Tiscali Communicator (scraper)

on SteepHost (Ukraine)

[not2easy]

UA:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; 
XMPP Tiscali Communicator v.10.0.2; .NET CLR 2.0.50727)"

_{(I put the line break in, there is a space after ".NET CLR 1.1.4322;")}

Chewed through 42 files (many off limits)in under 4 min. It is on SteepHost (Ukraine) at 91.207.4.0 - 91.207.9.255
I have blocked 91.207.8.0/24 (RIPE)

When I saw the beast's name I thought it was more from TalkTalk/Opal/Tiscali, but no. Tiscali is branching out?

[blend27]

I had that same range blocked since 05/11, with notes of "mad SQL Injections attemps & CSRF", comment spamming.

91.207.4.0 - 91.207.9.255 SteepHost-DC-UA
195.190.13.0 - 195.190.13.255 SteepHost-DC-UA

[dstiles]

I have the range 195.190.0.0 - 195.190.31.255 blocked as "various countries" all bad.

According to botsvsbrowsers dot com the UA goes back to at least 2007 on Apnic IPs. The term "Tiscali Communicator" (in quotes) on ixquick turns up mostly spam and botnet references.

Zytrax shows the UA with the explanation: "MSIE 6.x on XP SP1 with the tiscali IM plug-in".

In any case, MSIE 6 is obsolete and should never be used online so I'd say kill it.