First Look - MaSagool spider

Some search engine called Sagool from Japan [translated] sent a spider caledl MaSagool that came crawling from 2 IP addresses. Didn't look for robots.txt or any other damn thing so probably a good idea just to block this thing until they teach it some manners.

59.158.235.21
[59x158x235x21.ap59.ftth.ucom.ne.jp.]
"MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"

124.32.246.45
[124x32x246x45.ap124.ftth.ucom.ne.jp.]
"MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"

Ace-Hole SEO Spamming Promotion Service

Today some bullshit artist that claims to be a SEO expert appears to have referrer spammed a bunch of their sites or sites they built on my server.

It's bottom feeding scumbags like this that gives SEO a bad name as this isn't SEO, this is just fucking SPAM by some idiot that hasn't got a clue that INTERNET PROMOTIONS is not synonymous with the PISSING PEOPLE OFF you fucking moron.

Here's the referral spams for your viewing pleasure:

86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"

All of the crap above is linked back to Ace SEO in one way or another.

• At the bottom of hypnospot.co.uk it says it was designed by "Ace SEO Web Site Design and Promotion".
• The bottom of tradercurrencies.com also says designed by "Ace SEO Web Site Design and Promotion"and it's registered to "Ace Web Masters" so these idiots own it.
• Both thelistandsell.com and 123hyperlinks.com have AdSense that claims " Advertise on www.ace-search-engine-optimization.co.uk" and are also registered to "Ace Web Masters".

It's real simple, if you don't want your dirty laundry spread all over the internet then keep it off my fucking server so take your spamming SEO bullshit and shove it up your AceHole.

DUMBASS Scanned Your Page!

This DumbAss using the user agent "Badass scanned your page!" was on my server a whopping 30 seconds and appears to have been asking for the index page over and over, then hit my spider trap right away, invoked a speedtrap for running too fast and then got page after page of captcha's it never answered.

06/23/2006 SPIDERTEST 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"

The IP resolves to some server with some adult crud on it by some dipshits in Denmark.

Block this and sleep better at nights:

inetnum: 84.246.245.32 - 84.246.245.63
netname: rackserv-cust-hipergroup
descr: Hipergroup mediahouse

Buh Bye Bad... er DumbAss

The Boyz From Brazil Want to Crack Your Site

The XML-RPC exploit for PHP must be very popular in Latin America as these Brazilian IPs just don't fucking give up trying.

02/27/2006 20:45:58 201.0.61.144 "" "//xmlrpc.php"
04/20/2006 00:45:23 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 01:40:39 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 01:40:39 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 20:31:07 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 22:52:14 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 23:26:11 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 23:53:55 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 13:26:20 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 13:49:21 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 17:21:46 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:21:59 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:45:47 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:45:47 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 20:39:46 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 21:28:56 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 19:51:31 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 22:13:01 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 23:09:54 201.6.7.70 "" "/xmlrpc.php"
04/25/2006 01:47:17 201.6.7.70 "" "/xmlrpc.php"
07/02/2006 13:11:21 201.1.141.75 "" "/xmlrpc.php"

If you haven't upgraded your XMLRPC file yet, you better get it quick before these fuckers nail your server.