OutclicksBot

new UA, new range

[keyplyr]

UA: OutclicksBot/1 +https://www.outclicks.net/
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Protocol: HTTP/1.1
Robots.txt: No
Host: Rackspace Cloud Servers
104.130.0.0 - 104.130.255.255
104.130.0.0/16

Note: Crawl session appended to the end of UA (e.g. OutclicksBot/1 +https://www.outclicks.net/agent******)

VigLink instantly modifies your links so you earn money.

source: viglink.com

[keyplyr]

UA: OutclicksBot/1 +https://www.outclicks.net/agent/******
Protocol: HTTP/1.1
Robots.txt: No
Host: Rackspace Cloud Servers
23.253.96.0 - 23.253.111.255
23.253.96.0/20

[keyplyr]

UA: OutclicksBot/2 +https://www.outclicks.net/agent/****
Protocol: HTTP/1.1
Robots.txt: No
Host: Rackspace Cloud Servers
166.78.46.0 - 166.78.47.255
166.78.46.0/23

[lucy24]

Crawl session appended to the end of UA

Does it change on repeat visits? I only find it on one day so far, with requests less than ¼ hour apart, which must not count as separate sessions, as it's the same enormous string in both places.

:: detour to Base 64 decoder ::

Darn. I was hoping it would spell out something interesting.

[keyplyr]

[Crawl session] Does it change on repeat visits?

I assume. I haven't kept track :)

However, this seems like a very nasty hijacking of site links. Who's getting paid?

[lucy24]

Yes, the “so you earn money” line seems more plausible if you read if as “so we earn money”.

[keyplyr]

New UA, new IP range...

UA: OutclicksBot/4
Protocol: HTTP/1.1
Robots.txt: No
Host: digitalocean.com
142.93.0.0 - 142.93.255.255
142.93.0.0/16

[lucy24]

:: detour to raw logs ::

I find a couple of /4 way back in June (blocked, out of sight out of mind) from two entirely different IPs--23.253.blahblah and 166.78.blahblah--but, interestingly, the identical long garbage in the UA string although many days apart. Still more interestingly, I also find the identical garbage attached to a couple of /2 visits in April. In fact there are only three different garbage strings across 15 requests spanning April and June. Next time I pull logs I'll see if they have come up with anything new in the last few days.

Wonder what they did with version /3?

[tangor]

Isn't this all old news?

Then again, I suppose we need to stay on top of things.

[keyplyr]

Per forum charter* [webmasterworld.com] our mission is to document User Agents and Spiders. This involves updating when the UA changes name or IP range.

Some members and those reading this forum who may not be members (yet) use this information in the operation of their web interests, so updating out of date information can be essential to that end.

*The charter for this forum is located at the top tool menu.

[keyplyr]

New IP range...

UA: OutclicksBot/4
Protocol: HTTP/1.1
Robots.txt: No
Host: digitalocean.com
159.203.0.0 - 159.203.255.255
159.203.0.0/16

So to answer the above question about the appended session parameter, yes it has changed each time I've seen it. And subsequent requests do not include the parameter at all.

1st request: OutclicksBot/4 +https://www.outclicks.net/agent/__session_parameter_here_

Other requests: OutclicksBot/4 +https://www.outclicks.net/agent/

- also -

Some include my site in a referrer:
https://www.outclicks.net/sites/kkrq3v/example.com

and other requests carry no referrer at all, with no apparent reason.

[keyplyr]

Also coming from...
Host: digitalocean.com
104.248.0.0 - 104.248.255.255
104.248.0.0/16