Forum Moderators: open

Message Too Old, No Replies

New Spam bot?

         

willtell

2:39 pm on Oct 22, 2002 (gmt 0)

10+ Year Member



Anyone seen this crawler on their site?

crawler918.com

carfac

4:23 pm on Oct 22, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



What is the UA?

martin

6:28 pm on Oct 22, 2002 (gmt 0)

10+ Year Member



Mozilla/4.7

Thanks. I didn't know it's a spambot.

I'll ban 12.148.196.141 immediately.

martin

6:33 pm on Oct 22, 2002 (gmt 0)

10+ Year Member



Also RPT-HTTPClient/0.3-3.

PS. A problem with owner edit.

fiestagirl

6:48 pm on Oct 22, 2002 (gmt 0)

10+ Year Member



Nameprotect snoopbot. They're selling info about your site to anyone that will buy.
they own:

12.148.196.128 - 12.148.196.255

and use multiple uas.

Romeo

10:14 pm on Oct 22, 2002 (gmt 0)

10+ Year Member



I have seen this bot (12.148.196.141) on 2002-09-26 violating my robots.txt.

jdMorgan

2:24 am on Nov 13, 2002 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This spider came by today with a "new" IP and a UA of "Mozilla/4.7", did not fetch robots.txt, promptly ran into a spider trap and got itself banned:

12.148.209.196 - - [12/Nov/2002:19:33:57 -0500] "GET / HTTP/1.1" 403 773 "-" "Mozilla/4.7"

So, this makes two IP blocks I know of:
12.148.196.128 - 12.148.196.255 Nameprotect.com
12.148.209.192 - 12.148.209.255 Nameprotect.com

For those blocking IPs using mod_rewrite:

RewriteCond %{REMOTE_ADDR} ^12\.148\.196\.(12[8-9]¦1[3-9][0-9]¦2[0-4][0-9]¦25[0-5])$ [OR]
RewriteCond %{REMOTE_ADDR} ^12\.148\.209\.(19[2-9]¦2[0-4][0-9]¦25[0-5])$ [OR]
...

This very-dumb spider fetched "/" ten times before it whacked itself - very wasteful of bandwidth.

Jim