Welcome to WebmasterWorld Guest from 54.162.57.225

Forum Moderators: Ocean10000 & incrediBILL & keyplyr

Message Too Old, No Replies

Iptcbot

     
3:26 am on Nov 2, 2011 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member jab_creations is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 26, 2004
posts: 3150
votes: 12


User Agent: Mozilla/5.0 (compatible; IPTCBOT;
IP Address: 82.165.37.69
Host: 1.onlinehome-server.info

This bot first arrived at my site on Fri Aug 5th, 2011 at 09:04PM. It is sending referrers most of which look spammy though the last few link to valerie-bistro.de/robot.html?=example.com (my domain instead).

Doing a search for "IPTCBOT" (without quotes) a Twitter account comes up with the following description...

Unofficial bot that publishes things that might be about the IPTC, by @smyles


That account doesn't seem related to the main page linked in the referrer. It's been rejected by my site and will continue to however I am curious if anyone could find something a bit more solid on this?

- John
10:22 am on Nov 2, 2011 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:May 24, 2002
posts:894
votes: 0


If have seen it a few times but I have no better idea of what it's about than you do.
They seem to have changed their UA lately. Sunday it dropped by in the same way you described with my site name as example.com, before that they used :

Mozilla/5.0 (compatible; IPTCBOT; SessionID=; favoriteColor= http://example.blogspot.com//

where the URL part varied and, I guess because of how the UA is formatted, the URL showed as the referrer.
12:06 pm on Nov 2, 2011 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Nov 5, 2005
posts: 2038
votes: 1


Confirming the OP's Host/IP and bot, on Aug. 8th:

s15525901.onlinehome-server.info
Mozilla/5.0 (compatible; IPTCBOT;

robots.txt? NO
Fake REF? Yes

IP = 82.165.37.69 [projecthoneypot.org...]

The IP is block-worthy given the constellation of UAs indicated in that PHP data:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
Mozilla/5.0 (compatible; IPTCBOT;
Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10)

In addition, here's another, 'newer' variation of the OP's UA from the exact same IP, on Oct. 5th. Note that IPTCBOT is now robot.html:

s15525901.onlinehome-server.info
Mozilla/5.0 (compatible; robot.html;

robots.txt? NO
Fake REF? Yes

FWIW: onlinehome-server.info [robtex.com...] has been a source of trouble for a long time. [google.com...]
12:46 pm on Nov 2, 2011 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:May 24, 2002
posts:894
votes: 0


onlinehome-server.info is hosted on :
inetnum: 212.227.134.0 - 212.227.143.255
netname: SCHLUND-CUSTOMERS
descr: 1&1 Internet AG
country: DE

82.165.37.69 is hosted on :
inetnum: 82.165.32.0 - 82.165.47.255
netname: SCHLUND-CUSTOMERS
descr: 1&1 Internet AG
country: DE

SCHLUND has been host to many unsavouries for many years. Usually, when I see a bot come from there (with whatever UA) its range gets blocked. The whole is pretty much the same environment as the likes of SoftLayer, etc.
9:39 pm on Nov 2, 2011 (gmt 0)

Senior Member from GB 

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member Top Contributors Of The Month

joined:May 14, 2008
posts:3101
votes: 3


The whole 1&1 / Schlund server network is blockworthy out of hand.