Forum Moderators: open

Message Too Old, No Replies

Your Worst Nightmare

         

lucy24

6:13 pm on Jun 19, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



This is a human pretending to be a robot:
68.6.154.nnn - - [17/Jun/2016:16:48:43 -0700] "GET /robots.txt HTTP/1.1" 200 631 "-" "Your_Worst_Nightmare/1.0" 
68.6.154.nnn - - [17/Jun/2016:16:48:43 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:43 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:43 -0700] "GET /favicon.ico HTTP/1.1" 200 662 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:45 -0700] "GET /robots.txt HTTP/1.1" 200 631 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:46 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:47 -0700] "GET /robots.txt HTTP/1.1" 200 630 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:48:48 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:49:34 -0700] "GET /robots.txt HTTP/1.1" 200 631 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:49:34 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:49:40 -0700] "GET /robots.txt HTTP/1.1" 200 631 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:49:40 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET /dir/subdir/babpics HTTP/1.1" 301 603 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET /dir/subdir/babpics/ HTTP/1.1" 403 1808 "-" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET /sharedstyles.css HTTP/1.1" 200 2092 "http://example.com/ "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET http://example.com/" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET /images/banner-icon.png HTTP/1.1" 200 1804 "http://example.com/" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:13 -0700] "GET http://example.com/" "Your_Worst_Nightmare/1.0"
68.6.154.nnn - - [17/Jun/2016:16:50:14 -0700] "GET /favicon.ico HTTP/1.1" 200 661 "-" "Your_Worst_Nightmare/1.0"
... after which they got bored and reverted to visiting pages in ordinary human fashion while retaining the made-up UA. The 301-to-403 sequence represents a roboted-out directory that has no index page.

Har, har. Yuk, yuk. I bet you thought that was absolutely hilarious, but what you* may not appreciate is that the phony UA caused me to spend a good deal of time figuring out that this is not, in fact, a new robot that I need to look out for.


* Where "you" = the WebmasterWorld reader behind this exploit.

[edited by: keyplyr at 8:54 pm (utc) on Jun 19, 2016]
[edit reason] removed personal links [/edit]

wilderness

9:07 pm on Jun 19, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I've had problems with IP's from San Diego since the beginning of time.

lucy24

12:24 am on Jun 20, 2016 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



removed personal links

Well, ###, sorry, keyplyr, I could swear I went over that post three times to get rid of all personally identifiable details :)