205.223.216.6

[coyote]

This IP has generated hundreds of requests on my site in the past two days - no images, css, js. Has used three different UA strings:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; DigExt)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Googled the IP and got only one result, a stats page [216.239.53.104...]

The IP belongs to a school district in Florida. Maybe some kids built a bot for a science project or something. I'm all for education, but this thing is a bandwidth hog, so I'm blocking it.

[dougb]

I frequently notice bursts of traffic from the same IP with slightly varying UA strings (e.g. different versions of IE), and then trace the activity to a K12 school. My hunch is that these incidents are due to entire classrooms/labs of students going to my website at approximately the same time (as instructed by their teachers, presumably), all of them going through the same proxy. I run educational websites, so this is pretty common.

This doesn't explain why the agent in your case avoids images/JS/CSS, so it might not apply to you. School computers often often have ad blockers installed and high security settings, but I don't see why they'd block these filestypes in general.

[bull]

whois -h whois.arin.net 205.223.216.6 ...

OrgName: Leon County School District
OrgID: LCSD
Address: 520 South Appleyard Drive
City: Tallahassee
StateProv: FL
PostalCode: 32304
Country: US

NetRange: 205.223.144.0 - 205.223.223.255
CIDR: 205.223.144.0/20, 205.223.160.0/19, 205.223.192.0/19
...
NameServer: ROADRUNNER.ADMIN.LEON.K12.FL.US

[coyote]

Doug,
It would be expected for you to have school kids visiting your site, even with security on the computers. My site is in the entertainment genre and contains text on pages and keywords which would set off alarms on any type of kid-friendly filtering software. Even though my site isn't adult or pornographic, it would be blocked from access by K-12 students. The crawling has been during all hours, not just 8-3, which is something I took into consderation before writing this off as something other than a human visitor.

I think I'll block the entire range to prevent any further crawling and to keep any kids from accessing my site at school because they would probably get in trouble for surfing non-educational sites.

[BlueSky]

Why not contact the school district and show them a portion of your logs so they can remedy the problem. You may not want to get some kids into trouble, but if they are doing it to you most likely they are doing it to others as well. I doubt any school district would want students turning bots loose on the net especially using their networks. Not to mention taxpayers are footing the bill for them to do this.

[coyote]

After looking at today's logs, I'm taking a "wait and see" approach to this. I got a few visits early today from this IP, but this time images and css were downloaded, so I'm assuming this was a human visitor.
I'm now wondering if the crawler may be related to the school's blocking/filtering software, possibly finding sites that may be deemed inappropriate and storing them for review by teachers and administrators?
If that is the case then there shouldn't be any further crawling, and if the administration doesn't want kids visiting my site from school it should be blacklisted by their filtering software.

If there is any further crawling I will block the IP range and e-mail whoever is in charge of the schoool's computer network.