open proxies

major providers

[wilderness]

I've a couple of pages that attract these creatures.
The page requests are generally from a dozen or more IP's across different continents and the requests are consecutive. The UA's are generally non-standard and get caught by one thing or another.

Recently, I began seeing a handful of consecutive page requests (with muliple open proxies), where the URI is the page URL and the UA ends with SV1 (however that UA could change at any time).

Does anybody have an established procedure for dealing with these open proxies, when they only make a handful of page requests on each visit?

[dstiles]

Depends on the UA / Header / OS combination. I have several SV1 UAs that auto-block the IP on first hit if the headers are weird, otherwise log them for later analysis. Since many of the hits are from domestic ranges I tag the IP hits for release a few months after logging, assuming they are trojan'd machines that may recover.

[blend27]

I have setup several fake blogs/forums just to deal with this issue. a spam data collection honeypots. by the time the, via Proxy, munchkin gets to the main sites the IP has been logged on else where.