Exabot-Thumbnails redux

[lucy24]

Couldn't find any thread newer than 2011, so let's bump the question. Is this a preview or something more sinister?

I found it recently in a blocked venue, and while trying to figure out why I blocked it, I found something a little odd.

Headers from most recent visit:

IP: 178.255.215.98
Connection: close
Cache-Control: max-age=259200
X-Forwarded-For: 10.83.ccc.158, unknown
Via: 1.1 ng255 (squid/3.4.9)
Host: www.example.com
Accept-Encoding: gzip
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)
Accept-Charset: utf-8;q=0.9,*;q=0.8
Accept-Language: en;q=0.9,*;q=0.8

The keen-eyed observer will figure out why they got blocked. But here's the odd part. See the X-Forwarded-For header? Google Preview sends that too; it's useful to know who's actually using the preview. But some cross-checking turns up:

2014-08-10:11:44:50
IP: 178.255.215.97
Accept-Language: en;q=0.9,*;q=0.8
Accept-Charset: utf-8;q=0.9,*;q=0.8
User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip
Host: example.org
Via: 1.1 ng257 (squid/3.4.3)
X-Forwarded-For: 10.83.ccc.159, unknown
Cache-Control: max-age=259200
Connection: close

Different sites, unrelated pages.

10.bb.cc.dd is a Private Use range. To me it absolutely passes credibility that two different requests, half a year apart, should originate from a near-identical IP. (Possibly more; I found a couple from 2011 but don't have those headers.)

I feel like I should be looking with suspicion on someone, I just can't figure out who(m).

[dstiles]

X-Forwarded-For should be HTTP_X_FORWARDED_FOR but I've noticed a few of the alternative field header name X_FORWARDED_FOR (without the HTTP) lately; but no hyphenated version. Of the alternatives, 127 and 10 ranges (and other "local" ranges) seem "normal", and they are not always accompanied by a Via but are sometimes paired with the correct version. So, it looks as if the X-Forwarded-For is a fake.

However... I would view your examples as exabot scanning through its own squid proxy from a machine whose IP within the exabot network is 10.83.ccc.159 and is apparently blocking the "real" user of the bot that shows as "unknown". It's possible squid has X-Forwarded-For as a value but can't say I've noticed it and would not expect it.

For what it's worth I have 178.255.215.0 - 178.255.215.255 (and only this exalead range) blocked.

[keyplyr]

I block the entire Dassault range:
178.255.208.0/21
178.255.208.0 - 178.255.215.255

FYI: exalead.com > 3ds.com (Web Mining)
Until they start paying me for my data, I'm not letting them have it :)