Wednesday, June 28, 2006

Why Block Proxy Sites

People ask why I block anonymous proxy servers and here's a prime example coming from our friends at ThePlanet.

Not only is someone using Firefox from this location but it appears they're cloaking information to get Google to crawl through the proxy as well which can result in hijacked pages.

06/23/2006 70.87.42.250 "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

06/25/2006 70.87.42.250 "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

06/25/2006 70.87.42.250 "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4"

06/27/2006 70.87.42.250 "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

06/28/2006 70.87.42.250 "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4"
That, in a nutshell, is why I block proxy servers.

First Look - Retrieve_Title

It's hit my site twice now asking for a whopping 1 page each time, and I can't seem to find out anything else about it except it seems to be coming from Florida using a service called Neosmart.

65.124.200.76 "Retrieve_Title"
Doesn't seem to be a big threat, as the name of the bot implies it might be an automated link checker or something, but we've got our eye on it just the same.

Any information on this one is kindly appreciated.

Tuesday, June 27, 2006

First Look - Pussycat from India

No clue what this critter is up to as it only attempted 2 page requests and went away.

202.65.156.23 "PussyCat 1.0, Murzillo compatible"
Anyone else spotted this "Murzillo" compatible cat?

Update -

Definitely a spammer as it's trying to hit my submit page but the idiot is using a GET instead of a POST so it would always be rejected, not to mention I don't allow his user agent to get onto the site in the first place.

This slimeball tried to hit again from a new location and this time I noticed it's coming via a proxy server:
200.36.112.92 "PussyCat 1.0, Murzillo compatible"
Forwarded IP -> 85.255.117.218
So I looked up the original hit and it was also via proxy server:
202.65.156.23 "PussyCat 1.0, Murzillo compatible"
Forwarded IP -> 69.50.175.91
Looks like the spammer is trying to cover his tracks routing thru various proxy servers but he's stupid and keeps using the same user agent which is so easily blocked.

Nobody claimed spammers were smart and this one just proves it.

SPAM!TunnelPro

Don't know what this is all about, but it smells like spam of some sort.

Y!TunnelPro is a plug-in for Yahoo Instant Messenger but this morning it showed up as a user agent from 3 different networks in 18 seconds. Never saw it before, ever, and it hasn't come back since.

07:49:00 69.223.60.254 "Y!TunnelPro"
07:49:04 208.246.86.5 "Y!TunnelPro"
07:49:17 58.87.7.242 "Y!TunnelPro"
Your guess is as good as mine, anyone else see this garbage?

Sunday, June 25, 2006

SCRAPER BUSTED #4 - Snoopy Porn Spammer

Here's another scraper that's very prolific that can no longer hide:

69.50.190.242 "Snoopy v1.2"
The IP address of the scraping comes from the US:
OrgName: InterCage, Inc.
OrgID: INTER-359
Address: 1955 Monument Blvd.
Address: #236
City: Concord
StateProv: CA
PostalCode: 94520
Country: US

NetRange: 69.50.160.0 - 69.50.191.255
CIDR: 69.50.160.0/19
NetName: INTERCAGE-NETWORK-GROUP
NetHandle: NET-69-50-160-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: MAIL.ATRIVO.COM
NameServer: PAVEL.ATRIVO.COM
Comment:
RegDate: 2003-06-04
Updated: 2005-09-01
All of the sites are in the Ukraine, go figure.

The scrapings are cloaked and now they use NOARCHIVE after getting whacked in Google not too long ago .

I wonder who reported them for cloaking, hmmmm....

UPDATE:

I unlinked the old Google searches as they are obsolete.

So far in 2008 I only see Snoopy here:
66.128.60.81 "Snoopy v0.94"

Dominet.net DOMINET (NET-66-128-60-0-1)
66.128.60.0 - 66.128.60.255

SCRAPER BUSTED #3 - London Scrapings on Latvian Websites

Some subdomain on a Latvian website eclub.lv finally coughed up an IP address so I could link the scraping with the scraper. The IP address that did the scraping was 80.77.80.103 with a blank user agent that appears to come from the UK.

I can't really tell what eclub.lv actually is since I can't read it, and it has a TON of subdomains, but a few of those are definitely occupied by a scraper in louisiana-map.eclub.lv. This is an oddball scraper as all the pages are cloaked and redirect elsewhere so it's more difficult to get information about this one but not impossible.

Problem is, I'm not that bored to dig further, busted, blocked, banned, bye bye.

Webzone uses c-spider.bot

Finally tracked down the c-spider.bot to it's spammy search engine owner called WebZone.

87.230.5.195 "c-spider.bot"
address is vps43.ehost.pl
Whois says:
Domain Name: ezo9.com
Domain servers in listed order:
ns1.ehost.pl ns2.ehost.pl
Ties the scraper/crawler to the same hosting company, good enough for me.
The AdSense account on this scraper, um, search engine links to www.modaifryzury.org.

Time to block c-spider.bot, e-host.pl, blah.

SCRAPER BUSTED #2 - sunshineholidayrental

Tracked another scraping bastard that uses a blank user agent from the IP address of 72.29.92.126 which appears to be a Lithuanian scraper/spammer with a dedicated server at HostDime.com.

Here's a few of this assholes active sites:

4-dates.net
4-recycling.net
4-vehicle.com
4teenagers.net
5-phones.com
5-stuff.com
asilelis.com
chmokas.com
klase.net
snookeris.com
snukeris.com
zaislai.net
zineryt.net
Some of them may look almost legit at first glance but trust me, there are tons of keyword and phrase stuffed bullshit pages hiding behind those seemingly innocent facades.

All the AdSense accounts claim to be owned by sunshineholidayrental.com which currently seems to be a Joomla default site.

Blocked HostDime a while back, looks like it was a good idea.

Brinkster is hosting referral spammer or is the spammer

This javascript referral spam keeps showing up in my logs and the fact that several of these were for Brinkster themselves I figured they had something to do with this.

03/14/2006 65.182.100.121 "<script>window.open('http://buy4cheap.brinkster.net/buy2/side-search.htm')</script>"

04/29/2006 65.182.100.126 "<script>window.open('http://buy4cheap.brinkster.net/buy2/side-search.htm')</script>"

05/16/2006 65.182.100.121 "<script>window.open('http://buy4cheap.brinkster.net/buy2/side-search.htm')</script>"

06/25/2006 65.182.100.121 "<script>window.open('http://i.cannot.undo.it')</script>"
It's obvious these idiots wanted publicity and now they have it, and it's not good publicity.

Trying to get people to buy hosting by breaking a webstats page to auto-redirect is pretty foul.

Saturday, June 24, 2006

SCRAPER BUSTED #1 - Vipse Corporation using InetURL

Well, perhaps it's not cool to out people but it's also not cool to try to steal my shit, scramble my stuff with other people's stuff so it looks like it's a paragraph written by a drunken monkey, slap AdSense on it and THEN have the balls to attribute that gibberish source as being my domain name.

So fuck it, here we go...

Mind you the only real data they have was before I put the bot blocker online so as they are either expanding or updating, the bot blocker is replacing what they have with my errors.

It actually took me a while to bust this scraper because his code kept chopping up the data I was feeding them so it took a while to find a page with the scrapers IP but finally I was able locate who they were and review their activity in my scraoer archive.

This scraper's IP shows scraping from Italy:

213.203.184.30 "InetURL/1.0"
The scrapings from that IP address ended up on loghinuovi.net, 9-shopping.us, and some other places as this appears to be a full blown scrape and spam operation.

According to whois, this is our scraper:
Vipse Corporation
Ryan's Place
High Street
St Johns, Antigua WI PO Box 744
AG
A little bit of research shows this scraper has a ton of crap sites:

They are mostly NonSense™ sites (that's what I call gibberish AdSense sites) like cellulari.us, loghi.us, loghi-suonerie.us, suonerie.us, suonerie-loghi.us, and anzwers.us for a short list, some may not even work anymore but they have buried landing pages with black on black text and all sorts of NonSense.

After hunting around it appears the root AdSense account, according to "advertise on this site" from cellulari.us is all tied to www.categorico.com.

Doing a little more research, a whois on cartegorico.com shows this owner:
whois categorico.com

Noago Srl
Via Vittorio Veneto 25
Borgomanero, Italy Novara 28021
IT
Which explains the original scraping IP from Italy.

TA DA!

You can scrape me but you cannot hide.

Update...

The following aroma from Roma dropped in and translated this page:
Referring Link http://www.google.com/search?sourceid=navclient&ie=UTF-8&rls=GGLG,GGLG:2006-23,GGLG:en&q=noago srl
Host Name host229-2.pool8250.interbusiness.it
IP Address 82.50.2.229
Country Italy
Region Piemonte
City Novara
Coincidence?

I think not...

Friday, June 23, 2006

Be trendy and ameliorate your blog!

Not to be bragging, but my vocabulary is pretty extensive, but I had to take pause today at a link request email from someone trying to "ameliorate our google positioning".

OK, in context it was obvious what the word meant but I'm scratching my head going "who the fuck uses that word?" as I read a lot and can't remember actually seeing that word in print.

For those of you that still haven't figured it out, ameliorate means improve, so perhaps the author of this email was trying to ameliorate my vocabulary, or just use it to catch my attention.

Heck, if it was just an attention grabbing ploy it sure as hell worked.

This could be a great word to start using in marketing:

Ameliorate, the new and improved word for improve!

I can see it now:

"NEW ULTRA TIDE! It's ameliorated!"


People seeing that on a box of Tide in the store would buy the fuck out of it just because it sounds like a technical chemical type word and they won't admit they dont know what the word means. They will just have to have it because god knows, if you wash your clothes with anything else it wouldn't be ameliorated now would it?

What a concept, let's start an ameliorated trend today!

Tuesday, June 20, 2006

Crawlers with Toolbars?

If you believe this user agent that came from China, the crawler has the Alex Toolbar installed.

211.100.25.206 "Crawler Mozilla/4.0( compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; Alexa Toolbar)"
I'll assume everything after the word Crawler was just stuck in the user agent with hopes to get past the filters but ironically enough, the word Crawler is what set off the traps in the first place.

Now let's have a loud "NEENER NEENER!" for whoever pulled that boner.

New Nutch from Germany

These Nutch things are like Energizer bunnies, they just keep coming and coming and coming...

87.139.106.60 "NutchCVS/0.8-dev (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"
It's like a bad zombie movie that never stops with all their arms outstretched as they all try to get you, one page at a time...

Monday, June 19, 2006

Yahoo Research

Caught this unidentified beast belonging to Yahoo trying to access pages 4 different days:

209.73.174.15
research5.corp.scd.yahoo.com
"Wget/1.9+cvs-stable (Red Hat modified)"
Don't know what they were doing but it didn't work, they didnt get what they wanted ;)

Sunday, June 18, 2006

RedKernel is Backasswards

This isn't a new bot but what they did made me laugh out loud:

66.55.143.162 - "GET / HTTP/1.1" RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"
66.55.143.162 - "GET /robots.txt HTTP/1.1" "RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"
66.55.143.162 - "GET / HTTP/1.1" "RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"
66.55.143.162 - "GET /robots.txt HTTP/1.1" "RedKernel WWW-Spider 2/0 (+http://www-spider.redkernel-softwares.com/)"
That's right, they asked for the home page and then robots.txt, in reverse order, twice in a row.

Why would you ask for the home page and they check to see if my site permits your bot to crawl?

Do you think you're just entitled to the home page regardless?

How bizarre as their website doesn't even mention robots.txt:
REMOVE a website from our link directory:

Our www-spider (= a bot like googlebot) is an automated crawler/indexer.
So it works with meta names like all other bots.

You just have to insert in your meta names: (only in your index)
<meta name="RK_WWW_Spider" content="noindex">

Then just wait the next crawl of your website. The meta name will be detected and your site will not be indexed. It can takes few months before your site is crawled.
Meta tags?

What a joke, say it boys and girls "block! block! block!", now isn't that better?

Can't see the Layeredtech for the Forex

Another layeredtech.com hosted beast call Netforex crawled out of the woodwork today with HTML in the user agent which is the most obnoxious shit ever. Nothing at their website yet except a default Apache page.

It looked at robots, amazing, then got slapped when it hit the home page.

Iisn't bot blocking automation is wonderful?

72.232.204.58 - "GET /robots.txt HTTP/1.0" "<a href='http://www.netforex.org'> Forex Trading Network Organization </a> (info@netforex.org)"

72.232.204.58 - "GET / HTTP/1.0" "<a href='http://www.netforex.org'> Forex Trading Network Organization </a> info@netforex.org"
Just makes me positive that blocking the entire range of Layeredtech was also a good idea.

Saturday, June 17, 2006

New Nutch Sighting at Rediff

Just to make sure our list doesn't grow stale, here's the new Nutch of the day:

203.199.83.162
pro3.rediffmailpro.com
"NutchCVS/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"
No clue why a business email company needs a web crawler but that's where it came from.

I noticed the Nutch developers picked up on my previous post and are discussing forcing the default user agent to be changed, which wasn't yet again, and ways to reduce the amount of actual crawling of individual websites by Nutch.

Good luck on that effort guys, we can use it!

Thursday, June 15, 2006

Hanzo:web Social Archiving is Social Copyright Infringement

OK boys and girls, it's time to get pissed off as all notion of copyright and control of your site content has been tossed out the window as the fine folks over at hanzo:web ARCHIVE your site content on demand!

That's right, you click on their bookmarklet and TA DA! your page gets archived WITHOUT YOUR PERMISSION on someone else's server.

Here's the most priceless quote on their site:

Only you can save the Web!
So who's going to save the web from some bullshit like this?

Did you bother asking webmasters if they want their websites saved?

I don't want to be archived, I don't need to be saved, take your archiving toys and go fuck yourselves!

SPIT ALERT - PUT DOWN YOUR DRINK!

I just about wrecked a keyboard while sipping soda when I ran across this:

Respect for content

All archived pages, links and sites are stored exactly as they appeared on the web. Pictures, objects, links and flash are all retained as they are, preserved as originally conceived.

RESPECT FOR CONTENT?

Are you fucking kidding me?

Where's the respect for my fucking copyright?

You'll be archiving pages WITHOUT PERMISSION, possibly with someone's AdSense account embedded and someone can be sitting on your sites click frauding accounts to death, or stealing content while it can't even be detected that someone is even accessing the pages via the archive.

When they "archive" your page it gets crawled by the following:
87.98.198.194 "Mozilla/5.0 (compatible; heritrix/1.4.0 +http://www.hanzoweb.com)"

inetnum: 87.98.198.192 - 87.98.198.207
netname: hanzoweb
descr: Hanzo Archives Ltd
Now look at this shit coming from their servers:
87.98.198.194 "GET / " Mozilla/5.0 (compatible; heritrix/1.4.0 +http://www.hanzoweb.com)"
87.98.198.194 "GET /robots.txt" "Python-urllib/1.16"
87.98.198.194 "GET / " "Mozilla/5.0 (compatible; heritrix/1.4.0 +http://www.hanzoweb.com)"
87.98.198.194 "GET /robots.txt HTTP/1.0" "Python-urllib/1.16"
87.98.198.194 "GET /"" "Python-urllib/2.4"
87.98.198.194 "GET /" "Python-urllib/2.4"
So it's looking at robots.txt but what user agent are they looking for?

I dug around on their site and didn't see it, so I have no clue what the Python-urllib is looking for in robots.txt, but it really doesn't matter because the FAQ page plainly states that they don't give a flying fuck about your robots.txt file, they'll archive it anyway no matter WHAT YOU SAY MR. WEBMASTER and make it private:
The original crawl was subject to restrictions by robots.txt. This means that any archived content will be marked as private for browsing by the person crawling it, therefore, unless its your own archive, you will not see this content.
Sounds to me, as a webmaster, they're saying "FUCK YOU!".

Well, I blocked your service, so this webmaster is replying in kind "FUCK YOU!" no tresspassing allowed.

This is a huge problem as people will be snapping copies of anything for any reason and you, the webmaster, will have no control over what Hanzo:web stores or displays nor what these people do with your content after the fact.

BTW, when people start flaming me that I should've "contacted" them to find out what they were looking for in the robots.txt file, if they were doing it right, the path to this information would've been in the user agent string just like all the other sites do, or highlighted in the FAQ.

Nice idea but your draconian implementation doesn't deserve a second chance and it's blocked, out of mind, not a problem for me anymore.

FWIW, my bot blocker already stopped them from getting anything in the first place but I'm blocking their whole range of IPs just to make sure nothing slips through the cracks like stealth crawling as they have already demonstrated a complete lack of respect for everyones website.

Why is MonsterCommerce mining my site?

Didn't think this was worth mentioning until it happened several days in a row.

This is what's requesting various web pages:

72.32.59.114
wordsmith.monstercommerce.com
"Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
So the question is what do they want?

Are they scraping my directory for potential customer leads?

Very curious indeed.

Wednesday, June 14, 2006

Green Template Must Go

OK, I can stand it anymore, some of the colors in the blog are making me crazy and I just tweaked a couple of fonts because I could barely read the block quotes.

Going to either tweak this template some more or ditch it for something else altogether.

Any suggestions?