 - 166.90.255.255
Level 3 Communications, Inc. (NET-LEVEL6-CIDR) LEVEL6-CIDR
209.0.0.0 - 209.0.255.255
Level 3 Communications, Inc. (NET-LEVEL7-CIDR) LEVEL7-CIDR
207.90.128.0 - 207.90.191.255
Level 3 Communications, Inc. (NET-LEVEL8-CIDR) LEVEL8-CIDR
206.15.0.0 - 206.15.31.255
Level 3 Communications, Inc. (NET-LEVEL9-CIDR) LEVEL9-CIDR
192.231.42.0 - 192.231.42.255
Level 3 Communications, Inc. (NETBLK-LC-ORG-ARIN) LC-ORG-ARIN 64.152.0.0 - 64.159.255.255
Level 3 Communications, Inc. (NETBLK-LEVEL3-CIDR) LEVEL3-CIDR 209.244.0.0 - 209.247.255.255
Level 3 Communications, Inc. (NETBLK-LEVEL4-CIDR) LEVEL4-CIDR 63.208.0.0 - 63.215.255.255
And More NetRange: 67.24.0.0 - 67.31.255.255
end

Be nice if webmasters could make their profit on "hits" ;)

5:35 am on May 2, 2003 (gmt 0)

Preferred Member

10+ Year Member

joined:June 3, 2002
posts:566
votes: 0


just wanted to point out Voila is the provider for Wanadoo

I'm not sure where you have this information from, recently saw an IP block (193.252.170.) owned by France Telecom, with a wanadoo abuse e-mail address given.

Well, if Voila is provider for wanadoo - another reason for me to block it ;)

jan

5:35 am on May 2, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 6, 2003
posts:193
votes: 0


heini & SEO practioner: Have you read my subtitle? I am fully aware that Voila is a bot of a search engine/portal in France. I checked out their site after the bot first hit me and I read the two threads I mentioned in my first post.

Fact is: It didn't obey robots.txt, and I got spammed by them - that's all I'm saying.

I guess you'd have to be in France, Switzerland, Belgium, or Canada (being the french-speaking countries in the western hemisphere, sorry if I forgot someone) to get the abuse.

[edited by: WebJoe at 7:56 am (utc) on May 2, 2003]

7:40 am on May 2, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member heini is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Jan 31, 2001
posts:4404
votes: 0


Webjoe, if you say the bot didn't obey robots, than that is so. The part that got me puzzled is you are saying it worked as email harvester (if I understand that right).

A SE bot occasionally not obeying robots, okay, has happened to better bots :). But a SE bot doing a side job as harvester?

8:01 am on May 2, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 6, 2003
posts:193
votes: 0


@heini: I was puzzled too...maybe it's just a bad coincidence that the bot hit my site and within a week I got the spam. As I mentioned before, the recipeint of the spam could be brute-force spammed, but the source lokks very much like voila: The msg-header looks as if the message came from voila (I know that can be altered), the sender has a @voila.fr-address and it's an ad for a service voila seems to provide (I couldn't verify with the site).

Anyhow, it's two bad behaviors at once, and I thought somebody would like to know.

8:06 am on May 2, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:May 21, 2001
posts:2149
votes: 0


They would have to be the dumbest spammers in the world to do what is being suggested.

I can't say for SURE they didn't - just like I couldn't say for sure - that googlebot isn't serving up spam emails - just doesn't seem likely.

Sometimes coincidinces seem amazing - and in this case - I think thats what it is.

8:30 am on May 2, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Jan 6, 2003
posts:193
votes: 0


I've seen dumber stuff...but from all the responses I figured that I jumped a conclusion maybe too quick.

Changes nothing here though (svr-cfg-wise)

8:38 am on May 2, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:May 21, 2001
posts:2149
votes: 0


in the future you could pretty much prove something like it by putting the IP address in a fake email address trap bait - like

123.456.78.9@yourhost.com

it would be simple to do with SSI [so simple even I could do it], except for having people emailing you as to why they should email their IP address at your website...

Other than that...

 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members