Bot coming from Everyones Internet

[Mokita]

IP is always - 67.15.119.**
UA is always - User-Agent: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
(Note the duplicated "User-Agent:")

First saw it in early March. From early April it has visited 7-8 times per month, always retrieving just the index page - no graphics etc.

I've banned the whole block of 67.15. (belonging to Everyones Internet) - even though this particular bot only ever comes from the one IP.

[edited by: volatilegx at 3:04 pm (utc) on June 21, 2006]
[edit reason] obscured IP address [/edit]

[GaryK]

I saw the same thing last week only without the duplicated "User-Agent:" in the user agent.

[wilderness]

You'll see many unidentified crawls from users at Everyone's net.

[GaryK]

Is this one of those hosts like HE?

[wilderness]

Is this one of those hosts like HE?

Basically, yes, however I have legitimate visitors from Everyone's as well. (something quite unusual at HE.)

[incrediBILL]

It's a part hosting farm, part ISP, but I've blocked everything coming from the hosting part so if it ends in ev1servers.net it's banned.

Just curious why the IP was obscured for a server, thought that was only for human IPs?

Not challenging the rules on IPs, just want to make sure I'm clear on them is all, as that user agent is definitely not a browser.

[wilderness]

Just curious why the IP was obscured for a server, thought that was only for human IPs?

Bill,
It's been customary to obscure IP ranges from providers that do NOT list sub-delgations to commercial companies in this forum.
Dan's the only one that can really address this issue.

The only sub-delegations that I have stored locally from Everyone's are the 64.246. ranges.
Although I haven't spent any real time searching for more.

Don

edited:

Go to ARIN and do a sub-delegation on 67.15 in the following way and without the quotes. (leave the blank space between the operator and 67

"> 67.15."

[incrediBILL]

If you have reverse DNS enabled in Apache, everything coming from their servers is clearly ID'd as ev1servers.net so that's been a fairly clean way to play whack-a-mole with them so far IMO.

[wilderness]

66.98.128.33 - - [11/Jun/2004:05:21:18 -0700] "GET /robots.txt HTTP/1.1" 206 2365 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

67.15.80.14 - - [25/Nov/2004:10:24:30 -0800] "GET /robots.txt HTTP/1.0" 200 2891 "-" "CreativeCommons/0.06-dev (Nutch; [nutch.org...] [e-mail])"