baidu

[wilderness]

the following quite interesting.
No Clue what their up.

The "HiddenFolder" folder was a directory created by my host at one time or another for specific need and I (nor the host), simply never removed it.
There were NEVER (NEVER!) any http links to this folder.
My service with this host and for this particular site ended a few hours ago, although the DNS was moved about ten days ago.
Most of these other folders have never existed.

220.181.38.* - - [01/Apr/2008:03:03:06 +0100] "GET /entropybanner/ HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:04:42 +0100] "GET /?N=D HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:05:30 +0100] "GET /scgi-bin/ HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:06:08 +0100] "GET /?S=A HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:06:57 +0100] "GET /Mysite-www HTTP/1.1" 403 1100 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:07:32 +0100] "GET /?D=A HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:08:12 +0100] "GET /HiddenFolder/ HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
220.181.38.* - - [01/Apr/2008:03:09:06 +0100] "GET /?M=A HTTP/1.1" 403 1114 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"

In closing, these requests send extreme flags to myself regarding the unworthiness of this bot in particular.

Their requests all for not anyway.
The entire 220 Class A is denied from my sites and any UA that includes "spider" as well.

[edited by: incrediBILL at 6:51 am (utc) on April 1, 2008]
[edit reason] Obscured IPs [/edit]

[incrediBILL]

I see similar things from other search engines and they may just be probing your site to see if you're infected or vulnerable to becoming infected. The other alternative is some other site is posting bad links to your site which Baidu is following, see that all the time with the big SEs.

[wilderness]

I've found at what this where and as a result of Slurp making similar requests.

However I's still puzzled as to why they are shown in the logs in this manner.

To confuse matters even more, in my initial example both the bot and the IP are denied and result with 403's.

Slurp on the hand resulted in 200's which caught my attention.

This a site I changed hosting on.
The old host had an "options" in place (even allowed directory options in htaccess) which prevented viewing of empty directory contents. This new host has neither, requiring the addition of blank index.html.

Sure hope these folder contents don't show up in SE's.

[Bewenched]

here's another baidu range 61.135.166.***