63.80.38.10

[bobriggs]

63.80.38.10

First hit: 3:45 pm CDT this afternoon with a UA of Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0), AND sent a referer URL. Took 2 more pages with that UA.

3:50 pm. Switched to Mozilla/3.01 (compatible;). Has continued (last hit at 8:27 pm) (so far 48 pages)

I get Virgin Islands Telecommunications on a whois (no host lookup) - So it looks like a user on an ISP.

However, the Mozilla/3.01 is exhibiting behavior similar to a spider. Anyone seen anything like this before?

[added]
I just checked the pages it is looking at. The original (UA) got to a page and looked at 2 others. The 'spider' is looking at only these three pages - No graphics, external CSS, etc.

[littleman]

[63.80.38.10...]
It is a proxy on port 80. So, someone is probably using it to mask his identity.

[bobriggs]

Thanks. I banned the ip last night after making this post.

It got 3 403 errors and didn't make any more requests. I have lifted the ban and will watch for it again.

This seems like some kind of bot that is checking for changes on the page - the pages have prices on them, I suspect that if a change is detected, the user is notified.

BTW, how can you tell that this is a proxy server?

[littleman]

I requested the IP on port 80 through another proxy which gave a 'Problem Report' splash.