Current verified SPAM-bots User-agents and IP's

[Orange_XL]

I'm setting up a list of ip's and user-agents to ban. I looked thourgh the forums, but I saw many list which had valid UA and IP's in them. Can anyone give me a list of verified UA's and IP's of SPAM-bots?

Thanx!

[Dreamquick]

To be honest you going to have a hard time coming up with an absolute set of rules - spambots can come from anywhere (although number come from Far East address space, all it takes is one clueless users who thinks email harvesting is a good idea) plus their user-agents can look like whatever they want!

Personally I prefer to use case-insensitive regular expressions to identify spambots UA's - my current list looks like this (it's fed from what my site sees - there might be a downloader or unwelcome crawler in here but I've tried to take these out of this list);

e.*mail
extract
collector
^Mozilla/\d\.\d\s\(compatible;\sAdvanced\sEmail\sExtractor\sv\d\.\d+\)$
CherryPicker
Crescent
^Mozilla/\d\.\d\s\(compatible;\sMSIE\s\d\.\d;\sWindows\sNT;\sDigExt;\sDTS\sAgent$
e-collector
EmailCollector
^EmailSiphon$
EmailWolf
ExtractorPro
Microsoft\sURL\sControl
NEWT\sActiveX
Teleport
Telesoft
UtilMind\sHTTPGet
WebBandit
WebEMailExtrac
WinHttp\.WinHttpRequest\.\d+
Zeus\s*Webster
^Mozilla/3\.Mozilla/2\.01\s\(Win95;\sI\)$
^Internet\sExplore\s{0,1}\d{0,1}\.{0,1}[a-z0-9]+$
^Internet\sExplorer\s{0,1}\d{0,1}\.{0,1}\d{0,1}$
^IE\s\d\.\d\sCompatible.*Browser$
^Microsoft\sInternet\sExplorer/4\.40\.426\s\(Windows\s95\)$
^MSIE(\s\d\.\d¦)$
^Mozilla$
^Mozilla(\\¦/)\?\?$
^Production\sBot\s\d{4}B$
^Harvest

<note>The site turns solid vertical bar into broken vertical bar</note>

- Tony

[Orange_XL]

Thanx! But don't put in this:

e.*mail

Try e.?mail instead.

Using .* will cause the entire UA to be searched!

[Dreamquick]

Orange,

You're right that is a bit of an oversight on my part, but that said it doesn't return false positives at the moment. I'll fix it when I get a moment.

- Tony