Visitor using Yahoo proxy. Why?

User Agent string remains the same.

[grandma genie]

Hi,
This is odd. I had a visitor come to the site and pretty much downloaded a whole directory that included a new section I added within the last few days. They came on with this log entry:

209.190.161.nnn - - [20/Mar/2011:10:05:58 -0400] "GET /ranchhouse/cattle.html HTTP/1.1" 200 8638 "h**p://www.google.com/search?q=ranch+cattle+cows&rls=com.microsoft:en-us:IE-SearchBox&ie=UTF-8&oe=UTF-8&sourceid=ie7&rlz=1I7GGLL_en" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={0080A079-5AD5-4c7e-9DC7-08B884C7BC95}; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

The odd part was then they changed to this:

66.196.119.nn - - [20/Mar/2011:10:11:45 -0400] "HEAD /osc/product_info.php?cPath=29 HTTP/1.1" 200 - "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={0080A079-5AD5-4c7e-9DC7-08B884C7BC95}; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

66.196.119.nn - - [20/Mar/2011:10:11:45 -0400] "GET /osc/product_info.php?cPath=29 HTTP/1.1" 200 39691 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SIMBAR={0080A079-5AD5-4c7e-9DC7-08B884C7BC95}; GTB6.6; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

That is a Yahoo Proxy IP. The User Agent is the same as the original IP. Looking at the same pages in the same order. Then the visitor went back to the 209.190.161.nnn entries.

What was the point of the proxy? Is this a scraper? It just didn't make sense to show up with a typical visiter's footprint, then jump to a proxy, then go back to the original IP. Any comments?

Grandma_genie

[incrediBILL]

Could be anything from a language translator to cache pages, sometimes they do real time updates, nothing I'd worry about for such a small sampling.

Yahoo has many proxies, it could be just about any service.

[wilderness]

Here's a solution for ya:

RewriteCond %{HTTP_USER_AGENT} GTB6 [OR]
RewriteCond %{HTTP_USER_AGENT} SIMBAR
RewriteCond %{REMOTE_ADDR} ^209\.190\.1(2[89]|[3-8][0-9]|9[01])\. [OR]
RewriteCond %{REMOTE_ADDR} ^66\.196\.(6[4-9]|[789][0-9]|1[01][0-9]|12[0-7])\.
RewriteRule .* - [F]

[wilderness]

nothing I'd worry about for such a small sampling

Generally speaking and without any corrective action initiated by a webmaster, these otherwise "small sampling's" are likely to transform into BIGGER windows on a future return visit.

Don

[wilderness]

Course you and some others would have been an exception as this first request would have been 403'd based upon your http-whitelist:

209.190.161.nnn - - [20/Mar/2011:10:05:58 -0400] "GET /ranchhouse/cattle.html HTTP/1.1" 200 8638 "h**p://www.google.com

[incrediBILL]

Generally speaking and without any corrective action initiated by a webmaster, these otherwise "small sampling's" are likely to transform into BIGGER windows on a future return visit.

I try to err on the side of site usability over paranoia these days because I've inadvertently locked out too many human used services by being too restrictive.

For instance, the translate tools are used by scrapers but also by individuals so now I look at the forward IP address for those services instead of the service IP itself and throttle abuse by individual forward IPs using the proxy, not just a blanket lock down of the proxy itself.

Besides, I have scripts in place that will automatically lock down anything that looks like abuse and sets a 24 hour timer before that resource can try again ;)

[grandma genie]

Hi Don, Thank you for the rewrite rule. I'll add it to my htaccess file.

Can I ask another question, this one about the latest Firefox visitor whose user agent included this odd addition to the string: PBSTB/1.2. I've never seen that one before. Do you know what PBSTB stands for?

[grandma genie]

I can understand someone coming in via a proxy, but why would someone come in as themselves then change to a proxy for just two log entries, then go back to their own IP, then change again to the proxy and back and forth. That's just weird.

[wilderness]

That's just weird.

gg,
This forum especially, however all the forums at Webmaster World have thrived because each webmaster must decide what is beneficial or detrimental to their own website (s), there's not any one-fits-all rule.

htaccess allows some of the same versatility, in that there are frequently multiple methods of accomplishing similar tasks.

[wilderness]

Do you know what PBSTB stands for?

I've not seen it previously.

a google if you separate some letters and enclose in quotes ("PB STB") , offers a reference to a OS Driver downloader, however that could be inaccurate.

It sure provides a good keyword to key-in on in UA's ;)

[Leosghost]

Toolbar of some sort..Firefox specific ..shows up a lot.

[wilderness]

Toolbar of some sort.

more pests!