siteintel.net

Bot-running bad Opera

[Pfui]

siteintel.net
= 213.133.111.12 [projecthoneypot.org...]
= static.213-133-111-12.clients.your-server.de

Asks for robots.txt, then ignores:

15:55:37 /robots.txt (200)
15:55:38 / (403)

UA is coded in quotes (das ist dumm) --

"Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"

-- so raw log entries look like:

""Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10""

Germany-based Hetzner [google.com...] and/or your-server.de have been big havens for bad eggs for ages.

[Pfui]

Weekly routine now; siteintel.net gets, and ignores, robots.txt:

00:58:14 /robots.txt (200)
00:58:15 / (302 to...)
00:58:22 /botbait/ (200)

"Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"

[dstiles]

213.133.96/19 is hetzner - once found, permanently blocked.

[Pfui]

So much for changing for the better...

The UA's now bot-runner specific but it's still double-double-quoted-quoted, and still ignores robots.txt:

04:45:59 /robots.txt (200)
04:46:01 / (302 to)
04:46:02 /botbait (200)

UA: "http://SiteIntel.net Bot"
(Raw log: ""http://SiteIntel.net Bot"")

Time to simply 403 this unintelligent thing.

[lucy24]

Time to simply 403 this unintelligent thing.

Hah! And here I thought I was the only one with the "Too stupid to live" category of 403 ;)

[Pfui]

Actually, I reserve 127.0.0.1 for "Too stupid to live."

(Muaha-ha)

[Pfui]

UA 'corrected' by bot-runner --

static.106.51.9.176.clients.your-server.de [projecthoneypot.org...]
httpl://SiteIntel.net Bot

-- but still asks for robots.txt, then ignores:

01:50:48 /robots.txt (200)
01:50:49 / (302 to...)
01:50:51 /botbait/ (200)

IP = 176.9.51.106 = Hetzner [robtex.com...]

[keyplyr]

Nov 14

176.9.51.106
http://SiteIntel.net Bot

Blocked since it's from hetzner/your-server.de