Welcome to WebmasterWorld Guest from 54.147.44.13

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

someone spoofing?

these are some wierd UAs

     
8:15 am on Mar 29, 2007 (gmt 0)

Preferred Member

10+ Year Member

joined:May 14, 2003
posts:376
votes: 0


has anyone seen anything like these?


85.255.117.xyz [17/Mar/2007:23:18:20 -0400] "# UA \"Googlebot/Test (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:29:52 -0400] "# Google"
85.255.117.xyz [17/Mar/2007:23:29:53 -0400] "# UA \"Googlebot-Image/1.0\""
85.255.117.xyz [17/Mar/2007:23:29:57 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:23 -0400] "# UA \"Mediapartners-Google/2.1\""
85.255.117.xyz [17/Mar/2007:23:30:28 -0400] "# UA \"Googlebot/2.1 (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:30 -0400] "# Google"
85.255.117.xyz [17/Mar/2007:23:30:30 -0400] "# UA \"Googlebot/Test (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:31 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:32 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:50 -0400] "# UA \"Googlebot/2.1 (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:51 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:53 -0400] "# UA \"Mediapartners-Google/2.1\""

yeah, they're not the full log line... just the IP, time/date and the UA... the thing that triggered my alarms was the timestamps and the quick UA changes... i seem to remember something similar several years back when i used to frequent these forums...

oh yeah, hello to all those who may remember me ;)

8:29 pm on Mar 29, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 22, 2001
posts:2450
votes: 0


Yes, a spoofer. I've seen this guy before.
10:27 pm on Mar 29, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 11, 2001
posts:5408
votes: 2


six UA changes DEMANDS denial ;)
10:55 pm on Apr 8, 2007 (gmt 0)

Administrator from US 

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Jan 25, 2005
posts:14622
votes: 85


That IP is for Inhoster hosting company and there's a LOT of problems there, you're just looking and the tip of that iceberg. Look up all their ranges and ban them and then watch how much junk shows up in your logs that's being bounced.

Most likely you will be nothing short of amazed.

[edited by: incrediBILL at 10:56 pm (utc) on April 8, 2007]

2:11 am on Apr 9, 2007 (gmt 0)

New User

5+ Year Member

joined:Jan 28, 2007
posts:30
votes: 0


That IP is for Inhoster hosting company

Is a list or source of hosting companies available somewhere? For our web site there would never be any need for anyone to access it other than a human sitting at his computer, so I'd like to just ban all these guys. (Or is that a bad idea ...?)