Welcome to WebmasterWorld Guest from 18.104.22.168
Someone requested help locating the PicScout image copyright crawler and I've dug up some data and hope someone else can confirm this activity on other servers, especially if you have a lot of photos.
Since there was NO information on the net about them, no user agent, nothing, I started with their domain name and where it was hosted.
picscout.com has address 22.214.171.124
126.96.36.199.in-addr.arpa domain name pointer bzq-80-254-37.dcenter.bezeqint.net.
inetnum: 188.8.131.52 - 184.108.40.206
This led to a list of high volume crawling from these IP's in that range that was trapped by my bot blocker automatically and they never answered the challenges, so it was definitely bot traffic.
These IPs have only been spotted using the two following user agents:
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; (R1 1.1); .NET CLR 1.1.4322)
After posting that data on my blog, PicScout hit my site 5 times from this IP block:
inetnum: 220.127.116.11 - 18.104.22.168
status: ASSIGNED PA
source: RIPE # Filtered
Anything anyone can confirm on either range of IPs would be great.
22.214.171.124 - - [09/Aug/2006:02:48:21 -0400] "GET / HTTP/1.1" 200 29019 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; (R1 1.1); .NET CLR 1.1.4322)"
126.96.36.199 - - [09/Aug/2006:02:48:23 -0400] "GET / HTTP/1.1" 200 29019 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
188.8.131.52 - - [09/Aug/2006:02:48:24 -0400] "GET /logo.gif HTTP/1.1" 403 471 "-" "-"
Hopefully, someone with more traffic can contribute more/better info than I can.
malformed NT 5.1 UA
That one was blocked, they saw no pages, I used passive blocking so I can still track activity attempts. That was from 184.108.40.206 and I don't think that was them, but it was in the same general range so who knows.
Other than that one IP, I think it sounds like we're on the right trail.