Beware the lovely Lachesis

One voracious somethingorother....

[pendanticist]

This hungry litte puppy scarfed 85 files in seconds. Some files were pulled at the rate of 13 files a second!

Grrrrrr..... Check this hog out...

138.15.164.10 - - [27/Jan/2003:15:00:27 -0800] "GET /Botanical_M-Z.html HTTP/1.1" 200 14107 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:27 -0800] "GET /Calculators.html HTTP/1.1" 200 3377 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Calendars.html HTTP/1.1" 200 3062 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Citation_Guides.html HTTP/1.1" 200 3101 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Classics_A-H.html HTTP/1.1" 200 13828 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Classics_Departments.html HTTP/1.1" 200 8077 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Countries.html HTTP/1.1" 200 22036 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Criminology_Drug-Awareness.html HTTP/1.1" 200 12941 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Dictionaries.html HTTP/1.1" 200 12077 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Earth-Space.html HTTP/1.1" 200 12171 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Ecology.html HTTP/1.1" 200 14026 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Ecology_Sustainability.html HTTP/1.1" 200 10975 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Education.html HTTP/1.1" 200 8029 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:28 -0800] "GET /Educational_Television.html HTTP/1.1" 200 5106 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:15:00:29 -0800] "GET /English.html HTTP/1.1" 200 8985 "-" "Lachesis"

RewriteCond %{HTTP_USER_AGENT} ^Lachesis [NC,OR]

I guess it's time to send that one to the 403 bucket.

Pendanticist.

[jdMorgan]

Pendanticist,

Did you have it disallowed in robots.txt? Did it check it and ignore it?

Older threads [webmasterworld.com]

The original description for this 'bot would lead me to expect greater actvity from it following "events" such as the Saturday SQL debacle. But I'd be suspicious of the visit you got, since it did a LOT more than necessary to check "response time of [your] landmark Web site."

Jim

[pendanticist]

Did you have it disallowed in robots.txt?

No. Based on the same post you referred to [webmasterworld.com], I felt there was no reason to have it disallowed. None at all.

Older threads

I found, and read all of those last week when Lachesis showed up looking only for robots.txt. At the time of it's visit I was under the impression it was both - worthwhile to have visit me and well behaved.

The original description for this 'bot would lead me to expect greater actvity from it following "events" such as the Saturday SQL debacle. But I'd be suspicious of the visit you got, since it did a LOT more than necessary to check "response time of [your] landmark Web site."

That was my first impression when I saw the massive hits too, looking for sites up or down...and that's why I slammed the door shut!

Now, you think she "did a LOT more than necessary" then, look what she did overnight.

138.15.164.10 - - [27/Jan/2003:21:31:21 -0800] "GET /Humanities.html HTTP/1.1" 403 225 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Internet_Privacy.html HTTP/1.1" 403 231 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Internet_Stuff.html HTTP/1.1" 403 229 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Internships.html HTTP/1.1" 403 226 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Languages.html HTTP/1.1" 403 224 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /International_Law_Enforcement.html HTTP/1.1" 403 244 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Law_Schools.html HTTP/1.1" 403 226 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Legal_Search.html HTTP/1.1" 403 227 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Marketing_Yourself.html HTTP/1.1" 403 233 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Marketing_Yourself_Contract-Work.html HTTP/1.1" 403 247 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Mathematics_Physics.html HTTP/1.1" 403 234 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Medical.html HTTP/1.1" 403 222 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Mega_Sites.html HTTP/1.1" 403 225 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Newspapers.html HTTP/1.1" 403 225 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Quotations.html HTTP/1.1" 403 225 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Recycle.html HTTP/1.1" 403 222 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Reference.html HTTP/1.1" 403 224 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Research.html HTTP/1.1" 403 223 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Science.html HTTP/1.1" 403 222 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Search-Engines_More-Engines.html HTTP/1.1" 403 242 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /States.html HTTP/1.1" 403 221 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Statistics.html HTTP/1.1" 403 225 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:22 -0800] "GET /Student.html HTTP/1.1" 403 222 "-" "Lachesis"
138.15.164.10 - - [27/Jan/2003:21:31:23 -0800] "GET /Terrorism.html HTTP/1.1" 403 224 "-" "Lachesis"

Whaddaya think of dem apples?

One doesn't even have to count the hits to see the speed doubled!

Now, if "You can grab it at ftp.intel.com" as digitalghost mentions, then one has to closely examine the possibility of extensive problems from her (based on current usage standards shown above) in the future.

<edit>gramatical error</edit>

Pendanticist.

[jdMorgan]

Looks like a pretty dumb bot to me... Beating its head on your door.

The speed went up because the 403 response is much shorter that the real file, plus it contains no html content that might need to be parsed. So this implies the 'bot does not use a a timer to limit its rate of requests. The only things that slow it down are the size of your response and current 'net performance.

I have both a disallow in robots.txt and a 403 block on everything else for this 'bot. But Lachesis hasn't visited since I implemented this. What I'm wondering is if Lachesis honors robots.txt, ignores it, or uses it as a "shopping list".

Jim

[pendanticist]

What I'm wondering is if Lachesis honors robots.txt, ignores it, or uses it as a "shopping list".

What would we be looking at doing here?

Although I'm not all that thrilled with the thought of granting this hog a continuance, I suppose I do disallow in robots.txt and delete the 'deny from' to see what happens once I bone up on a White Space Question [webmasterworld.com].

Pendanticist.

[pendanticist]

Although I'm not all that thrilled with the thought of granting this hog a continuance, I suppose I do disallow in robots.txt and delete the 'deny from' to see what happens once I bone up on a White Space Question.

What I was trying to say is: I could allow it in robots.txt and delete the 'deny from' entry in my .htaccess to see what happens once I bone up on White Space Question.

Duh!

Pendanticist.