Psycheclone

Anyone heard of this one?

[malachite]

Just had "Psycheclone" turn up this morning. Anyone ever heard of it? I haven't, never seen it before, and a search on Google returned absolutely nothing.

It visited robot.txt, then went through the whole site like a dose of salts.

The IP was 208.66.195.3, some US corporation.

Good/bad/indifferent? Should I ban it?

[wilderness]

resurfaced under same name a few hours after I posted Msg#3
[webmasterworld.com...]

Don

[malachite]

Thanks. On the banned list it goes ;)

[fusion5]

I orig. posted a similar msg. at abt. this, too.
Guess we got hit at pretty much the same time.
I had it coming from 208.66.195.10. It hit robots.txt, then went through all the main pages.

-W

[Pfui]

McColo Corporation. Again. Hardly a week goes by that something bad from WHOIS "MCCOLO" tries to slap us around. Like Don, I started blocking by IPs, but they have a ton. What are they, a gigantic server farm like Hurricane Electric?

208.66.195.11 - - [01/Jun/2006:09:36:43 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.11 - - [01/Jun/2006:09:37:05 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:53:38 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.9 - - [01/Jun/2006:11:54:00 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:22 -0700] "GET /robots.txt HTTP/1.1" 403 784 "-" "psycheclone"
208.66.195.5 - - [02/Jun/2006:09:08:44 -0700] "GET / HTTP/1.1" 403 784 "-" "psycheclone"

Clever name (if a bit cutesy). And clearly not programmed to know 403 means "Go AWAY."

[wilderness]

but they have a ton

Not all that many ;)
Most are confined to the D Class.

McColo Corporation HURRICANE-CE1548-0922 (NET-64-62-243-0-1) 64.62.243.0 - 64.62.243.63
McColo Corporation HURRICANE-CE1548-0925 (NET-64-71-133-128-1) 64.71.133.128 - 64.71.133.191
McColo Corporation MCCOLO (NET-208-66-192-0-1) 208.66.192.0 - 208.66.195.255
McColo Corporation HURRICANE-CE1548-0927 (NET-64-62-228-0-1) 64.62.228.0 - 64.62.228.255
McColo Corporation HURRICANE-CE1548-0922 (NET-64-71-159-192-1) 64.71.159.192 - 64.71.159.223
McColo Corporation HURRICANE-CE1548-0924 (NET-64-71-177-0-1) 64.71.177.0 - 64.71.177.127
McColo Corporation HURRICANE-CE1548-0923 (NET-64-71-167-0-1) 64.71.167.0 - 64.71.167.127
McColo Corporation HURRICANE-CE1548-0921 (NET-64-62-198-128-1) 64.62.198.128 - 64.62.198.191
McColo Corporation HURRICANE-CE1548-0926 (NET-65-19-154-0-1) 65.19.154.0 - 65.19.154.127
McColo Corporation HURRICANE-CE1548-0920 (NET-64-62-171-128-1) 64.62.171.128 - 64.62.171.255

[youfoundjake]

They hit every page on my site. Using ip address 208.66.195.8

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

Regardless, after the (not)post, i found the library thread about webmasters robots.txt file and promptly added it to my site, with the addition of the fore mentioned bots, but unfortunately, the psycheclone got everything, with a big bold 200 return code for every page.... sigh...

[wilderness]

On a side note, 2 nights ago i posted a new topic here titled snapbot and psycheclone checking to see if anyone else had heard of these, but it never showed up in the forums. Do i have to participate upto a certain number of posts before forums that are premoderated will look at my submissions?

ALL new threads are moderated and await Dan's approval.
On occassion if there are multiple submissions, he just passes one through (no need for duplication [or more]).

[youfoundjake]

okie dokie

[photoace]

whois: McColo Corporation
Digital Infinity LTD

Deeper search reveals Digtal Infinity headquarters location in Moscow.

Draw your own conclusions

[gford]

How does one ban, in linux/apache a specific crawler/scaper like this?

Only way I know is in httpd.conf add deny from. Is there an easier way? I have virtual hosting setup so going into each and every vhost httpd.conf file sounds awful painful.

[wilderness]

RewriteCond %{REMOTE_ADDR} ^208\.66\.(19[2-5])\. [OR]

Here's two links which may assist you:

[webmasterworld.com...]

[webmasterworld.com...]
continuation of thread:
[webmasterworld.com...]
[webmasterworld.com...]

Some tutorials
[baremetal.com...]
[evolt.org...]
[edginet.org...]
[dimi.uniud.it...]
[webhelpinghand.com...]
[javascriptkit.com...]
[serverwatch.com...]
[verio.com...]

[gmrthree]

I got hit by this bot too.
Why ban based on IP?
The host I use says that I can't ban based on IP, so should this work?:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} ^(psycheclone) [NC,OR]
RewriteRule ^.* - [F]
</IfModule>

[seoshare]

I just happen to see this psycheclone on my server, spidering web pages. Its from a Russian Company, having 15 IP's starting from 1 to 15.

Does any one know more about what is all this up to

[Pfui]

McCOLO again, but hitting a different site where I'd not blocked the heck out of its IPs and UAs --

208.66.195.2
psycheclone
06/24 13:06:47 /robots.txt
06/24 13:07:17 /

So much for the 'let them all see robots.txt even if they're Disallowed' theory. Oh, well!

[incrediBILL]

FYI, if you aren't blocking blank user agents, time to do it as this one has mutated.

Used to be:

208.66.195.4 "psycheclone"

Now is...

208.66.195.4 ""

Also, just block the whole range of 208.66.195.0/24 as I've tracked this on about 12 IPs so far in that block.

[larryhatch]

Hello again .htaccess fans. Got another one. User Agent is given simply as "psycheclone".

It sucks down most of my .html pages, never any images.
If you Google for psycheclone, you will find lots of us with the same questions.

About all that is known is:
It always uses the same set of DNS numbers A.B.C.* where A, B, and C are constant but D varies.
Those numbers trace back to Russia.

Lots of guesses out there, everything from email harvesting to you name it, nothing solid.

Several webmasters say they banned by DNS A.B.C.* with * a wild-card. I banned them by name for now.

Anybody here have a clue what its about? I'm just curious now, gonna pop a beer. -Larry

PS: A GOOD beer from Europe. No cheap sh**. It was hot in California today. Maybe more than one.

[GMax]

Hi everyone,
i'm also being plaged by psycheclone in a very short time i had 43 requests for 38 pages.
A few days ago it requested 51 pages in 1 hour (funny part is, my site only has 7 pages)
unfortunately i don't really understand how to block bots through the use of a htaccess file.
I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots"" i would very grateful.

GMax.

[wilderness]

I have been trying to make one but only to find that no one could go on the site (not even me)
If there is anyone that would be willing to show me how to make a htaccess file so i can block
the ""badbots""

GMax,
It's customary and beneficial if you both make some kind of effort at creating your own htaccess and then provide what you created seeking help.

The reason for your error (500) or denial to all (yourself included) is that you have a syntax error.

The Cpanel on your website access should have an option for making some additions to your active htaccess. (My host names it "IP Deny Manager".

Here are some helpful web pages

This site will create an htaccess based on IP:
[htaccesstools.com...]

The simplist tutorials
[edginet.org...]
[webhelpinghand.com...]
[javascriptkit.com...]

More complicated explanations
[evolt.org...]
[baremetal.com...]
[dimi.uniud.it...]

[GMax]

Thank you wilderness,
this will perhaps get me on the right track.
I hope that with the help of the links you gave i will be able to make a working htaccess file.

GMax.