Thursday, July 13, 2006

DIT - Dissident Internet Technology

Don't get me wrong, I have no problem with the Chinese people having open access to the internet, but not via sneaky assed cached DIT proxies and not on my server.

If you want internet freedom you can a) move elsewhere like many of my Chinese friends and neighbors or b) overthrow your damned government and stop poking around in firewalls like children trying to bypass NetNanny.

Not like we have any internet freedom as the fucknuts in Washington state passed a law about online gambling that can have your ass tossed in prison just for WRITING about online gambling, not even doing it, so we have our own internet problems and politicians tossing out the 1st Amendment that need overthrowing right here at home.

The proxy details:

66.98.206.97
[ev1s-66-98-206-97.ev1servers.net.]
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), DynaWeb http://www.dit-inc.us/disclaimer.php
The amusing part was, unless it was spoofed, the IP being forwarded was 65.59.219.179 which belongs to Level 3 Communications, which certainly isn't in China unless it was yet another proxy server relaying from there.

Sorry people, I know it's harsh, but bad shit goes down via proxies and Chinese IP's have knocked my server offline as long as 90 minutes at a time asking for hundreds of pages a second.

Not that I don't have sympathy for their situation, but I have NO fucking sympathy for anything that has potential to enable my server going offline.

A Daily Rant from a kindred spirit

Looks like somewhere out in the internet someone else has A Daily Rant that is also pissed about bots. For those of you doing it the old fashioned way and still blocking bots one at a time, he provides snippets of code for your antiquated .htaccess files and has a big list of bots to block ready to install.

Maybe some day he'll have an epiphany and come around to the whitelist method and stop wasting his time with the endless list of bots that just don't stop with a new bot found almost daily.

The site has some good information so I think you'll all enjoy it but he needs more cursing, it's pretty tame ;)

1&1 Web Host Goes Spamming

When you want some bad publicity just send some spam and you'll get all you need.

For starters, I'm not in any opt-in, double opt-in or any other kind of bullshit spam list unless someone stuck my name in there. I despise spam so whatever excuse they make about how they sent me this spam is a FUCKING LIE whatever it is so don't even bother trying to post excuses if you read this as I NEVER signed up, no way, no how, not possible, and you spamming morons can kiss my big fat white hairy ass.

It appears this email came from some SPAM operation called DesertWalls hosted on Interland.

Interland.Return-Path:
Received: from desertwalls.com (66.33.17.22)
From: "eMarketing" <SPAMMING_FUCKWADS@desertwalls.com>
Message-ID: <fuck_you_desert_walls@desertwalls.com>
Subject: Exclusively from the World's Largest Web Host
X-Complaints-To: SPAMMING_ASSHOLES@desertwalls.com

This is 1&1's bullshit ad:



The ad was originally loaded from:
http://69.59.147.20/1and1ad4.jpg
When you clicked the ad it went to a tracking script:
http://desertwalls.com/t/xxxxx/xxxxx
Which was redirected here:
http://order.1and1.com/xml/order/HostingHome
Which is owned by 1&1:
domain: 1and1resources.com
registrant-firstname: Thomas
registrant-lastname: Vollrath
registrant-organization: 1&1 Internet Inc.
registrant-street1: 701 Lee RD
registrant-street2: Suite 300
registrant-pcode: 19087
registrant-state: PA
registrant-city: Wayne
registrant-ccode: US
registrant-email: support@1and1.com
Don't know if this was one of their affiliates and I really don't fucking care but it looks like 1&1 sent the email as this was at the bottom:
If you no longer wish to receive messages from 1&1 Internet, please send a blank email with the single word "Unsubscribe" in the subject line to remove@1and1resources.com. Make your mark on the web with 1&1, the only web hosting company trusted by over 5 million people worldwide.
If 1&1 didn't send it then it would be too obvious they had an issue with the affiliate when all the unsubscribe requests started pounding their server, so it's probably them.

So take your webhosting service and shove it up your spamming ass.

Thank you.

Wednesday, July 12, 2006

Honey Pots are History - Fix Your Site or Block Bots!

There's a really cool anti-spam site up called Project Honey Pot that seems to be snaring a ton of spambots and identifying where the spammers crawl from, spam from and what they are spamming. However, the problem with this valiant but slightly misguided effort is that it assumes you can stop spambots from harvesting if you can out them, which blew up in Blue Security's face.

The true way to stop spambots isn't trying to feed them honey, it's fixing your website so there isn't any email addresses for them to harvest in the first place. Wow, isn't that a revelation, no email address on the page, nothing to harvest, end of spambots.

Two simple ways to accomplish the end of spambots are CONTACT FORMS and BOT BLOCKERS. If you purge your site of all email addresses and use a secure form with a captcha to stop spammers, then you should eliminate email harvesting and form spamming in one shot. Combine this with a bot blocker that stops all the vermin from crawling your site in the first place and you've got a 2-pronged strategy that should stop them cold.

Not that honey pots aren't cute as they snare these idiots, it just makes more sense to EDUCATE webmasters to avoid publicly displayed email addresses in the first place and stop bots from crawling to end the spambots once and forever. Anything else, like a honey pot, is just patching around the problem and not putting a permanent stop to the disease.

NO EMAIL ADDRESSES SHOULD BE DISPLAYED ON WEB PAGES EVER!

GET IT?

GOT IT?

GOOD!

Now move on.

Tuesday, July 11, 2006

Gaisbot crawls via Yahoo China

I've been waiting for an excuse to block Yahoo China and this shit tips the scales.

202.165.96.134
[r2.mk.cnb.yahoo.com.]
"Gaisbot/3.0+(robot@gais.cs.ccu.edu.tw;+http://gais.cs.ccu.edu.tw/robot.php)
What the fuck Yahoo?

Why is GAIS Labs of National Chung Cheng University crawling from your IP block?

This is BULLSHIT!

Tireman crawling or breached?

Here's one that makes no sense to me as it appears the Tireman Auto Centers came crawling today.

72.240.44.21 [thetireman.com.] requested 29 pages as "Java/1.5.0_07"
It appears to be a dedicated from from ev1servers.net which is a hot bed of trouble anyway.

ev1s-207-44-205-180.ev1servers.net
Another reason I block anything from ev1servers.net

Rightscripts are Leakey

Some UK script kiddie Leakey Yung has a website called Rightscripts where he sells a bunch of bullshit scripts like Extract Website, just what we need, along with some SEO tools with live demos you probably don't want aimed at your site.

Their server is:

rightscripts.com (64.202.163.153)
If they try to run the demo from their server it shows as a different IP:
64.202.165.132
wc02.inet.mesa1.secureserver.net
"" [blank user agent]
This mess runs on GoDaddy servers:
OrgName: Go Daddy Software, Inc.
NetRange: 64.202.160.0 - 64.202.191.255
I've seen them appear to use 2 IPs for a proxy also from GoDaddy twice on my site:
64.202.165.201
"Rightscripts"
Proxy VIA=1.0 wc04.inet.mesa1.secureserver.net:3128 (squid/2.5.STABLE12) FORWARD=64.202.163.153

64.202.165.131
"Rightscripts"
Proxy VIA=1.0 wc01.inet.mesa1.secureserver.net:3128 (squid/2.5.STABLE12) FORWARD=64.202.163.153
Then of course, there appears to be some asshole that actually bought this script that aimed it at my site:
65.254.32.58
[sandiego.hostingforme.com]
"Rightscripts"
Of course "hostingforme" is a bullshit shell page that says nothing, another shocker, owned by some idiot scraper from India.
hostingforme.com (72.9.235.194)

Domain Name: HOSTINGFORME.COM
Registrant:
Ankur Motreja
399, 5th cross,
Gokulam III stage
Mysore, Karnataka 570002
India
Reinforces why I blocked GoDaddy's hosting farm in the first place and lock out all these idiot scripts by default.

Juniper Networks Security Lab

Just about once a day something Juniper Networks has been playing with comes and asks for a page or two and goes away. Never asks for robots.txt or anything like that so no clue if it's a crawler or what.

208.223.208.181
[security-lab1.juniper.net.]
"Python-urllib/1.16"
Perhaps it goes away when the user agent is blocked and it gets the "go away you're bothering me" page, but it will come back again and again and has been doing so for months.

If anyone from Juniper wants to comment on what in the hell your "security lab" is doing, perhaps I'll let it pass thru if it's a worthy cause. However, considering they aren't even bright enough to change the default user agent, forget that last thought, we'll just keep blocking it.

Monday, July 03, 2006

First Look - MaSagool spider

Some search engine called Sagool from Japan [translated] sent a spider caledl MaSagool that came crawling from 2 IP addresses. Didn't look for robots.txt or any other damn thing so probably a good idea just to block this thing until they teach it some manners.

59.158.235.21
[59x158x235x21.ap59.ftth.ucom.ne.jp.]
"MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"

124.32.246.45
[124x32x246x45.ap124.ftth.ucom.ne.jp.]
"MaSagool/1.0 (MaSagool; http://sagool.jp/; info@sagool.jp)"

Ace-Hole SEO Spamming Promotion Service

Today some bullshit artist that claims to be a SEO expert appears to have referrer spammed a bunch of their sites or sites they built on my server.

It's bottom feeding scumbags like this that gives SEO a bad name as this isn't SEO, this is just fucking SPAM by some idiot that hasn't got a clue that INTERNET PROMOTIONS is not synonymous with the PISSING PEOPLE OFF you fucking moron.

Here's the referral spams for your viewing pleasure:

86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
86.135.32.94 "http://www.hypnospot.co.uk"
86.135.32.94 "http://www.tradercurrencies.com"
86.135.32.94 "http://www.internet-viral-marketing.com"
86.135.32.94 "http://www.thelistandsell.com"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk"
86.135.32.94 "http://www.123hyperlinks.com"
86.135.32.94 "http://www.tradercurrencies.com/currency-trading/index.php"
86.135.32.94 "http://123hyperlinks.com/More-Web-Traffic/index.php"
86.135.32.94 "http://www.ace-search-engine-optimization.co.uk/SEO/index.php"
All of the crap above is linked back to Ace SEO in one way or another.
  • At the bottom of hypnospot.co.uk it says it was designed by "Ace SEO Web Site Design and Promotion".
  • The bottom of tradercurrencies.com also says designed by "Ace SEO Web Site Design and Promotion"and it's registered to "Ace Web Masters" so these idiots own it.
  • Both thelistandsell.com and 123hyperlinks.com have AdSense that claims " Advertise on www.ace-search-engine-optimization.co.uk" and are also registered to "Ace Web Masters".

It's real simple, if you don't want your dirty laundry spread all over the internet then keep it off my fucking server so take your spamming SEO bullshit and shove it up your AceHole.

Sunday, July 02, 2006

DUMBASS Scanned Your Page!

This DumbAss using the user agent "Badass scanned your page!" was on my server a whopping 30 seconds and appears to have been asking for the index page over and over, then hit my spider trap right away, invoked a speedtrap for running too fast and then got page after page of captcha's it never answered.

06/23/2006 SPIDERTEST 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 SPEED 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
06/23/2006 CHALLENGE 84.246.245.40 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Badass scanned your page!)"
The IP resolves to some server with some adult crud on it by some dipshits in Denmark.

Block this and sleep better at nights:
inetnum: 84.246.245.32 - 84.246.245.63
netname: rackserv-cust-hipergroup
descr: Hipergroup mediahouse
Buh Bye Bad... er DumbAss

The Boyz From Brazil Want to Crack Your Site

The XML-RPC exploit for PHP must be very popular in Latin America as these Brazilian IPs just don't fucking give up trying.

02/27/2006 20:45:58 201.0.61.144 "" "//xmlrpc.php"
04/20/2006 00:45:23 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 01:40:39 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 01:40:39 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 20:31:07 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 22:52:14 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 23:26:11 201.6.7.70 "" "/xmlrpc.php"
04/20/2006 23:53:55 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 13:26:20 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 13:49:21 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 17:21:46 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:21:59 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:45:47 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 18:45:47 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 20:39:46 201.6.7.70 "" "/xmlrpc.php"
04/21/2006 21:28:56 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 19:51:31 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 22:13:01 201.6.7.70 "" "/xmlrpc.php"
04/24/2006 23:09:54 201.6.7.70 "" "/xmlrpc.php"
04/25/2006 01:47:17 201.6.7.70 "" "/xmlrpc.php"
07/02/2006 13:11:21 201.1.141.75 "" "/xmlrpc.php"
If you haven't upgraded your XMLRPC file yet, you better get it quick before these fuckers nail your server.

Saturday, July 01, 2006

Return of the Jeteye

Beyond the obvious StarWars reference in the title of this post, the Force is not strong with this crawler. This Jeteye crawler is bucking for the Empire's buggy software award today as it came and asked for robots.txt a whopping 11 consecutive times, and THEN asked for 11 other pages.

71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
71.5.15.254 - "GET /robots.txt HTTP/1.1" "jeteyebot/0.1; http://www.jeteye.com/bot.html"
Can anyone really write software that bad after gradeschool?

I weep for the future.

Investor Relations Group Running Email Harvester

Things just get stranger and stranger but MG Investor Relations appears to be running a known spam harvester program.

64.34.166.105
[mgir.mginvestorrelations.com.]
"sna-0.0.1 mikeelliott@hotmail.com"
Who knows, maybe the server is hacked and a spammer is running this from a subdomain without the owners knowing about it.

Who cares.

Blah.

First Look - Bladder Fusion Leaks Onto Web

Some Comcast customer must be pissing their pants laughing after changing the name of their user agent to bladder fusion.

68.48.144.199
[c-68-48-144-199.hsd1.md.comcast.net.]
"bladder fusion 1.4.0"

No other activity has been recorded from that address so we don't know what this little pisser is all about.

Let me know if you see this one tinkling on your website.

Another Nutch Batch Hatched

Here's another new batch of Nutch crawlers bugging the shit out of my website today.

81.173.155.210
[xdsl-81-173-155-210.netcologne.de.]
"NutchCVS/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"

62.40.33.173
[plato.portal.o2.ie.]
"NutchCVS/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"

71.217.33.149
[71-217-33-149.tukw.qwest.net.]
"NutchCVS/0.7.2 (Nutch; http://lucene.apache.org/nutch/bot.html; nutch-agent@lucene.apache.org)"

This is getting old, it's like one of those biblical plagues that just comes in overwhelming numbers like locusts, frogs and now Nutch.

Wednesday, June 28, 2006

SCRAPER BUSTED #5 - Site is so bad McAfee SiteAdvisor blocked the page load!

Well, I knew some scrapers were bad but this one takes the cake.

209.172.60.19 [ip-209-172-60-19.reverse.privatedns.com]
User Agent: lwp-trivial/1.41
The scraping was tracked to a page on umax-search.info.

When I went to open the page in Internet Explorer I got this error instead.

umax-search.info may cause a breach of browser security.

We blocked your browser from visiting this site.

In our tests, umax-search.info attempted to make unauthorized changes to our test PC by exploiting a browser security vulnerability. This is a serious security threat which could lead to an infection of your PC.
The proud owner of this lovely site is:
whois umax-search.info

Domain Name:UMAX-SEARCH.INFO
Registrant Name:Sid Wongvorakul
Registrant Street1:979 Rutland Dr
Registrant City:Memphis
Registrant State/Province:TN
Registrant Postal Code:78243
Registrant Country:US
The site's information is as follows:
umax-search.info (66.199.247.42)
The site is hosted by this now blocked company:
OrgName: EZZI.NET
OrgID: EZZIN
Address: AccessIT - Hosting Services
Address: 75 Broad Street, Suite 1902
City: New York
StateProv: NY
PostalCode: 10004
Country: US

NetRange: 66.199.224.0 - 66.199.255.255
The SCRAPING IP came from iWeb Technologies which I'll assume is hosting a proxy site that was used to scrape and is now also on my blocked list.
whois 209.172.60.19

OrgName: Groupe iWeb Technologies inc.
OrgID: GIT-20
Address: 3185, rue Hochelaga
City: Montreal
StateProv: QC
PostalCode: H1W-1G4
Country: CA
NetRange: 209.172.32.0 - 209.172.63.255
NameServer: NS1.IWEB-HOSTING.COM
NameServer: NS2.IWEB-HOSTING.COM
From Canada to Tennessee and finally landing in New York, my scraped data took a wild trip and ended with a McAfee warning, sheesh.

Nastiest thing I've run into so far, but I doubt it will be the worst.

HTTPanties on ThinkGeek

The ThnkGeek website has some amusing undies for sale called HTTPanties.

Currently they offer the following printed on your crotch covers:

  • "200 OK" if you feel frisky
  • "403 Forbidden" which is obvious
  • "411 Length Required" for size queens
  • "413 Requested Entity Too Large" which most of us will never see
We would like to suggest these additional HTTP offerings:
  • "101 Switching Protocols" for bisexuals
  • "300 Multiple Choices" for swingers
  • "301 Moved Permanently" for transexuals
  • "304 Not Modified" for virgins
  • "307 Temporary Redirect" for having an affair
  • "400 Bad Request" for that time of the month
  • "405 Method Not Allowed" stamped on the ass if not into anal
  • "409 Conflict" when she's pissed
  • "416 Requested Range Not Satisfiable" when you didn't make her come
  • "417 Expectation Failed" when he couldnt get it up
And for ladies that don't like adult toys, vegetables, and other non-human phallic replacement parts:
  • 415 Unsupported Media Type
Last but not least, if she was all horny and went to bed without you, waiting while your dumb ass kept watching football or some shit, and she fell asleep don't be surprised to see this when you finally make it to bed:

  • 504 Gateway Timeout

User Agent: "Microsoft Internet Explorer"

After seeing this user agent coming from Raytheon my curiosity got the best of me so I looked up any other occurances of this exact user agent and got the list below. None of them asked for more than a page or two, very rare occurances, and the requests originate from corporate proxies and dial-ups so I don't see any pattern to this yet.

03/07/2006 199.64.0.252 "Microsoft Internet Explorer"
04/05/2006 66.27.21.125 "Microsoft Internet Explorer"
05/04/2006 199.64.72.252 "Microsoft Internet Explorer"
05/31/2006 65.92.122.217 "Microsoft Internet Explorer/4.40.426 (Windows 95)"
06/11/2006 209.198.169.10 "Microsoft Internet Explorer"
06/28/2006 199.46.200.232 "Microsoft Internet Explorer"
Just keeping an eye on this one as well.

Odd Raytheon Behavior

OK, not sure what this is about, but this is just WEIRD....

The IP 199.46.200.232 [lax-gate3.raytheon.com.] came out of nowhere and asked for only these files which was very bizarre out of context.

199.46.200.232 - "GET /page1.html HTTP/1.0" "Microsoft Internet Explorer"
199.46.200.232 - "GET /favicon.ico HTTP/1.0" "Microsoft Internet Explorer"
199.46.200.232 - "GET /page2.html HTTP/1.0" "Microsoft Internet Explorer"
199.46.200.232 - "GET /favicon.ico HTTP/1.0" "Microsoft Internet Explorer"
Could it be something trying to test for bookmarks pages still existing and update favicon.ico for those pages?

If anyone has a clue, as usual, I'm curious

UPDATE...

FYI, someone at Raytheon really keeps an eye on the blogs as this was barely posted an hour before they read it. Not so unusual as many companies seem to be spying on anything said about them all the time and I see this constantly, just not so quick!
(138.127.125.236) www.technorati.com/search/raytheon
incredibill.blogspot.com/2006/06/odd-raytheon-behavior.html

whois 138.127.125.236

OrgName: Raytheon Company
OrgID: RAYTHE
Address: 141 Spring St
City: Lexington
StateProv: MA
PostalCode: 02421
Country: US