First Impressions of Deepnet Explorer

Aggghhhh!

[Angonasec]

I'd never heard of the thing until I saw what looked like a bot blitzing my site without checking robots, and so I immediately blocked the IP 24.69.255.203 using deny from in .htaccess. I've not checked if this is an official deepnet IP or just a hyperactive user of it.

That blocked it, but in response, it then tried to access my rss feed file once every minute for two days running! Thousands of error log entries. As if it was trying a DOS on our rss feed.
I was not impressed.

How to make enemies fast.

So I unblocked the IP and used mod_rewrite:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^Deepnet [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro [OR]
RewriteCond %{HTTP_USER_AGENT} ^CherryPicker [OR]
RewriteCond %{HTTP_USER_AGENT} ^NICErsPRO [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport*28 [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailCollector
RewriteRule ^.*$ bye.htm [L]

This served it a 500 error, and after a day it stopped calling every minute, only came every hour, then finally it gave up, after multiple thousands of hits.

Apparently, it's not a simple bot, but a free browser that punters use to download sites and share them like netster music files. It also has other bot like features that caused me the grief.

Be warned. Block it now, it'll be coming your way soon.

Unless you like the idea of people making it even easier to rip off your site.
Somebody ... please, put its creator in a strait-jacket pronto.

Ta!

PS. If there's a more efficient way of canning it, feel free to offer.

[MatthewHSE]

Where do you add that code you posted, .htaccess file?

[Angonasec]

Yes, but please be sure you understand it fully first.
The bye.htm file is just a bucket for junk bots.

Don't use this code unless you understand.

I'm really posting this thread to alert folks to the ravages of Deepnet Explorer