odd referrs in logs

Is it good or bad? I think very bad...

[caspita]

Today I found many hits on mi logs for different pages on my website. All of them have in common the same IP, no domain, "Mozilla/4.0 (compatible; MSIE 5.00; Windows 98" user agent and "http://www.example.com/information.html" as the referal page. It looks like some kind of spider but I'm not sure, I was looking into this forum and trying to GG it but wasn't able to find out anything, of course if you visit the referal URL it takes you to a redirect page or so, I think then this is a kind of bad spider (are they stealing my content?).

I was wondering if somebody else has seen this spider or sometthing, the IP address is <snip> and it resolves to some place in China I think in the 'whois' db.

Should I block this IP only or some range?.. any advice would be highly apreciated.

Thanks!

CS.

[edited by: oilman at 8:48 pm (utc) on July 6, 2004]

[oilman]

sounds to me like you are being log spammed - are your log files accessible online to anyone that wants to see them maybe?

[bull]

Mozilla/4.0 (compatible; MSIE 5.00; Windows 98

[webmasterworld.com...]
Note the missing ")" in the User-agent string! So this one is a) easy to ban and b) easy to filter out of your stats.

[caspita]

Thanks bull!

I wasn't able to find out that post before, I suppose because the referal an IP was different for me, in my case it was :

IP : 211.157.8.42
referal : http;¦¦www dot advair-diskus dot biz¦information dot html

It haven't come back since that day but I'm keeping an eye on mi logs just in case it does.

Anyway looks like the same technique that the post you are refering.

Thanks again..
CS.