missing ")"

bot masking as IE

[bull]

213.239.***.* - - [%timestamp%] "GET /mymainentrypoint/ HTTP/1.1" 200 1668 www.-.net "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0" "-"

So-called "photo site" hosted on that IP. Went straight to the trap after taking three, four pages.
Will
RewriteCond %{HTTP_USER_AGENT} .*[0-9]$
function and perhaps affect any known legal bots I currently don't think at?

[jdMorgan]

That would block Gigabot, the ODP verification spider Robozilla, and many others.

In this case, I'd split the difference between an exact UA match and one that allows some flexibility:

RewriteCond %{HTTP_USER_AGENT} ^Mozilla/[1-9]\.[0-9]+\ \(compatible;
RewriteCond %{HTTP_USER_AGENT} !\)
RewriteRule .* - [F]

That just looks for the missing ")" in a standard Mozilla UA string.

Jim

[bull]

thank you Jim!

[WebJoe]

same bot from the same IP range (assuming the part bull posted was real) hit two of my sites tooo today, also went straight fot the trap.

Anybody got an idea one would go about writing that regexp in asp?

[bull]

WebJoe,
the posted part is real, Germany. I did a http on that IP and got the type of site I described above.

[WebJoe]

interesting...never tried that before, but I gotta remember it as it gives a more accurate result. I just looked up the ip in RIPE and got the provider, so I blocked its whole ip range (hence the Q about regexp in asp, it's a bit of an overkill)

[WebJoe]

guess what...today i receifed an email fom the same range by some company that are called m*e*ta*f*i*n*d*e*r*.*d*e, to the email addy I have as bait on my trap-page...that'll keep 'em banned for a while