Crescent Internet ToolPak HTTP OLE Control v.1.0

Crazy rapid fire bot with bad links!

[LeBain]

Oh my god! A bot called "Crescent Internet ToolPak HTTP OLE Control v.1.0" running at rr-56-38-107.atl.mediaone.net grabbed 730 URLs from one of my sites on Oct 15, 2001 between 2:03AM and 2:10AM.

This included 307 requests that were 404 becase the bot doesn't know how to construct links. It was requesting pages like:
/archive/'../index.shtml'
/'/list.html'

And even requesting javascript commands:
/archive/javascript:window.print();

I added this to my .htaccess file:

order allow,deny
allow from all
deny from rr-56-38-107.atl.mediaone.net

[LeBain]

Just found this link to a description of this bot. Appears to be an e-mail address scanner.

[siteware.ch...]

[bobriggs]

I'm afraid that the ip list could be endless:

[webmasterworld.com ]

[webmasterworld.com ]

I have the same UA with these ip's from Friday and Saturday:

cpe-66-1-194-223.co.sprintbbd.net (66.1.194.223)

and
ocnsd1-blk1-hfc-0251-d1db0d9c.rdc1.sdca.coxatwork.com (209.219.13.156)

But can anyone verify that this works?
[webmasterworld.com...]

And if you can't use mod_rewrite, is there any other alternative?

[LeBain]

Happened again 24 Oct. from att-98-2-94.atl.mediaone.net (dynamic IP I'm sure).

833 requests
584 of which were 404

[redzone]

The Crescent Internet Control is an ActiveX control package that could be used for a variety of functions, depending on the application.

It could be a spider, capturing pages, a bot scanning for email addresses, etc....

We use a similar ActiveX control for our ranking functions, and PPC Engine monitoring.