Badly-written spider

Possibly using open .CA proxies

[jdMorgan]

Last night I got a visit from a badly-written spider.
It tried to fetch /shortcut - as in "shortcut icon", which appears in a tag just after my title. It then tried to fetch "/icon".

The next attempt fell right into one of my spider traps, and subsequent requests resulted in 403-Forbidden responses.

Tonight, it came back, first using the blocked IP address from last night, then immediately switching to a new IP for the subsequent requests. It then repeated the same sequence as last night, and got trapped again. Then it finished off with another attempt from the previously-banned address.

Very weird.

207.164.181.130 - - [30/Mar/2003:21:45:21 -0500] "GET / HTTP/1.1" 403 505 "-" ""
204.101.104.111 - - [30/Mar/2003:21:54:21 -0500] "GET / HTTP/1.1" 200 23928 "-" ""
204.101.104.111 - - [30/Mar/2003:21:54:23 -0500] "GET /shortcut HTTP/1.1" 404 448 "-" ""
204.101.104.111 - - [30/Mar/2003:21:54:24 -0500] "GET /icon HTTP/1.1" 404 448 "-" ""
204.101.104.111 - - [30/Mar/2003:21:54:26 -0500] "GET /eat_it.html HTTP/1.1" 200 114 "-" ""
207.164.181.130 - - [30/Mar/2003:21:57:24 -0500] "GET / HTTP/1.1" 403 505 "-" ""

The only obvious commonality of these IPs is that both are Canadian, and otherwise reputable firms.

So, no conclusions here, just a heads-up.

Jim

[Andrue]

204.101.104.235

that IP shows up in the spamcop blacklist as a spammer if that may help here.