Sleipnir

what is this?

[keyplyr]

Been hit very heavy by Sleipnir Version 1.41

219.77.245.148 - - [07/Sep/2003:03:13:47 -0700] "GET /page.html HTTP/1.1" 200 24222 http*://www.google.com/search?hl=zh-TW&q=search%20term "Sleipnir Version 1.41"
219.77.245.148 - - [07/Sep/2003:03:13:48 -0700] "GET /css/global.css HTTP/1.1" 200 3565 "http*://www.my_domain.com/page.html" "Sleipnir Version 1.41"

IP = http*://www.pccw.com/ which looks like a directory in Hong Kong. Anyone have any more info on this UA?

Thanks

* added to de-link URL

[seindal]

Not much, but the names seems to be a reference to a horse in ancient nordic mythology, which hints towards Scandinavia or Iceland. Somewhat thin evidence, I admit, but who knows.

It is often spelled Sleipner.

[keyplyr]

Well, regardless - LOL, I'm not so sure I'm OK with it going through thousands of my image files and scripts since they are disallowed in robots.txt

[claus]

Sleipnir is a Japanese browser.

(1) Homepage: [sleipnir.pos.to...]
(2) Unofficial user's page: [sleipnir.sub.jp...]
(3) Yahoo group: [groups.yahoo.com...]

Link 1 and 2 are mostly in japanese.

/claus

---

Added: The major Icelandic Search Engine is called Leit: [leit.is...]

[seindal]

Kinda weird they've chosen that name, but maybe it means something in Japanese.

[keyplyr]

Thanks Claus, I also read those pages and it looks to me that this utility is set-up as a download tool to harvest files from a website. My logs reflect just that.

[BlueSky]

How exactly are you determining it is harvesting your files? When a browser hits a page, the logs will show entries for loading the css, all the graphics, external js files, etc. A thousand pix sounds like a lot but if your pages are loaded with images, it could just be his browser retrieving them for display. Or, are these all spread out and he's hitting a lot pages on you?

[keyplyr]

No pages - just files.

[BlueSky]

Oh really...I got the impression it was pages because of the two entries you posted. Well, if he is pulling that many files directly then he's probably a good ban candidate.

[keyplyr]

He requested the index page, then requested it again, then went after all the image files in 3 directories which are disallowed in robots.txt. Looks like he only requested the page to find out where the files were. And yes, I banned the UA immediately.

[claus]

With my understanding of Japanese (joke, i know nothing - parts of the pages are in English) this browser has a scripting language, so it's possible that it can be changed from being just a browser to being something else.

A careful approach would be a ban on the combination of IP and User-Agent (both stated as a rewrite condition without the [OR] flag between them) - that way you don't ban real people using it for browsing by accident. OTOH, you could just keep the ban based on UA alone if you don't suspect you will get real visitors using this one.

/claus