Welcome to WebmasterWorld Guest from 54.145.118.24

Forum Moderators: Ocean10000 & incrediBILL & keyplyr

Message Too Old, No Replies

Psycheclone

Anyone heard of this one?

     
11:58 am on Jun 2, 2006 (gmt 0)

Preferred Member

10+ Year Member

joined:Nov 2, 2005
posts:529
votes: 0


Just had "Psycheclone" turn up this morning. Anyone ever heard of it? I haven't, never seen it before, and a search on Google returned absolutely nothing.

It visited robot.txt, then went through the whole site like a dose of salts.

The IP was 208.66.195.3, some US corporation.

Good/bad/indifferent? Should I ban it?

5:49 pm on June 2, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5459
votes: 3


resurfaced under same name a few hours after I posted Msg#3
[webmasterworld.com...]

Don

7:47 pm on June 2, 2006 (gmt 0)

Preferred Member

10+ Year Member

joined:Nov 2, 2005
posts:529
votes: 0


Thanks. On the banned list it goes ;)
8:15 pm on June 2, 2006 (gmt 0)

New User

10+ Year Member

joined:Mar 12, 2006
posts:13
votes: 0


I orig. posted a similar msg. at abt. this, too.
Guess we got hit at pretty much the same time.
I had it coming from 208.66.195.10. It hit robots.txt, then went through all the main pages.

-W

12:45 am on June 3, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Nov 5, 2005
posts:2038
votes: 1


McColo Corporation. Again. Hardly a week goes by that something bad from WHOIS "MCCOLO" tries to slap us around. Like Don, I started blocking by IPs, but they have a ton. What are they, a gigantic server farm like Hurricane Electric?

208.66.195.11 - - [01/Jun/2006:09:36:43 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.11 - - [01/Jun/2006:09:37:05 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:53:38 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:54:00 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:22 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:44 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"

Clever name (if a bit cutesy). And clearly not programmed to know 403 means "Go AWAY."

3:19 am on June 3, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5459
votes: 3


but they have a ton

Not all that many ;)
Most are confined to the D Class.

McColo Corporation HURRICANE-CE1548-0922 (NET-64-62-243-0-1) 64.62.243.0 - 64.62.243.63
McColo Corporation HURRICANE-CE1548-0925 (NET-64-71-133-128-1) 64.71.133.128 - 64.71.133.191
McColo Corporation MCCOLO (NET-208-66-192-0-1) 208.66.192.0 - 208.66.195.255
McColo Corporation HURRICANE-CE1548-0927 (NET-64-62-228-0-1) 64.62.228.0 - 64.62.228.255
McColo Corporation HURRICANE-CE1548-0922 (NET-64-71-159-192-1) 64.71.159.192 - 64.71.159.223
McColo Corporation HURRICANE-CE1548-0924 (NET-64-71-177-0-1) 64.71.177.0 - 64.71.177.127
McColo Corporation HURRICANE-CE1548-0923 (NET-64-71-167-0-1) 64.71.167.0 - 64.71.167.127
McColo Corporation HURRICANE-CE1548-0921 (NET-64-62-198-128-1) 64.62.198.128 - 64.62.198.191
McColo Corporation HURRICANE-CE1548-0926 (NET-65-19-154-0-1) 65.19.154.0 - 65.19.154.127
McColo Corporation HURRICANE-CE1548-0920 (NET-64-62-171-128-1) 64.62.171.128 - 64.62.171.255

8:02 am on June 3, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 28, 2006
posts:1043
votes: 1


They hit every page on my site. Using ip address 208.66.195.8

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

Regardless, after the (not)post, i found the library thread about webmasters robots.txt file and promptly added it to my site, with the addition of the fore mentioned bots, but unfortunately, the psycheclone got everything, with a big bold 200 return code for every page.... sigh...

11:39 am on June 3, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5459
votes: 3


On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

ALL new threads are moderated and await Dan's approval.
On occassion if there are multiple submissions, he just passes one through (no need for duplication [or more]).

7:10 pm on June 3, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 28, 2006
posts:1043
votes: 1


okie dokie
3:02 am on June 11, 2006 (gmt 0)

New User

10+ Year Member

joined:Mar 9, 2003
posts:16
votes: 0


whois: McColo Corporation
Digital Infinity LTD

Deeper search reveals Digtal Infinity headquarters location in Moscow.

Draw your own conclusions

6:13 pm on June 13, 2006 (gmt 0)

Junior Member

10+ Year Member

joined:Apr 28, 2005
posts:112
votes: 0


How does one ban, in linux/apache a specific crawler/scaper like this?

Only way I know is in httpd.conf add deny from. Is there an easier way? I have virtual hosting setup so going into each and every vhost httpd.conf file sounds awful painful.

8:39 pm on June 13, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5459
votes: 3


RewriteCond %{REMOTE_ADDR} ^208\.66\.(19[2-5])\. [OR]

Here's two links which may assist you:

[webmasterworld.com...]

[webmasterworld.com...]
continuation of thread:
[webmasterworld.com...]
[webmasterworld.com...]

Some tutorials
[baremetal.com...]
[evolt.org...]
[edginet.org...]
[dimi.uniud.it...]
[webhelpinghand.com...]
[javascriptkit.com...]
[serverwatch.com...]
[verio.com...]

5:37 am on June 16, 2006 (gmt 0)

New User

10+ Year Member

joined:May 24, 2006
posts:2
votes: 0


I got hit by this bot too.
Why ban based on IP?
The host I use says that I can't ban based on IP, so should this work?:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^(psycheclone) [NC,OR]
RewriteRule ^.* - [F]
</IfModule>

1:01 pm on June 16, 2006 (gmt 0)

New User

10+ Year Member

joined:Feb 4, 2006
posts:18
votes: 0


I just happen to see this psycheclone on my server, spidering web pages. Its from a Russian Company, having 15 IP's starting from 1 to 15.

Does any one know more about what is all this up to

4:30 am on June 25, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Nov 5, 2005
posts:2038
votes: 1


McCOLO again, but hitting a different site where I'd not blocked the heck out of its IPs and UAs --

208.66.195.2
psycheclone
06/24 13:06:47 /robots.txt
06/24 13:07:17 /

So much for the 'let them all see robots.txt even if they're Disallowed' theory. Oh, well!

6:43 am on June 25, 2006 (gmt 0)

Administrator from US 

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14663
votes: 99


FYI, if you aren't blocking blank user agents, time to do it as this one has mutated.

Used to be:

208.66.195.4 "psycheclone"

Now is...

208.66.195.4 ""

Also, just block the whole range of 208.66.195.0/24 as I've tracked this on about 12 IPs so far in that block.

11:06 am on June 24, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Nov 13, 2004
posts:1425
votes: 0


Hello again .htaccess fans. Got another one. User Agent is given simply as "psycheclone".

It sucks down most of my .html pages, never any images.
If you Google for psycheclone, you will find lots of us with the same questions.

About all that is known is:
It always uses the same set of DNS numbers A.B.C.* where A, B, and C are constant but D varies.
Those numbers trace back to Russia.

Lots of guesses out there, everything from email harvesting to you name it, nothing solid.

Several webmasters say they banned by DNS A.B.C.* with * a wild-card. I banned them by name for now.

Anybody here have a clue what its about? I'm just curious now, gonna pop a beer. -Larry

PS: A GOOD beer from Europe. No cheap sh**. It was hot in California today. Maybe more than one.

4:36 pm on June 28, 2006 (gmt 0)

New User

10+ Year Member

joined:Mar 2, 2006
posts:4
votes: 0


Hi everyone,
i'm also being plaged by psycheclone in a very short time i had 43 requests for 38 pages.
A few days ago it requested 51 pages in 1 hour (funny part is, my site only has 7 pages)
unfortunately i don't really understand how to block bots through the use of a htaccess file.
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" i would very grateful.

GMax.

6:23 pm on June 28, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5459
votes: 3


I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots""

GMax,
It's customary and beneficial if you both make some kind of effort at creating your own htaccess and then provide what you created seeking help.

The reason for your error (500) or denial to all (yourself included) is that you have a syntax error.

The Cpanel on your website access should have an option for making some additions to your active htaccess. (My host names it "IP Deny Manager".

Here are some helpful web pages

This site will create an htaccess based on IP:
[htaccesstools.com...]

The simplist tutorials
[edginet.org...]
[webhelpinghand.com...]
[javascriptkit.com...]

More complicated explanations
[evolt.org...]
[baremetal.com...]
[dimi.uniud.it...]

8:51 pm on June 30, 2006 (gmt 0)

New User

10+ Year Member

joined:Mar 2, 2006
posts:4
votes: 0


Thank you wilderness,
this will perhaps get me on the right track.
I hope that with the help of the links you gave i will be able to make a working htaccess file.

GMax.

 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members