dloader(NaverRobot)/1.0

switching IP Numbers very, very quickly.

[pendanticist]

218.145.25.17 - - [01/May/2003:18:01:01 -0700] "GET / HTTP/1.0" 403 198 "-" "dloader(NaverRobot)/1.0"
61.78.61.242 - - [01/May/2003:18:01:01 -0700] "GET /Blahblah.html HTTP/1.0" 403 215 "-" "dloader(NaverRobot)/1.0"
61.78.61.242 - - [01/May/2003:18:01:02 -0700] "GET /Blahblah.html HTTP/1.0" 403 214 "-" "dloader(NaverRobot)/1.0"

Both resolve to the same ISP.

That's a fairly wide range/block of IP Numbers for the same ISP isn't it?

Switched IP Numbers in about a nanosecond! Is that normal?

Pendanticist.

[wilderness]

Pendanticist
They been doing that to my 403's for some months now ;)
They are persistent and return almost daily to more awaiting 403's.

Best to ban this one by UA.

Not sure if the switching of IP's is normal or not.
Most anything is possible these days with the correct software :(

I've seen other IP's switch it's just not a fresh mind tonight.

[marcs]

That's a fairly wide range/block of IP Numbers for the same ISP isn't it?

It's two IP blocks :

218.144.0.0 - 218.159.255.255
and
61.78.59.0-61.78.63.255

It's not unusual for an ISP to have more than 1 IP block.

Switched IP Numbers in about a nanosecond! Is that normal?

I don't think it "switched IP numbers", probably just a bot running on several machines which have differnet IP numbers.

Looks like you had their bot visit you from two machines at pretty much the same time. If those two machines had those respective IP's then that would pretty much explain it.

[pendanticist]

wilderness:
>They are persistent and return almost daily to more awaiting 403's.

<chuckle> Yet another one to add to the stupid bot list.

>Best to ban this one by UA.

RewriteCond %{HTTP_USER_AGENT} dloader(NaverRobot)/1.0 [OR]

Been banned, just curious about this particular activity.

marcs:

>It's not unusual for an ISP to have more than 1 IP block.

Not well versed on that stuff, but just assumed that the blocks would be closer together numerically.

>Looks like you had their bot visit you from two machines at pretty much the >same time.

That's what was in the back of my mind when I posted.

Thanks to both of you. :)

Pendanticist.