Yahoo in stealth mode?

[bobothecat]

66.228.165.156 - - [03/Nov/2005:13:06:55 -0600] "GET /robots.txt HTTP/1.0" 200 4614 "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)"

Then proceeded to grab one html file... URL resolves to ngorongoro.yst.corp.yahoo.com

[bobothecat]

Just to update on this 'bot' ... it's been coming back requesting robots.txt and the same file every 1-2 hours.

Hmm...

[jdMorgan]

Pretty dumb spidering/checking with an invalid User-agent... I guess they figure nobody ever checks these things.

C'mon Y-guys, it's "Windows NT <major version number dot minor version number>" for WinNT, Win2000, or WinXP -- at least if you want in at my door.

ARIN says this block is assigned to "Overture Services (formerly Goto.com)"

Ngorongoro is a major wildlife preserve in Tanzania.

Jim

[fiestagirl]

Interesting, Now that I check I see that this has been going on since May.

IPs 66.228.164.* and 66.228.165.*

UA: mozilla/4.5 [en] (win98; i) and mozilla/4.0 (compatible; msie 5.0; windows nt)

mozilla/4.5 [en] (win98; i) - does not ask for robots.txt

mozilla/4.0 (compatible; msie 5.0; windows nt) - does ask for robots.txt

[wilderness]

interesting fiesta.

My logs are archived in a ZIP for each year.
I keep the previous month and the current month open for access.

from the 66.228.164.#*$! I have two checks last month and one thus far this month.
All checking the same 301-redirect, and using a valid Yahoo UA.

Just once last month I had the following (from a differnt Class D than the aforementioned):

66.228.164.xxx - - [30/Oct/2005:08:31:09 -0800] "GET /robots.txt HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)"
66.228.164.140 - - [30/Oct/2005:08:31:09 -0800] "GET /myfolder/mypage.html HTTP/1.0" 403 - "-" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)"

This was 403'd off the invalid NT.

Don