VoilaBot is a Spambot

Though it supposed to run for a search engine

[WebJoe]

A couple of days ago I noticed that VoilaBot (as mentioned in [webmasterworld.com...] and [webmasterworld.com...] hit my page quite hard...I checked my logs and noticed that it didn't obey robots.txt

So I banned the UA and the IP-range...but too late! Today I got SPAM/UCE on the email adresses mentioned on most pages (as proprietor/designer contact..webmaster@ etc.) as well as brute-force attacs on adresses as info@ and the like.

Just thought maybe somebody'd like to know...

[heini]

Well... just wanted to point out Voila is the provider for Wanadoo, which is a huge portal in France and one of the biggest european ISPs.
Voila itself is one of the best known web brands in France.
Don't mean to discard you charges but it somehow strikes me as unlikely.

[SEO practioner]

heini is right web joe

[wilderness]

which is a huge portal in France and one of the biggest european ISPs

In my ever-growing lists of "determined" pests?
APNIC,
BT of the UK, now resolved at least to my sites,
Wanadoo and France.

Of course I would have to place Level 3 in the US far above these three.
Just to be fair :-)

Don

[jrobbio]

You mean Level3 the ones that are related to a company that rhymes with Google from a company that denied it was their router?

[wilderness]

are related to a company that rhymes

I haven't a clue about ryhmes or their deceptions.
Level 3 is the backbone provider for many reoccurring pests.
Most recently the bunch from Colorado.

Level 3's only interest is in raising their bandwith.

Level 3 Communications, Inc. (NET-LEVEL5-CIDR) LEVEL5-CIDR
166.90.0.0 - 166.90.255.255
Level 3 Communications, Inc. (NET-LEVEL6-CIDR) LEVEL6-CIDR
209.0.0.0 - 209.0.255.255
Level 3 Communications, Inc. (NET-LEVEL7-CIDR) LEVEL7-CIDR
207.90.128.0 - 207.90.191.255
Level 3 Communications, Inc. (NET-LEVEL8-CIDR) LEVEL8-CIDR
206.15.0.0 - 206.15.31.255
Level 3 Communications, Inc. (NET-LEVEL9-CIDR) LEVEL9-CIDR
192.231.42.0 - 192.231.42.255
Level 3 Communications, Inc. (NETBLK-LC-ORG-ARIN) LC-ORG-ARIN 64.152.0.0 - 64.159.255.255
Level 3 Communications, Inc. (NETBLK-LEVEL3-CIDR) LEVEL3-CIDR 209.244.0.0 - 209.247.255.255
Level 3 Communications, Inc. (NETBLK-LEVEL4-CIDR) LEVEL4-CIDR 63.208.0.0 - 63.215.255.255
And More NetRange: 67.24.0.0 - 67.31.255.255
end

Be nice if webmasters could make their profit on "hits" ;)

[bull]

just wanted to point out Voila is the provider for Wanadoo

I'm not sure where you have this information from, recently saw an IP block (193.252.170.) owned by France Telecom, with a wanadoo abuse e-mail address given.

Well, if Voila is provider for wanadoo - another reason for me to block it ;)

jan

[WebJoe]

heini & SEO practioner: Have you read my subtitle? I am fully aware that Voila is a bot of a search engine/portal in France. I checked out their site after the bot first hit me and I read the two threads I mentioned in my first post.

Fact is: It didn't obey robots.txt, and I got spammed by them - that's all I'm saying.

I guess you'd have to be in France, Switzerland, Belgium, or Canada (being the french-speaking countries in the western hemisphere, sorry if I forgot someone) to get the abuse.

[edited by: WebJoe at 7:56 am (utc) on May 2, 2003]

[heini]

Webjoe, if you say the bot didn't obey robots, than that is so. The part that got me puzzled is you are saying it worked as email harvester (if I understand that right).

A SE bot occasionally not obeying robots, okay, has happened to better bots :). But a SE bot doing a side job as harvester?

[WebJoe]

@heini: I was puzzled too...maybe it's just a bad coincidence that the bot hit my site and within a week I got the spam. As I mentioned before, the recipeint of the spam could be brute-force spammed, but the source lokks very much like voila: The msg-header looks as if the message came from voila (I know that can be altered), the sender has a @voila.fr-address and it's an ad for a service voila seems to provide (I couldn't verify with the site).

Anyhow, it's two bad behaviors at once, and I thought somebody would like to know.

[Chris_R]

They would have to be the dumbest spammers in the world to do what is being suggested.

I can't say for SURE they didn't - just like I couldn't say for sure - that googlebot isn't serving up spam emails - just doesn't seem likely.

Sometimes coincidinces seem amazing - and in this case - I think thats what it is.

[WebJoe]

I've seen dumber stuff...but from all the responses I figured that I jumped a conclusion maybe too quick.

Changes nothing here though (svr-cfg-wise)

[Chris_R]

in the future you could pretty much prove something like it by putting the IP address in a fake email address trap bait - like

[e-mail]

it would be simple to do with SSI [so simple even I could do it], except for having people emailing you as to why they should email their IP address at your website...

Other than that...