Welcome to WebmasterWorld Guest from 54.160.131.144

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Psycheclone

Anyone heard of this one?

     

malachite

11:58 am on Jun 2, 2006 (gmt 0)

5+ Year Member



Just had "Psycheclone" turn up this morning. Anyone ever heard of it? I haven't, never seen it before, and a search on Google returned absolutely nothing.

It visited robot.txt, then went through the whole site like a dose of salts.

The IP was 208.66.195.3, some US corporation.

Good/bad/indifferent? Should I ban it?

wilderness

5:49 pm on Jun 2, 2006 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



resurfaced under same name a few hours after I posted Msg#3
[webmasterworld.com...]

Don

malachite

7:47 pm on Jun 2, 2006 (gmt 0)

5+ Year Member



Thanks. On the banned list it goes ;)

fusion5

8:15 pm on Jun 2, 2006 (gmt 0)

5+ Year Member



I orig. posted a similar msg. at abt. this, too.
Guess we got hit at pretty much the same time.
I had it coming from 208.66.195.10. It hit robots.txt, then went through all the main pages.

-W

Pfui

12:45 am on Jun 3, 2006 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



McColo Corporation. Again. Hardly a week goes by that something bad from WHOIS "MCCOLO" tries to slap us around. Like Don, I started blocking by IPs, but they have a ton. What are they, a gigantic server farm like Hurricane Electric?

208.66.195.11 - - [01/Jun/2006:09:36:43 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.11 - - [01/Jun/2006:09:37:05 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:53:38 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:54:00 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:22 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:44 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"

Clever name (if a bit cutesy). And clearly not programmed to know 403 means "Go AWAY."

wilderness

3:19 am on Jun 3, 2006 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



but they have a ton

Not all that many ;)
Most are confined to the D Class.

McColo Corporation HURRICANE-CE1548-0922 (NET-64-62-243-0-1) 64.62.243.0 - 64.62.243.63
McColo Corporation HURRICANE-CE1548-0925 (NET-64-71-133-128-1) 64.71.133.128 - 64.71.133.191
McColo Corporation MCCOLO (NET-208-66-192-0-1) 208.66.192.0 - 208.66.195.255
McColo Corporation HURRICANE-CE1548-0927 (NET-64-62-228-0-1) 64.62.228.0 - 64.62.228.255
McColo Corporation HURRICANE-CE1548-0922 (NET-64-71-159-192-1) 64.71.159.192 - 64.71.159.223
McColo Corporation HURRICANE-CE1548-0924 (NET-64-71-177-0-1) 64.71.177.0 - 64.71.177.127
McColo Corporation HURRICANE-CE1548-0923 (NET-64-71-167-0-1) 64.71.167.0 - 64.71.167.127
McColo Corporation HURRICANE-CE1548-0921 (NET-64-62-198-128-1) 64.62.198.128 - 64.62.198.191
McColo Corporation HURRICANE-CE1548-0926 (NET-65-19-154-0-1) 65.19.154.0 - 65.19.154.127
McColo Corporation HURRICANE-CE1548-0920 (NET-64-62-171-128-1) 64.62.171.128 - 64.62.171.255

youfoundjake

8:02 am on Jun 3, 2006 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



They hit every page on my site. Using ip address 208.66.195.8

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

Regardless, after the (not)post, i found the library thread about webmasters robots.txt file and promptly added it to my site, with the addition of the fore mentioned bots, but unfortunately, the psycheclone got everything, with a big bold 200 return code for every page.... sigh...

wilderness

11:39 am on Jun 3, 2006 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

ALL new threads are moderated and await Dan's approval.
On occassion if there are multiple submissions, he just passes one through (no need for duplication [or more]).

youfoundjake

7:10 pm on Jun 3, 2006 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



okie dokie

photoace

3:02 am on Jun 11, 2006 (gmt 0)

10+ Year Member



whois: McColo Corporation
Digital Infinity LTD

Deeper search reveals Digtal Infinity headquarters location in Moscow.

Draw your own conclusions

gford

6:13 pm on Jun 13, 2006 (gmt 0)

10+ Year Member



How does one ban, in linux/apache a specific crawler/scaper like this?

Only way I know is in httpd.conf add deny from. Is there an easier way? I have virtual hosting setup so going into each and every vhost httpd.conf file sounds awful painful.

wilderness

8:39 pm on Jun 13, 2006 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



RewriteCond %{REMOTE_ADDR} ^208\.66\.(19[2-5])\. [OR]

Here's two links which may assist you:

[webmasterworld.com...]

[webmasterworld.com...]
continuation of thread:
[webmasterworld.com...]
[webmasterworld.com...]

Some tutorials
[baremetal.com...]
[evolt.org...]
[edginet.org...]
[dimi.uniud.it...]
[webhelpinghand.com...]
[javascriptkit.com...]
[serverwatch.com...]
[verio.com...]

gmrthree

5:37 am on Jun 16, 2006 (gmt 0)

5+ Year Member



I got hit by this bot too.
Why ban based on IP?
The host I use says that I can't ban based on IP, so should this work?:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^(psycheclone) [NC,OR]
RewriteRule ^.* - [F]
</IfModule>

seoshare

1:01 pm on Jun 16, 2006 (gmt 0)

5+ Year Member



I just happen to see this psycheclone on my server, spidering web pages. Its from a Russian Company, having 15 IP's starting from 1 to 15.

Does any one know more about what is all this up to

Pfui

4:30 am on Jun 25, 2006 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



McCOLO again, but hitting a different site where I'd not blocked the heck out of its IPs and UAs --

208.66.195.2
psycheclone
06/24 13:06:47 /robots.txt
06/24 13:07:17 /

So much for the 'let them all see robots.txt even if they're Disallowed' theory. Oh, well!

incrediBILL

6:43 am on Jun 25, 2006 (gmt 0)

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



FYI, if you aren't blocking blank user agents, time to do it as this one has mutated.

Used to be:

208.66.195.4 "psycheclone"

Now is...

208.66.195.4 ""

Also, just block the whole range of 208.66.195.0/24 as I've tracked this on about 12 IPs so far in that block.

larryhatch

11:06 am on Jun 24, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hello again .htaccess fans. Got another one. User Agent is given simply as "psycheclone".

It sucks down most of my .html pages, never any images.
If you Google for psycheclone, you will find lots of us with the same questions.

About all that is known is:
It always uses the same set of DNS numbers A.B.C.* where A, B, and C are constant but D varies.
Those numbers trace back to Russia.

Lots of guesses out there, everything from email harvesting to you name it, nothing solid.

Several webmasters say they banned by DNS A.B.C.* with * a wild-card. I banned them by name for now.

Anybody here have a clue what its about? I'm just curious now, gonna pop a beer. -Larry

PS: A GOOD beer from Europe. No cheap sh**. It was hot in California today. Maybe more than one.

GMax

4:36 pm on Jun 28, 2006 (gmt 0)

5+ Year Member



Hi everyone,
i'm also being plaged by psycheclone in a very short time i had 43 requests for 38 pages.
A few days ago it requested 51 pages in 1 hour (funny part is, my site only has 7 pages)
unfortunately i don't really understand how to block bots through the use of a htaccess file.
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" i would very grateful.

GMax.

wilderness

6:23 pm on Jun 28, 2006 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots""

GMax,
It's customary and beneficial if you both make some kind of effort at creating your own htaccess and then provide what you created seeking help.

The reason for your error (500) or denial to all (yourself included) is that you have a syntax error.

The Cpanel on your website access should have an option for making some additions to your active htaccess. (My host names it "IP Deny Manager".

Here are some helpful web pages

This site will create an htaccess based on IP:
[htaccesstools.com...]

The simplist tutorials
[edginet.org...]
[webhelpinghand.com...]
[javascriptkit.com...]

More complicated explanations
[evolt.org...]
[baremetal.com...]
[dimi.uniud.it...]

GMax

8:51 pm on Jun 30, 2006 (gmt 0)

5+ Year Member



Thank you wilderness,
this will perhaps get me on the right track.
I hope that with the help of the links you gave i will be able to make a working htaccess file.

GMax.

 

Featured Threads

Hot Threads This Week

Hot Threads This Month