Forum Moderators: open

Message Too Old, No Replies

cipherkey.net linked to a wide variety of bad bots

DFAgent/DivineFlowersExplorer, FinancialAnalysisAgent, LegalX Deep Analyzer

         

Pfui

5:28 pm on Dec 20, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This just in:

70.70.240.2*
Mozilla/5.0 (compatible; DFAgent/1.0; http://www.divineflowers.ca)

robots.txt? NO
Fake ref/log spam? YES, the UA's URL

Also similar UA:

zz2092059103*.cipherkey.net
Mozilla/5.0 (compatible; DivineFlowersExplorer/1.0; http://www.divineflowers.ca)

robots.txt? NO
Fake ref/log spam? YES, the UA's URL

Also exact same IP:

70.70.240.2*
Mozilla/5.0 (compatible; FinancialAnalysisAgent/1.0; http://www.ifsdb.com)

robots.txt? NO
Fake ref/log spam? YES, the UA's URL

Common denominator? cipherkey.net

For more about its many-named UAs, see: LegalX Deep Analyzer (née WideCircles Analysis Agent [webmasterworld.com]

KenB

9:15 pm on Dec 20, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Well, that is pretty spammy and as seems to always be the case with log spam they are coming from dynamic IP addresses, so it won't exactly be easy to block by those of us with more limited bot detecting abilities. :-(

Pfui

2:27 am on Dec 24, 2009 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



zz2092056517*.cipherkey.net
Mozilla/5.0 (compatible; SMAnalysisAgent/1.0; http://www.smhelper.com)

robots.txt? NO
Fake ref/log spam? YES, the UA's URL

FWIW:

That UA's name is not static. A day earlier, it appeared thusly via another Host, also no robots, also log-spamming:

Mozilla/5.0 (compatible; SMAgent/1.0; http://www.smhelper.com)

Pfui

10:13 pm on Jan 7, 2010 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



FYI: UA variation on a theme (was: LegalX Deep Analyzer yada-yada):

zz20920565171.cipherkey.net
Mozilla/5.0 (compatible; LegalContentAnalysisAgent/3.0; http://www.legalx.net)

robots.txt? NO
Fake ref/log spam? YES, the UA's URL

See also the following (more variations: HealthAnalysisAgent and...):

ParchedAnalysisAgent
(distributed HTTP access/referer spammer)
[webmasterworld.com...]

[edited by: Ocean10000 at 11:41 pm (utc) on Jan. 10, 2010]
[edit reason] Requested Fix by Pfui [/edit]