Forum Moderators: open
419 Scammers use of Missigua Locator 1.9 is again a problem from Mozambique, Nigeria, Cote d'Ivory, Togo & Benin.
Deutsche Telekom: In most cases, their backbone is used by other countries and while they should be informed of scammers/spammers using their network, they are not the culprit.
Israel: Runs a satellite backbone that feeds some African countries. Again, we can not blame a backbone.
UK: Same notation. Feeds many African countries.
Massive IP blocks may lock out "friendly" visitors, therefore be highly selective in your blocks and htaccess.
- - -
I found that post on Google, after the same, uh, entity crawled my entire site.
It never looked at robots.txt (not banned there) and took every html file I had, but no images.
All hits were from the same IP # 64.165.***.** which traces back to Pacific Bell
(now SBC) in San Francisco.
Having only 140 pages or so, I wasn't hit too badly.
But, does anybody know who/what this actually is,
and what purpose they have in crawling a UFO site?
What is a "419 scammer" anyway?
- Larry
[edited by: volatilegx at 2:04 pm (utc) on Jan. 4, 2005]
[edit reason] obscured IP address [/edit]
The perpetrators of Advance Fee Fraud (AFF), known internationally as "4-1-9" fraud after the section of the Nigerian penal code which addresses fraud schemes...
For the record, I want to say that just because certain 419 fraudsters may have used Missigua Locator, it doesn't mean every use of the UserAgent can be linked with 419 fraud.
[edited by: volatilegx at 4:02 pm (utc) on Jan. 19, 2005]
I don't think that applies here though. Somebody used or spoofed the 'Missigua Locator 1.9'
tag to spider my entire site. No images, but all 140 .html files instead.
Does anyone know who this is, and what's their game? - Larry
It hit a blog I host and headed straight for the bot-trap.
216.117.157.247 - - [30/May/2004:22:48:06 -0700] "GET /myfolder/mypage.htm
HTTP/1.1" 200 24705 "-" "Missigua Locator 1.9"
Hardly coming from any non-NA IP range.
I've also had constant spidering attempts by a varity of sources in Missauga, Ontario
In addition the following thread appears to reference blogs:
[webmasterworld.com...]
IMO, all three provide reasons for denial.
Four days running, spidered entire site yet again ..
THIS time the DNS # is 69,228.XX.XX.
I put that into the ADDRESS bar and (slowly) up comes the ZEND corporation, "the .php people".
Zend is headquartered in Cupertino, CA i.e. nearby.
I emailed their webmaster (via their form mail).
This has me mystified. The only thing in common is the Missugua Locator (phony?) user agent.
Previously, they came in with DNS'es
67.119.#*$!.#*$! -and- 67.119.yyy.yyy (different last two #s.
All come in via the SBC backbone (our local phone company) but that tells me nothing.
Whoever this is, they really cover their tracks.
I can't ban them based on DNS #s if they keep changing them that much.
Any clues at all? - Larry
I'm stuck for an answer
Larry,
Harvesting is not a difficult task to comprehend!
Take a look at ALL the software's created in the past to harvest:
[webmasterworld.com...]
The reason the users continue harvesting is apprently because they generate revenue. Accept it and make corrections in how you both create and allow access to you pages.
Denying access to visitors based on IP ranges is a secondary choice, ALWAYS.
The best and most effective option is to deny visitors based on a User Agent which is used by few visitors and reduces the denial of innocents.
The locator thing creates any easy solution.
SetEnvIf User-Agent Missigua keep_out (or what ever close you use)
or
SetEnvIf User-Agent Locator (or what ever close you use)
You may also use Rewrite for UA's, I do not.
RewriteCond %{HTTP_USER_AGENT} Missigua [OR]
or
RewriteCond %{HTTP_USER_AGENT} Locator [OR]
216.65.11.179 - - [19/Jan/2005:07:04:18 -0800] "GET / HTTP/1.1" 200 20407 "-" "Missigua Locator 1.9"
No robots.txt.
RewriteCond %{HTTP_USER_AGENT} Missigua [OR]
Drat! But it's in there nooowwwww....
tracerouted source back to
irc109.hostcentric.com (216.65.11.179) 179.944 ms 167.879 ms 167.906 ms
irc109? some sort of IRC bot maybe?
Http Code: 200 Date: Jan 30 07:20:29 Http Version: HTTP/1.1 Size in Bytes: 23308
Referer: -
Agent: Missigua Locator 1.9
Hitting my site every 30 seconds to grab a page.
67.10.67.116 - - [31/Jan/2005:09:23:15 -0500] "GET / HTTP/1.1" 200 28799 "-" "Missigua Locator 1.9"
Banned the i.p. but it is likely a dhcp isp address and will probably change.
Was also misfiring:
67.10.67.116 - - [31/Jan/2005:09:23:03 -0500] "GET /directory/keyword-keyw...%A0 HTTP/1.1" 404 986 "-" "Missigua Locator 1.9"
<added> Now banned it is generating a 403 request every 10-12 seconds. Slow learner. </added>
I'd disabled the script earlier this week, so it never went through. But this is the same IP as someone had noticed earlier in this thread.
Along with Ask :). Ask just never learns! I freed it a few days ago, and it's back into the trap.
Jim
they were hitting me multiple times per second, tho! ;)
mod_dosevasive started giving them 403's right away, though, and they're now banned by UA...
69.115.135.243 - - [24/Apr/2005:06:10:34 -0400] "GET / HTTP/1.1" 200 14187 "-" "Missigua Locator 1.9"
I am leaning toward some form of "for purchase" automated content scraper or harvesting program leaving this bot description because of this being an apparent dynamic i.p. and the i.p. range of this particular request. I have banned similiar dynamic i.p. ranges from this provider in the past for scraping content. Anybody know definitively what this bot is from?
[edited by: idoc at 7:44 pm (utc) on April 25, 2005]
I loaded the IP number as a website. Title is:
Top 10 Search engine placement _ Need Web Traffic?
But the only visible content is a green background and a simple form field/submit with this text above it:
To be removed, enter your email address below and click REMOVE
My guess would be - e-mail harvesters.
stef
OK, its time to ban it. Problem is, I'm scared to death of screwing up my .htaccess file.
Here's what I have so far, just a little code to 301 redirect non-www to my full www URL:
= = =
RewriteEngine On
RewriteCond %{HTTP_HOST}!^www\.mysite\.net [NC]
RewriteRule ^(.*)$ [mysite.net...] [R=301,L]
= = =
First off, is the code above perfect in every way? I'm already using it.
NOW, I want to ban any and all requests from anything with 'missigua' in name of user-agent.
Can somebody write me the code to do this?
If so, PLEASE put it together with the code above so its all in one piece. I don't know what comes first,
the 301 rewrite or the missigua ban, and I don't know how to stitch those together.
I'd like to make it case insensitive, and just use the one word missigua in case they change version
numbers etc.
Once that's in place, I will do my best to figure it all out, and ban other abusive bots on my own.
Any help much appreciated. The last time I tried to bad a bot I shut my whole site down!
Sticky me if that will help. Many thanks in advance - Larry
PS: Assuming this works, will missigua show up in my error_log files, like mistyped URLs etc do now?
I'd really like that. Sort of like hearing the bug-zapper go snap! -LH
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.mysite\.net [NC]
RewriteRule ^(.*)$ http://www.mysite.net/$1 [R=301,L]
RewriteCond %{HTTP_USER_AGENT} ^Missigua [NC]
RewriteRule .* - [F]
I just sent it up and tested it. My site didn't vanish or anything awful.
Now I can't wait for Missigua monster to come back around.
If all goes well, my error_log file should be really big. Thanks again! - Larry
If you use it all, you will be redirecting NON-www urls to the www.yoursite type, which is considered
a good thing in general. - Larry
