"Capture Extractor" Botnet Crawling Observed

[incrediBILL]

Had a rash of hits today similar to the ones targeting another page on my site, but now all aiming at the index page and they appear to be coming from corrupted machines best I can tell.

68.2.117.92,United States,"Capture Extractor",/index.html
50.83.184.99,United States,"Capture Extractor",/index.html
68.33.128.213,United States,"Capture Extractor",/index.html
76.110.181.211,United States,"Capture Extractor",/index.html
91.84.137.73,United Kingdom,"Capture Extractor",/index.html
50.138.43.240,United States,"Capture Extractor",/index.html
174.103.231.119,United States,"Capture Extractor",/index.html
99.43.200.48,United States,"Capture Extractor",/index.html
76.14.106.173,United States,"Capture Extractor",/index.html
173.76.71.124,United States,"Capture Extractor",/index.html

The amount of this kind of activity makes me wonder how many machines are truly involved, whether it's a botnet using random user agents or in this case simply the lead generation software by the same name as the user agent.

[wilderness]

In the event that your NOT use white-listing, the following should be black-listed UA's and will catch a fair share of harvesters.

capture, extract, download, gather, harvest, fetch, crawl, spider, copy and any other terms with similar definitions. (note; there may be a few obvious terms that I missed.)

FWIW, WebCapture is part of the UA used by most of the Adobe PDF tools for crawling a website.