Fake bot spotted using Googlebot agent name

[jcoronella]

213.140.29.37 - - [10/Mar/2003:07:12:36 -0500]

Get those updates in now!

[netguy]

Did they add a new IP? I always thought it was 216*239.*.*

[ciml]

I've been getting requests from quite a few non-Googlebot IPs with a Googlebot user agent.

I think people are playing with us.

[jcoronella]

This looks like someone impersonating the Googlebot!

<self edited>.org is the nslookup result, but the whois comes back empty. "This is not what you are looking for" comes up on the page.

Could this be a competitor trying to police for cloaking so they can report me to Google?

[Rugles]

Yes I saw the deep crawler in the last hour too.

[Brett_Tabke]

hosts on that ip:

www.Acari.org
www.Autistici.org
www.Bastardi.net
www.Dolomedia.org
www.Eurosocialactivism.org
www.Gqonline.net
www.Hacari.com
www.Hacari.net
www.Hacari.org
www.Happyvegan.org
www.Insiberia.net
www.Inventati.org
www.Mortemale.org
www.Netwip.org
www.Networkinprogress.org
www.Oventhack.org
www.Paranoici.org
www.Radiointernational.org
www.Radioserva.info
www.Sitarg.net
www.Spialaspia.org
www.Stopthenato.org
www.Zanardifluxus.org

But that is no indication it was one of them. Just they share box space with the bot runner.

Also in that c-block:

www.Catrame.org 213.140.29.111
www.Birrificiobrianza.com 213.140.29.2
www.Computerprocessing.com 213.140.29.2
www.Denismarti.com 213.140.29.2
www.Generalservices.com 213.140.29.2
www.Leosalemi.com 213.140.29.2
www.Olimpiamilano.com 213.140.29.2
www.Villagreppi.org 213.140.29.2
www.Web-race.com 213.140.29.2
www.Thedop.com 213.140.29.20
www.Reisystem.com 213.140.29.35
www.Reisystem.net 213.140.29.35
www.Quicken-registration.com 213.140.29.56
www.Deltadivenere.com 213.140.29.59
www.Eroticclub-zlutavila.com 213.140.29.60
www.Europeagency.com 213.140.29.60

[react]

Autistici.org is an anonymmizer as are some of the other domains iirc

http://anonymizer.autistici.org/english/

[edit_g]

It might be someone checking if you're cloaking (could even be google:)). This is pretty easy to do, changeing your UA, but your real IP will still show up (as will any cloaking).

[ciml]

Since last Thursday, I've had Googlebot user agent values from these IPs. Mostly just ISPs.

217.207.196.184
217.158.132.79
213.140.29.37
217.158.156.94

Oddly, the first of those received 206 Partial Content responses.

> could even be google

I would imagine that if Google wanted to check for cloaking, they'd use very ordinary looking IPs and user agents.

[kyr01]

The problem may not be that easy. 213.140.29.37 is one of the address of Fastweb, an Italian fiberoptic cable connection provider. Fastweb doesn't assign static IP address to the users (I think they use DHCP - Dynamic Host Configuration Protocol servers), so it is quite possible that none of those sites is directly implied with the fake bot. By the way, all those sites share a "revolutionary" content against capitalism and globalization.

[edit_g]

I was joking ciml. ;)

[ciml]

Thanks kyr01, usually this sort of thing ends up just being someone on the end of an ISP.

Sorry edit_g, I should have realised.