Forum Moderators: open
I've received a couple of hits from them. I've been watching them for a while because they intercept web traffic in a manner similar to phorm and nebuad, in this case subverting 404 responses.
If your site returns a 404 then ISPs that use this company respond by sending the visitor a page of affilliate junk. They are used by at least one UK ISP and some of its customers are ranting. There are also reports that they breach some web sites' T&C policies (they certainly breach mine). They also trigger firewalls on users' computers so are obviously interacting with the users.
I have so far trapped two IPs from the range below. I'm not sure what they are actually doing on the site. They couldn't be confirming a 404 because they hit a valid home page but I suppose they could be trying to assess what adverts to show on the substitute 404 page.
IP: 92.242.128.0 - 92.242.159.255
UA: blank, ditto all headers
Robots: no
Hit: single (home) page
Is the UA blank or is it, Bare Fruit?
The IPs that hit resolved to a block allocated to Bare Fruit, which I already knew about as a 404 redirector.
Thanks for the information on Barefruit. I put in a IP block for CIDR range 92.242.128.0/23 in my firewall(csf).
Thomas
