209.247.222.46, 47, 48, 49 Who is this guy?

This guy is all over my log files.

[ClickMagazine]

I have this bot(?) all over my log files. Usually pulling down pages and pictures. Once I upload new content, within minutes, there he is.

Is this a spider? ? ?

As it moves through my pages/files, the IP changes throughout those IP addresses.

I can't tell if he's good or bad? The only info I can find is Method Networks. Is it an email harvestor?

TIA,
Sarah

[Yidaki]

What's the user agent?

[ClickMagazine]

2003-11-14 14:22:29 209.247.222.49 - 65.110._ GET /shared/Index.asp - 200 54454 427 218 HTTP/1.0 www.___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - -
2003-11-14 14:22:29 209.247.222.49 - 65.110._ GET /shared/Images/Spacer.gif - 200 328 494 31 HTTP/1.0 www.___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]
2003-11-14 14:22:33 209.247.222.48 - 65.110._ GET /Ink/Images/InkBrother.gif - 200 921 495 46 HTTP/1.0 www.___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]
2003-11-14 14:22:33 209.247.222.48 - 65.110._ GET /Ink/Images/InkEpson.gif - 200 864 493 31 HTTP/1.0 www.___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]
2003-11-14 14:22:33 209.247.222.47 - 65.110._ GET /Ink/Images/InkCanon.gif - 200 892 493 46 HTTP/1.0 top-___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]
2003-11-14 14:22:34 209.247.222.48 - 65.110._ GET /Ink/Images/InkHP.gif - 200 769 490 46 HTTP/1.0 www.___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]
2003-11-14 14:22:34 209.247.222.47 - 65.110._ GET /Ink/Images/InkLexmark.gif - 200 862 495 31 HTTP/1.0 ___.com Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+98;+Creative) - [___.com...]

This is a typical entry. Thanks

[Yidaki]

Looks like a normal user. Why do you think it's a bot? Could be a valid returning user who notices changes and is interested in your new stuff ... could be a competitor too ...

If he's pulling too much pages and graphics or too fast or if he does anything that you don't want him to do, you can always block him by ip.

btw, why do you think it's a guy and not a gal ...?

[ClickMagazine]

I just checked because I was pretty sure before.

This guy/gal/it(?) doesn't sleep. It's on my site 24 hours a day, a little here, a little there, but at least something every hour.

AND it found a new subdomain before it was ever linked up anywhere. And I just checked the stats of the other site that contains the link, and there's no reference to these IP's.

Is it typical for a user to change back and forth between 4 IP addresses? They show up in the logs:

46
47
46
49
48

But it's always the same IP's and in random order.

[bbrooks]

You can lookup who owns an IP address block via:
[arin.net...]

You might also want to try doing a Google search
with the IP address in double quotes.

e.g. "123.123.123.123"

This can help find out if there are any other complaints or postings about an IP in question. It is also useful for detecting if an IP is on any 'proxy lists' which are sometimes abused by script writers and spammers.

[ClickMagazine]

bbrooks,

The arin return Method Networks but that doesn't get me anywhere. And I've also tried doing a google search like you suggested. Searching the IP and Method Networks gives little information.

I'm just not getting anywhere. Now I'm seeing these same IP's with GET and (compatible;+MS+FrontPage+4.0) so I'm thinking it's a site copyier.

I'm going to IP ban them, I was curious to know who they are and what they are up to.

Thanks you two...