SCRAPER BUSTED #11- Inhoster Scraper Indexed by Yahoo

Couple of weeks back I posted about blocking Inhoster which was oozing with spambots with one scraper in their midst and that scraper has finally surfaced.

The scraper's ID is:

IP Address: 85.255.116.178
User Agent: Snoopy v1.2

Which showed up on a page buried on this domain:

index-se.com (85.255.116.182)

What a concept, 2 IPs in Inhoster for one scraper.

Now let's dig for some dirt!

A reverse-IP lookup reveals the scraping IP address 85.255.116.178 is also the IP for FINDALLBEST.COM which looks just like index-se.com.

85.255.116.178: FINDALLBEST.COM

Domain Name: FINDALLBEST.COM

Registrant:
N/A
Nekto (nekto@utopia.com)
Jamaica 17
Cuba
null,12476
CU
Tel. +543.56576767

The info for index-se.com claims to be from the US:

Domain Name: INDEX-SE.COM

Registrant:
Index SE
Index SE (admin@index-se.com)
67 Mt. Auburn St.
Cambridge
,02138
US
Tel. +617.4959659

85.255.116.182: SEARCHADULTSEX.COM:

Domain Name: SEARCHADULTSEX.COM

Registrant:
N/A
Nekto (nekto@utopia.com)
Jamaica 17
Cuba
null,12476
CU
Tel. +543.56576767

So I got curious what else was between 85.255.116.178 - 182 and it was all the same crap:

85.255.116.179: right-pharmacy.com

Different registrant but domain redirects to buy-soma-online.findallbest.com, there's a shock:

Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713

85.255.116.180: wagemax.com

This one is just a Plesk domain placeholder page at this time and another registrant.

Domain Name: WAGEMAX.COM

Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713

85.255.116.180: search-paga.com

Yes, same registrant and site looks like all the rest of the crap.

Domain Name: SEARCH-PAGA.COM

Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713

85.255.116.181: coolsearch.biz

Pay dirt! We found the domain linked to the other domains on 85.255.116.180

Domain Name: COOLSEARCH.BIZ
Domain ID: D6614592-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: ok
Registrant ID: DI_2271261
Registrant Name: Alexei Aniskevich
Registrant Organization: N/A
Registrant Address1: Moisavahe 64-1
Registrant City: Tartu
Registrant State/Province: Tartumsa
Registrant Postal Code: 50707
Registrant Country: Estonia
Registrant Country Code: EE
Registrant Phone Number: +372.715713
Registrant Email: alex@coolsearch.biz

When you go to coolsearch.biz it automatically takes you to: www.gigasearch.biz

Domain Name: GIGASEARCH.BIZ
Domain ID: D7182275-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: clientTransferProhibited
Registrant ID: DI_2191316
Registrant Name: Alexei Aniskevich
Registrant Organization: N/A
Registrant Address1: Sopruse pst 15
Registrant City: Tallinn
Registrant State/Province: Harjumsa
Registrant Postal Code: 50707
Registrant Country: Estonia
Registrant Country Code: EE
Registrant Phone Number: +372.715713
Registrant Email: alex@coolsearch.biz

85.255.116.181: your-searcher.com

Domain Name: YOUR-SEARCHER.COM

Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Sopruse pst 15
Tallinn
Harjumsa,50707
EE
Tel. +372.715713

Let us continue with more of this puzzle...

Let's explore gigasearch.biz a bit more:

69.50.163.9: gigasearch.biz

We did find some similar scraping in this range:

69.50.190.242 "Snoopy v1.2"

Actually, the range 69.50.*.* has a ton of scraping so seeing a link to this scraper and the Snoopy user again yet again was no surprise.

GigaSearch.biz is hosted on our old friends Intercage which hosted Scraper #4 and Scraper #6 which I think may be all the same scraper as everything just keeps linking them together from host to host, some similar IP ranges and the same user agent. Nothing concrete but all the circumstantial evidence is overwhelming that they may be somehow related.

Most amusing is all the links on gigasearch.biz redirect to find.fm, and this relationship could be interesting but I'm getting sick of chasing this scraper / spammer at this point.

The host of our busted scraping pals #4, #6 and #11:

OrgName: InterCage, Inc.
OrgID: INTER-359
Address: 1955 Monument Blvd.
Address: #236
City: Concord
StateProv: CA
PostalCode: 94520
Country: US
NetRange: 69.50.160.0 - 69.50.191.255

Let's see what else is on the Gigasearch.biz server:

69.50.163.9: blanksearch.biz

This domain is NSFW with raw porn all over it.

Domain Name: BLANKSEARCH.BIZ
Domain ID: D6761115-BIZ
Sponsoring Registrar: ESTDOMAINS INC
Sponsoring Registrar IANA ID: 832
Domain Status: ok
Registrant ID: DI_3009123
Registrant Name: Ivars Kaupers
Registrant Organization: No
Registrant Address1: Skirgailos 15
Registrant City: Kaunas
Registrant Postal Code: 75128
Registrant Country: Lithuania
Registrant Country Code: LT
Registrant Phone Number: +370.571689
Registrant Email: ivars@blanksearch.biz

69.50.163.9: tgp-porno.net

This site brings up another of the same old porn links again.

Domain Name: TGP-PORNO.NET

Registrant:
N/A
Alexei Aniskevich (alex@coolsearch.biz)
Moisavahe 64-1
Tartu
Tartumsa,50707
EE
Tel. +372.715713

Last but not least, the server with find.fm hosts a few other garbage domains with the same links about pills and porn on them all, with "find.fm" on the bottom of the page which was a big shocker as well:

Domains on 64.111.196.119 (Find.fm)

adultwebfind.com
carwebsearch.com
cashwebsearch.com
dmns4sale.com
gamblingwebsearch.com
pharmacywebsearch.com
travelwebsearch.com
your-needs.info

Well, that's all for now.

Needless to say, they can't hide for long as they leave a slimey trail that can be followed.

Scrape me again assholes, let's unravel the rest of your bullshit sites.

Slow Blog Week

Sorry if you aren't getting your daily dose of bad bots and the usual run-on ranting sentences packed full of expletives but I've been busy the last few days catching up on some accounting and doing some work on software and websites.

If you really need your 'fix' you can catch up on the latest of the Nutchies that are still harassing the shit out of me from a link from Doug Cutting's site.

As you can tell in the final comment posted, and a few previous comments, that I'm losing patience with this bunch of crawling-the-web-is-our-right cultists.

Pyrex Detonates Dinner

Tonight we had to go out to dinner because the Pyrex dish in the microwave detonated like a small bomb. It did NOT just fall apart like they claim, I heard the noise 3 rooms away when the dish went >BANG!< in the microwave and rocked it.

OK, I'll grant you that this occurance was possibly a rapid temperature change caused by cooking in the microwave.

However, a couple of years ago we had a Pyrex 11"x17" 6-month old baking dish sitting in a cabinet that hadn't been used in many days and it just exploded with such force that the door to the cabinet was blown open, shards of glass flew across the room and there was glass even on the shelf ABOVE where this dish was sitting.

The fine people of World Kitchen (scroll down to Pyrex Responds) would like to have you believe that these dishes don't explode, so perhaps they would like to explain why I had to empty a shelf above the dish that didn't explode to clean up the shards of glass, or how glass landed in the carpet almost 8' away, or sprayed across our kitchen.

For my part, I'm done with Pyrex as 2 exploding dishes in a couple of years is just too dangerous to deal with.

We'll be replacing them with metal for baking or some alternative for the microwave in every case possible.

In the meantime, we're immediately moving all of our Pyrex to lower shelves by the floor as a safety precaution as I'd rather have glass in my foot instead of glass in my face from this volatile cookware.

[Update]

After doing some research we found this tidbit:

"Pyrex kitchen products produced by World Kitchen are no longer made from borosilicate glass, and their packaging indicates that they must never be used over a flame, on stove tops, under a broiler, or in a toaster oven. Hence the exploding glassware. Pre-1998 Pyrex tends to crack into large pieces rather than shattering. Keep your pre-1998 Pyrex and treat it nicely so it will last. Anything you buy now may blow up in your face! "

The 11x17 baking dish was post-1998 but obviously because of it's size wouldn't fit in the toaster over or even the microwave, and we NEVER use these for stove top cooking.

The smaller dish that cracked up in the microwave last night we've had since about '91 so it was the old-style Pryex and did crack into larger pieces, but did so quite loudly.

I'm just glad it broke in the closed microwave and not when my wife opened the door or was removing it from the microwave, that would've been a bad situation.

No more Pyrex for us, it's gone.

SCRAPER BUSTED #10 - Fashion Designs Made for AdSense

We have some fuckers scraping from, come on say it - your favorite source of scraping, Everyones Internet or ev1.net for those of you new to this shit.

Some real dumb fuckers too that put "User-Agent:" in front of the user agent just in case we weren't smart enough to know the user agent was a user agent which was reason enough to block all the assholes that do that shit in the first place.

Here's the stealth crawler:

66.98.132.68 "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3"

Here's a snippet from MSN:

Spring Fashion 2003 Check Out The Backpacker Watercolor Palette Or The ...
...by political and economic decentralisation, especially in countries with mixed and command economies. spring fashion 2003 Your IP Address: 66.98.132.68 User Agent:
devoll.roswellspringcatalog.info/spring-fashion-2003.html8/18/2006

Stupid fuckers, did you not think we would catch your made for adsense scraper bullshit?

Stealth Crawler from HP

Something stealth came crawling from HP, perhaps it's part of that PlanetLab fiasco, asked for 11 pages and 3 images, very bizarre behavior.

Asked for the 'about' page 3 times, robots.txt 2 times, index 2 times, and the privacy page, so definitely not a human and not a terribly clever bot either.

192.6.19.203 - "GET /robots.txt " "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
192.6.19.203 - "GET / " "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

Reverse DNS says:

nslookup 192.6.19.203
name = cache2.nlanr.hpl.hp.com

What's up HP, mind sharing your intentions with this activity?

Found ACEZ in Placez, What is it?

Whatever ACEZ is, it always precedes what appears to be an actual page view so perhaps it's a filtering program of some sort. Additionally, it seems to only come via a proxy server.

Doesn't appear to be a bot but it's very strange.

Here's a few sightings:

220.227.148.74 "ACEZ" VIA=1.0 localzeesports.localzs.com:8080 (squid/2.5.STABLE1) FORWARD=192.168.10.178

212.138.113.12 "ACEZ" VIA=1.1 proxy2 (NetCache NetApp/5.3.1R4), 1.0 cache2.ruh FORWARD=213.165.59.253

212.138.113.13 "ACEZ" VIA=1.1 proxy2 (NetCache NetApp/5.3.1R4), 1.0 cache3.ruh FORWARD=213.165.59.253

212.138.47.17 "ACEZ" VIA=1.1 proxy2 (NetCache NetApp/5.3.1R4), 1.0 cache7.ruh FORWARD=213.165.59.253

212.138.47.14 "ACEZ" VIA=1.1 proxy2 (NetCache NetApp/5.3.1R4), 1.0 cache4.ruh FORWARD=213.165.59.253

Here's a sample of how it appears in a log file before a page is read:

212.138.113.13 - "GET /page1.html" "-" "ACEZ"
212.138.113.13 - "GET /page1.html" "" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

Any additional info would be nice if anyone knows anything about it.

Evolving Stealth Bots

Just in the last few weeks I've been seeing some really odd hits on robots.txt from things claiming to be browsers, loading images like a browser, the whole nine yards.

Bot #1 - Post-crawl Robots.txt Reader

What I'm seeing is that instead of looking at robots.txt upfront, which is a trigger to shut down a bot, I'm seeing robots.txt read after one or two pages is read. That way, they can snoop my robots.txt file but not do it first therefore avoiding being stopped while collecting a safe page or two in order to find out what my pages are for a future crawls.

That's my theory and I wouldn't have considered this the case except I've seen the exact same behavior multiple times.

Time to start setting some new traps and see who crawls with the information gathered from these probes.

Bot #2 - 3 Phase Crawler

Next on the list is a stealth bot that looks like it's either taking a screen shot on the first page or downloading images just to try and trick my software into thinking it's human.

This beast does the following:

1. Reads robots.txt with a blank user agent string
2. Loads the home page as Linux Firefox and downloads all associated images which appears to be taking a screen shot
3. Crawls the rest of the pages on the site disguised as Internet Explorer
   

Bot #3 - Blank User Agent Probe

Here's something amusing with what appears to be a Ukrainian spider that downloaded a linked image to my website as Internet Explorer and 4 seconds later hit robots.txt as an anonymous user agent.

82.207.93.90 - [12:20:47] "GET /banner.gif" "http://www.someotherwebsite.com" "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT 4.0)"

82.207.93.90 - [12:20:51] "GET /robots.txt" "-" "-"

This may be related to Bot #2 above, not sure, but I've seen a few hits like this where they follow the link and peek to see what's allowed and don't go any further.

Very odd.

Link Checkers Don't Understand

Having a few conversations that are going nowhere with some link checker sites.

ME: "Sorry but I had to block your link checker as you're never going to find what you want as I can't allow any of you to crawl 40K pages. Would you mind just telling me what you want to find and I can tell you exactly where it is?"

Link Checkers: "Just point us to your links page with robots.txt"

ME: "The whole site is links, it's a directory, and robots.txt is EXCLUSION only, not INCLUSION, so I can't tell you where to crawl only where NOT to crawl which is impractical with 40K pages anyway."

Link Checkers: "We stop after X pages anyway."

ME: "You're still wasting my bandwidth as the odds of finding what you're looking for in the top level pages is real slim. How about telling me who you want in the referrer field and I'll just redirect your crawler to the exact page you need."

Link Checkers: "Error, does not compute, too logical, error, error, erroooooooorrrrrr...."

So there you have my current state of impasse with the link checking community.

As soon as they can come up with a compromise I'll unblock them, but until then NADA PAGE!

FIRST LOOK - GenericBot-ax 0.85 at SurfControl

It's always cool to have an EXCLUSIVE on a new bot caught fresh in the traps this morning.

This little beast was crawling from SurfControl's IP range:

195.244.16.1 "GenericBot-ax 0.85"

Here's the 411 on the IP address:

inetnum: 195.244.16.0 - 195.244.17.255
netname: SURFCONTROL
descr: SurfControl PLC
country: GB
e-mail: karl.jones@surfcontrol.com

Didn't ask for robots.txt and asked for the home page 3 times in a row, about a minute apart.

What they didn't expect was their SurfControl met MY surf control and they got a swift kick in the ass.

NO DATA FOR YOU!

Buh bye.

Multiple Scrape Attempts from Google IPs?

OK, anyone can shed any light on this would be nice, web accelerator may?

Had a batch of "Avant Browser" requests, none got answered because of this SNAFU request early on that tripped the bot trap, yet they just kept coming:

64.233.173.89 - "GET /#top" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.0.3705)"

Google didn't even respond properly to reverse DNS, sloppy shit:

nslookup 64.233.173.89

** server can't find 89.173.233.64.in-addr.arpa: NXDOMAIN

But it's certainly a Google IP:

whois 64.233.173.89

OrgName: Google Inc.
OrgID: GOGL
Address: 1600 Amphitheatre Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US

NetRange: 64.233.160.0 - 64.233.191.255

Then look at THIS one also from Google, what the hell?

72.14.194.19 - "GET /robots.txt" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6"

Same reverse DNS problem:

nslookup 72.14.194.19

Non-authoritative answer:

*** Can't find 19.194.14.72.in-addr.arpa.: No answer

Just to make sure it wasn't my servers, I checked DNSSTUFF.com, same result.

Yet, it's Google:

whois 72.14.194.19

OrgName: Google Inc.
OrgID: GOGL
Address: 1600 Amphitheatre Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US

NetRange: 72.14.192.0 - 72.14.255.255

OK, someone from Google got a clue what in the hell is going on?

Anyone?

This is unacceptable whatever it is!

Another Yahoo Proxy Hijacking

Since our old buddy John think's I have a bad attitude about proxy sites and they shouldn't be blocked then we'll use him as an example and replace the actual data found in Yahoo with John's website.

John, how would you like your site being Hijacked in Yahoo like this?

1. We Own John's Site
   ... Yahoo has crawled via proxy IP 74.52.14.138 to hijack your site John, deal with it!
   Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp) ...
   gizliweb.com/g/o.web/010010A/http:/www.johnon.com

I doubt this will change his mind about proxies but those Google Ads on the top of his page sure look pretty!

Spam Gilad, It's All His Fault

As the website proclaims:

Gilad, this is all your fault!!!

Technically, just leaving the unattended guestbook online full of nothing but spam was Eli's fault.

This wouldn't even be so amusing except the guestbook is full of spam links pointing to our favorite scraper malware sites.

Take a peek in Yahoo to see the scope of the spamming just for one of the domains such as xanax-shop.info.

I let Yahoo know about the list of dirty scraper malware dogs last week so it will be amusing to see how long they remain in the index, especially since many of the domains in the list try to do harm to surfers.

Thanks to Olliver for pointing out this link titled GooglePray over at Spamhuntress' site.

China's iaskspider evolution and related crawling

Here's the latest on this little bullshit bot iaskspider from China.

Previously it crawled from 2 d-blocks using a simple name:

219.142.118.56 "iaskspider"
219.142.118.57 "iaskspider"
219.142.78.60 "iaskspider"
219.142.78.85 "iaskspider"

Now it claims to be Internet Explorer:

219.142.118.66 - "Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)"

And appears to be checking anonymously for spider traps or some shit:

219.142.118.75 - "GET /robots.txt HTTP/1.0" 200 146 "-" "-"
219.142.118.70 - "GET /robots.txt HTTP/1.0" 200 146 "-" "-"
219.142.118.69 - "GET /robots.txt HTTP/1.0" 200 146 "-" "-"
219.142.118.54 - "GET /robots.txt HTTP/1.0" 200 146 "-" "-"

Don't ask me, I only block them, no clue what the hell is going on.

EDI Edacious Bullshit and Yeti from Korea

Don't know much about this piece of shit crawling from Korea except it looks at robots.txt and operates from 2 d-blocks:

222.231.50.166 "EDI/1.2.0 (Edacious & Intelligent Web Crawler)"
222.231.50.161 "EDI/1.2.0 (Edacious & Intelligent Web Crawler)"
222.231.42.10 "EDI/1.2.0 (Edacious & Intelligent Web Crawler)"
222.231.42.14 "EDI/0.9.3 (Edacious & Intelligent Web Crawler)"

Something in the next d-block in this bad neighborhood:

222.231.21.62 "Yeti"
222.231.21.55 "Yeti"
222.231.21.122 "Yeti"
222.231.21.122 "Yeti"

Bullshit of a feather flocks together.

No Cookies for Decommissioned Junction

I've been dumping affiliate programs lately because of the abysmal rate of cookie tracking and ever decreasing affiliate income vs. the PPC steady income rate.

This isn't terribly accurate as my script doesn't know if a cookie was accepted until the second page view. However, out of 3489 visitors in a sample I just took, that looked at 2 or more pages, the cookies were disabled by 22% of the returning visitors.

5926 Visitors
3489 Visitors > 1 Page View
2710 Cookies Enabled
779 Cookies Rejected

It doesn't take a rocket scientist to figure out that 22% of disabled cookies make affiliate programs relatively unattractive as almost 1/4 of the returning visitors wouldn't give me credit for anything they buy.

Out of the total visitors it's only 13%, but we don't know how many of the 2437 visitors that only viewed a single page had cookies enabled, but my suspicion is it's closer to 20%.

Taking into account that these numbers are POST bot filtering, so all of the bots that were blocked or banned didn't get included, this leads to two possible conclusions:

1) a lot more people aren't accepting cookies than previously thought or
2) there's a lot more low impact stealth bot activity than even I suspected.

Which is the right answer?

I'm sure the truth lies somewhere in the middle.

Telemarketing SEO Assholes

I was sitting here minding my own business today and the phone rang.

Normally, I would let "UNKNOWN CALLER" roll to voicemail but today I lost my mind and answered the damn phone.

ME: "Hello?"

SLIMEBALL: "Hi, do you own domain XYZ.COM?"

ME: "Um, yes I do, why do you ask?"

SLIMEBALL: "We have been looking at XYZ.COM and it's a strong website but doesn't have very good presence in the search engines and we'd like to offer our help."

About now the hair stands up on the back of my neck...

ME: "Excuse me? I rank very well in search engines and have a ton of top 10 longtail keywords"

This alone should be a tip that I know something about this shit...

SLIMEBALL: "Well, our research report shows you're lacking in many major keywords and we could help..."

ME: "Are you out of your mind? I get 500,000 visitors a month, how in the hell is that lacking?"

SLIMEBALL: "Um, well, we don't show you on the main..."

>CLICK!<

I just didn't have the heart to start yelling and screaming profanity at this slimeball as it was just too early in the morning.

My suspicion is they would probably sink my site so low in the SE's that I'd have to get a real job as my days of webmaster welfare would be over.

Fuck it, I'll stick with my "lacking listings" thank you very much.

Kudos on the Google Dance, Stellar AdSense Support, and my Google Gift

Sometimes we complain about AdSense support being slow and unresponsive but I have to give kudos on a same day response yesterday, and that was in the midst of Google preparing for the Google Dance party.

Now the Google Dance party was off the hook, the band kicked ass, it was rock'n baby!

Enjoyed the various snacks, they were free and I never complain about free food.

The only thing I didn't try which looked good were the Pavlov's Dogs as I was snacked out and needed to save room for beer.

Google gets more love from me as their beer selections this year were far superior to last year, less cat piss and more beer for real beer drinkers. Last year I had to literally scour the place to find one lone tap with something that wasn't clear yellow cat piss that was tucked inside a building but this year the good beer was everywhere.

Just in case you haven't figured it out, I'm in love with Google at the moment,

I still use all the Google gifts I got last Christmas as the Google wireless mouse and USB expansion port are permanent fixtures on my laptop.

Last week when I went to get a new set of business cards printed I used my Google memory stick/keychain to take them to Kinkos and get them printed and cut while I waited, that was way cool too, no floppies, nothing.

My wife was poking fun at me and my giddy behavior with the memory stick "Have you never encountered technology before? Is this your first time?". Well, technically it was my first time handing someone my keychain to get something printed opposed to original copies or a floppy disk, just struck me as being cool.

I felt like Jack Bauer from 24 running into Kinkos:

"Quick Chloe, download the encrypted data off this chip that was just recovered in a covert sting and use our blowfish decryption algorithms to extract these business cards..."

Ah well, been there, done that, now it's old hat.

Besides, who can say anything bad about Google?

They give me free money every month, they give me free web traffic, they give me free gifts and then invite me into their building and give me free food, booze and entertainment.

It's almost like being a rich kid living off the family AdSense trust fund ;)

The only complaint I had about last nights Google Dance party is my feet hurt like hell by the time it was over!

Wait, I almost forgot, they were giving away t-shirts but the sizes were limited to LARGE, SMALL and WOMEN's. C'mon Google, did you take a serious look at how many 2X and 3X people you had waddling around the 'Plex last night?

What in the heck would I do with a LARGE t-shirt, dust my house with it?

Other than that one minor glitch, good job Google, loved it!

SCRAPER BUSTED #9 - Umax is baaaack

This is déjà vu day in the scraper busting dept. as Umax is back with a new virulent website.

BTW, if you want to read some funny misguided shit, this guy wants people to boycott the UMAX the scanner company because of something unrelated, like this spamming virus site maker that's the topic of this post.

What a screwball, sheesh.

WARNING - DO NOT GO TO THIS SITE!

IT WILL ATTEMPT TO INFECT YOUR PC WITH AN EXPLOIT!

Remember, I'm a trained professional, so don't try this site at home as this is some nasty shit.

However, if you're stupid enough [and most of you are] to attempt to access this site then use some goddamn common sense and disable your javascript and maybe java in your browser first or you might end up in a world of hurt.

For those of you real dumb fuckers, I mean the dumb as a pet rock variety, you'll get Trojan.ByteVerify installed on your machine if you visit these sites [see list at bottom] without proper precaution so don't blame me as YOU HAVE BEEN WARNED!

Crawler Info:

IP Address: 209.172.60.19 [ip-209-172-60-19.reverse.privatedns.com]
User Agent: lwp-trivial/1.41

Site info:

umax-ppc.net (66.199.247.42)

This is on the same server and host as the last reported site, but just in case you're too fucking lazy to click the link about and look it up for yourself it's repeated below.

Not sure this is even real information about this asshole, as other registrations say Russia, there's a shock, but they all seem to have FREEYAHO LLC in common.

American asshole information:

Registrant:
Sid Wongvorakul
979 Rutland Dr
Memphis, Tennessee 78243
United States

Registered through: FREEYAHO LLC.
Domain Name: UMAX-PPC.NET
Created on: 15-Dec-04
Expires on: 15-Dec-07
Last Updated on: 12-Jul-06

Administrative Contact:
Wongvorakul, Sid sidfeehit@yahoo.com
979 Rutland Dr
Memphis, Tennessee 78243
United States


Technical Contact:
Wongvorakul, Sid sidfeehit@yahoo.com
979 Rutland Dr
Memphis, Tennessee 78243
United States


Domain servers in listed order:
NS1.NEED-SITE.COM
NS2.NEED-SITE.COM

Russian asshole information:

Domain Name: SEHUNTRESS.BIZ
Domain ID: D10559406-BIZ
Sponsoring Registrar: WILD WEST DOMAINS, INC.
Sponsoring Registrar IANA ID: 440
Domain Status: clientDeleteProhibited
Domain Status: clientRenewProhibited
Domain Status: clientTransferProhibited
Domain Status: clientUpdateProhibited
Registrant ID: GODA-013273608
Registrant Name: DMITRIY SOLDATENKO
Registrant Organization: Freeyaho LLC.
Registrant Address1: a-n 262
Registrant City: Ulan-Ude
Registrant State/Province: Ru
Registrant Postal Code: 670042
Registrant Country: Russian Federation
Registrant Country Code: RU
Registrant Phone Number: +790.25651263
Registrant Email: soldde@mail.ru

Host information:

OrgName: EZZI.NET
OrgID: EZZIN
Address: AccessIT - Hosting Services
Address: 75 Broad Street, Suite 1902
City: New York
StateProv: NY
PostalCode: 10004
Country: US

ReferralServer: rwhois://rwhois.s2.ezzi.net:4321

NetRange: 66.199.224.0 - 66.199.255.255

The rest of this prolific virus spamming assholes domains hosted on the same box:

1day.us
adsadult.com
adscom.us
adsname.com
alprazolam-xanax.com
art-xxx.com
baikal-guide.com
baikal-hotel.com
baikal-hotel.info
baikal-hotel.net
baikal-info.com
baikal-shop.com
baikal-tour.biz
baikal-travel.info
baikalguide.com
baikalhotel.com
baikalhotel.info
baikalhotel.net
baikalshop.info
baikalsk.com
baikalsk.info
baikalsk.net
bbsporn.com
board-online.com
board-online.net
dimattic.com
dsdomain.com
forum-online.biz
free-hit.com
free-virgin-pic.com
freeyaho.com
hotel-baikal.com
hotel-baikal.info
hotel-shop.info
hotelbaikal.com
hotelbaikal.info
hotelbaikal.net
info-baikal.com
lake-baikal.info
lakebaikal.info
need-site.com
nude-teacher.com
online-info.info
payday-loan-top.com
pharmacy-affiliate-program.com
popular-screen-savers.com
porn-samples.com
porn-teacher.com
porn-teen-pic.com
porno-sample.com
ppc-se.biz
ppc-se.com
ppc-se.info
ppc-se.net
qoclick.com
qoclick.net
reseller-porn.com
sampleclip.net
sehuntress.biz
sehuntress.com
sehuntress.info
sehuntress.net
seohuntress.com
sex--free.com
sex--x.com
sexy-teacher.net
showavailable.com
solo-teens.com
specific911.biz
specific911.com
specific911.info
specific911.net
specific911.org
top-10-shop.com
top-new-affiliate-programs.com
umax-forum.com
umax-ppc.com
umax-ppc.net
umax-se.biz
umax-se.com
umax-se.info
umax-se.net
umax-se.org
umax-search-ppc-se-board.com
umax-search-ppc-se.com
umax-search-ppc.com
umax-search-se.com
umax-search-search-engine.com
umax-search.biz
umax-search.com
umax-search.info
umax-search.net
umax.org
umaxforum-umax-forum.com
umaxppc.com
umaxppc.net
umaxppcsearch.com
umaxse.biz
umaxse.com
umaxse.info
umaxse.net
umaxse.org
umaxsearch-ppc-se.com
umaxsearch-ppc.com
umaxsearch-se.com
umaxsearch-search-engine.com
virgin-sexy.com
webmasterdiscuss.com
weekly-pay-ppc-se.com
weekly-pay.com
weekly-teens.com
work-at-home-top.com
xanax-shop.info
yula.us
arshan.info

If you think I have a bad attitude in this post, you're very perceptive, as this fucker really pisses me off more than the usual garden variety scraper and hosting companies that allow this shit on their premises make my blood boil.

I'm trying to resist calling the whole lot of them a bunch of cocksucking assholes, but I think I'm losing that battle..

SCRAPER BUSTED #8 - Categorico Strikes Again from Canada

This is the same bunch of fucknuts I busted previously as Vipse Corp and Categorico with a new twist as this domain is ShopNews.com and claims to be registered to some fucker in Canada, not Italy, but the same Adsense account: "Advertise on www.categorico.com".

Scraping data:

IP Address: 66.240.172.2 [www130.mediaserve.net.]
User Agent: InetURL/1.0

Site data:

shopsnews.com (66.240.172.29)

Domain Name: SHOPSNEWS.COM
Registrant:
Logan Vernissa
306, 809-890 Crowfoot Cres.
Calgary, Alberta T7G 7T4
CA
507-454-0941
Fax:101-787-4348

The scraping and server are from the same d-block hosted here:

OrgName: Broadspire Inc.
OrgID: BRSP
Address: 10200 Sepulveda Blvd. Suite 160
City: Mission Hills
StateProv: CA
PostalCode: 91345
Country: US

NetRange: 66.240.128.0 - 66.240.191.255

You know what to do, block these fuckers and cut them off at the knees.

Robot MKDB From Oxford

No clue what the fuck this is but the reverse DNS suggests that this shit escaped from an Oxford computer science lab.

129.67.94.182 [marina.robots.ox.ac.uk.] requested 1 pages as "mkdb"

Didn't ask for robots.txt whatever it was.

Blah

Yahoo-Test/4.0 fails pop quiz

It wasn't Slurp so they got a error message, test failed, sorry Yahoo!

216.145.49.15 - "GET /robots.txt HTTP/1.0" 200 146 "-" "Yahoo-Test/4.0"
216.145.49.15 - "GET / HTTP/1.0" 200 1173 "-" "Yahoo-Test/4.0"

Study harder next time.

Adsense Scraper with CACHE pages

In a new twist, here's a scraper with CACHE pages pretending he's Google.

Easy target for a flood of DMCA notices...

IP: 66.246.252.172
User Agent: ""

Here's the fuckhead's information:

Registrant:
Dragulescu Radu
Victoriei, bl.7,
sc. D, ap. 3
Timisoara, Timis 01900
Romania

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: PHOTOIDEAS.NET
Created on: 18-Dec-05
Expires on: 18-Dec-07
Last Updated on: 01-Aug-06

Administrative Contact:
Radu, Dragulescu office@2x.ro
Victoriei, bl.7,
sc. D, ap. 3
Timisoara, Timis 01900
Romania
40726367488

Technical Contact:
Radu, Dragulescu office@2x.ro
Victoriei, bl.7,
sc. D, ap. 3
Timisoara, Timis 01900
Romania
40726367488

Domain servers in listed order:
NS1-FRANKLIN.NSWEBHOST.COM
NS2-FRANKLIN.NSWEBHOST.COM

The hosting appears to be thru nac.net:

OrgName: Net Access Corporation
OrgID: NAC
City: Parsippany
StateProv: NJ
PostalCode: 07054
Country: US

I think they're gonna get a letter about this asshole...

Inhoster Blog Spam Haven Servers Blocked

Inhosting is just filthy with blog spammers which is bizarre as usually I find a mix of activity on dedicated servers but this place seems to be overflowing with nothing but spammers and just one scraper, Snoopy.

I'm positive they are all spammers as every IP address listed below, except Snoopy, ONLY accessed my post form on a specific server, nothing else.

They host some of the usual garden variety bullshit spammers and Snoopy the scraper:

85.255.116.178 "Snoopy v1.2" "/"
85.255.117.218 "PussyCat 1.0, Murzillo compatible"
85.255.117.222 "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4"
85.255.117.226 ""
85.255.118.106 "PussyCat 1.0, Murzillo compatible"
85.255.118.114 "PussyCat 1.0, Murzillo compatible"

Then they have a few of the amazing changing user agent spammers from this IP sorted by user agent for your viewing pleasure:

85.255.117.250 "Mozilla/4.0 (compatible; MSIE 4.0; MSN 2.6; Windows 95; Gateway2000)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; USA On-Site)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98; 981)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 98; QXW0332q)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0; DT)"
85.255.117.250 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.9) Gecko/20020311"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc1) Gecko/20020417"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc2) Gecko/20020510"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0rc3) Gecko/20020523"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1a) Gecko/20020611"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.1b) Gecko/20020721"
85.255.117.250 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2a) Gecko/20020910"
85.255.117.250 "Opera/6.01 (Windows 98; U) [en]"
85.255.117.250 "Opera/6.04 (Windows 2000; U) [en]"
85.255.117.250 "Opera/6.04 (Windows 98; U) [en]"
85.255.117.250 "Opera/6.04 (Windows XP; U) [en]"
85.255.117.250 "Opera/7.0 (Windows 2000; U) [en]"
85.255.117.250 "Opera/7.0 (Windows NT 5.0; U) [en]"
85.255.117.250 "Opera/7.02 Bork-edition (Windows NT 5.0; U) [en]"

Another of the same rotating user agent shit on a different IP

85.255.117.251 "Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; USA On-Site)"
85.255.117.251 "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
85.255.117.251 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)"
85.255.117.251 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7) Gecko/20011221"
85.255.117.251 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.0) Gecko/20020530"
85.255.117.251 "Opera/7.02 Bork-edition (Windows NT 5.0; U) [en]"

And YET another that didn't hit as often

85.255.117.253 "Mozilla/4.0 (compatible; MSIE 4.0; MSN 2.6; Windows 95; Gateway2000)"
85.255.117.253 "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.7) Gecko/20011221"
85.255.117.253 "Opera/6.04 (Windows 2000; U) [en]"

For the grand finale, a D-block of Firefox Linux spammers:

85.255.118.82 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.83 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.84 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.85 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.86 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.130 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.132 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.133 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"
85.255.118.134 "Mozilla/5.0 (X11; U; Linux i686; ru; rv:1.8.0.3) Gecko/20060425 SUSE/1.5.0.3-7 Firefox/1.5.0.3"

Block block block block...

Here's the range of troublemaker IPs to block

netname: INHOSTER
inetnum: 85.255.112.0 - 85.255.127.255

They also have this range but I don't have any activity that has been tracked from here:

netname: INHOSTER
netnum: 195.95.218.0 - 195.95.219.255

Enjoy the silence with the fucking spammers gone.

Taiwan Scraping from C and D-Blocks

Didn't check the archive file to see if this was more widespread because as this was a single instance today of a coordinated scrape attempt from multiple IPs at the same time.

The D-block scraping attempt from "61.66.36" was nothing new as small blocks of scraping IPs turn up all the time.

However, the C-block scraping from "218.162." at the same has implications as this normally would've been harder to identify in small 1-4 page bursts.

The scraping C-block:

61.66.36.185 [adsl-61-66-36-185.TC.sparqnet.net.] requested 2 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
61.66.36.186 [adsl-61-66-36-186.TC.sparqnet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
61.66.36.187 [adsl-61-66-36-187.TC.sparqnet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"

The scraping D-block:

218.162.169.65 [218-162-169-65.dynamic.hinet.net.] requested 1 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.170.209 [218-162-170-209.dynamic.hinet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.172.171 [218-162-172-171.dynamic.hinet.net.] requested 4 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.175.60 [218-162-175-60.dynamic.hinet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.179.74 [218-162-179-74.dynamic.hinet.net.] requested 1 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"

Looks like they're getting smarter and your average webmaster will never spot this kind of activity.

Time to block Taiwan entirely?

SES San Jose 7-10 2006

Anyone I know going to be there this week?

I'm heading down to the speakers party tonight (oops, did I let out a surprise) so if anyone I know is there tonight maybe we'll pound a brew or two together.

Bet you can't figure out which session I'll be speaking at...

Google Crawls Thru Yahoo Japan

This odd Google crawling thru Yahoo Japan occurrence must be via some sort of proxy or translation server, no clue, but this shit is weird.

211.14.9.244 requested 2 pages as "Mediapartners-Google/2.1"

211.14.9.240/28
YAHOO-NET
Yahoo Japan Corp.

Makes you scratch your head doesn't it?

Perhaps you have lice or dandruff, stay away from me...

ActiveTourist Visits Rantville

Noticed someone from ActiveTourist was reading my blog post about their dumb as dirt crawler.

Host: activetourist.free-online.co.uk
IP Address : 80.229.187.190
Country : United Kingdom
Region : England
City: London
ISP : Plusnet-dial-adsl

So being curious I checked the address of the ActiveTourist server:

PING www.activetourist.com (80.229.187.190)

What a shock, it's the same IP address, so they're running this server our of their closet.

8-bit Internet Time Machine

Here's the oddest fucking user agent I think I've ever seen:

"IE/6.01 (CP/M; 8-bit)"

Are you shitting me?

Someone is still using an 8-bit computer with CP/M and accessing the Internet with this shit?

Come on, nostalgia is one thing, but that's just fucking stupid, you must be pulling my leg.

So I did some checking to see what other occurances of similar shit has been blocked:

212.69.245.89 "Nutscrape/9.0 (CP/M; 8-bit)"
212.197.17.177 "IE/6.01 (CP/M; 8-bit)"
82.159.197.251 "Nutscrape/1.0 (CP/M; 8-bit)"
195.228.115.1 "Nutscrape/1.0 (CP/M; 8-bit)"
84.56.234.101 Nutscrape/1.0 (CP/M; 8-bit)
82.69.177.201 Nutscrape/9.0 (CP/M; 8-bit)
212.219.82.36 Nutscrape/9.0 (CP/M; 8-bit)

Either this is someone's idea of a lame joke or there are some seriously twisted nerds out there that just won't let go of the past.

SCRAPER BUSTED #7 - Yahoo Loves Scraping Porn Spammers

NSFW - Unfortunately I can't bust these scrapers completely as they got snared with an earlier version of my error pages that didn't contain the IP address to tie back to the source of the scraping. It's sad really, as I'd like to complete the loop with these particularly slimy vermin but maybe I'll get the chance next time if they keep up this crap.

Anyway, they do have my content buried in their sites and it's searchable only in Yahoo as neither Google nor MSN seem to have these slimeballs indexed, at least not with my content in the pages.

The various domains and subdomains that contain my scrapings, and we're talking a whole page, not a snippet, are here:

amateursgarden.com
www.russians-in-tights.com
www.russian-bignaturals.com
www.sexygirlspages.net
www.russian-sexy-feet.com
www.sexyrussianbabes.net
www.poewlalle.com
www.acistits.com
www.poewlalle.com
amateurs.smut-server.net
teens.smut-server.net
babes.smut-server.net
fat.smut-server.net
www.cool-tgp.com
bigtits.cool-tgp.com
fat.cool-tgp.com

I didn't link to the actual page where the scrapings are as some innocent webmasters have been violated severely with this mess and I'd prefer not to give any link love to these pages to make the problem worse.

These bottom feeders seem to be registered mostly out of Ecuador and are hosted on ServerBeach, Webazilla, and a few other places but appear to be using HOSTPOINTS.NET for their DNS. I'm thinking any of the places listed in the U.S. will get served with a DMCA notice and since it's a dedicated box, and not a shared server, the ISP probably has little wiggle room when it comes to compliance other than shut the server down.

Don't get me wrong, I don't have a problem with porn sites, people gotta spank it and someone provides them with the pictures to help keep their seeds out of the gene pool, it's a public service.

However, when these fucking porn spammers start scraping pages from innocent websites and then linking our pages to their festival of filth as a means to get traffic off our backs, then it's a problem, a real big fucking problem.

If the fine people at Yahoo want to drop me a line I'll be more than happy to convey the specifics privately so you can get this slime off your search.

SCRAPER BUSTED #6 - Keyword Stuffing Porn Scraper Nailed

NSFW - This scraper is one of those that uses a website blender to scramble content around therefore it scrambled it's IP address around but 3 parts of the IP were more than enough to lock onto this site scraper/spammer with a blank user agent.

The website I found still contained the IP scrambled as 69, 186, 189 and 50, not in any particular order.

However, this gave me a clue:

PING biblogs.info (69.50.161.115)

So it looks like that IP starts with "69.50."

The winning combination logged in my archive was 69.50.189.186 which had a blank user agent.

This mess claims to be hosted at intercage.com which doesn't even have a fucking web page.

69.50.161.115-custblock.intercage.com

Probably the upsteam colo nlayer.net running this mess, hard to say.

These sites are NSFW so beware, and disable javscript before poking around as there are some eye-opening keyword stuffed pages with links to massively keyword stuffed pages at the root of "biblogs.info" and the others but a redirect elsewhere if you have javascript turned on.

1. pregnant-sex.biblogs.info/pregnant-nude-photography.htm
2. pregnant-sex.svemas.com/fine-art-pregnant-nude
3. pregnant-sex.fervex.net/pregnant-nude-photography
4. mature.vipzoner.info/differant-senior-pictures

Nothing much was learned from WHOIS in this case as each domain is registered to someone different in various countries even with the only thing they seem to have in common is the DNS servers:

Tech Email:sps@meteam.com
Name Server:NS1.2ESTDO.COM
Name Server:NS2.2ESTDO.COM

However, a little DNS digging turned up this pile of identical keyword stuffed shit sites on their servers:

altrosite.com
badmonth.com
banunet.info
biblogs.info
black2men.com
blyberry.com
bugsbugs.org
clickanewz.com
creo8.com
crochome.com
fervex.net
fillsbett.com
fonderm.com
gemalink.com
glibic.com
goglya.com
goremore.com
incestpicsmother.com
kftm3.com
leymfil.info
mdmover.com
neverbe.org
revilance.com
satinz.info
seysmograf.com
shnurlox.com
smesha.com
soma1s.com
sospils.com
spotrange.com
stopsneg.com
svet-dali.com
yoniru.com

The info and range for Intercage, if they still exist, that hosts this garbage is:

OrgName: InterCage, Inc.
OrgID: INTER-359
Address: 1955 Monument Blvd.
Address: #236
City: Concord
StateProv: CA
PostalCode: 94520
Country: US

NetRange: 69.50.160.0 - 69.50.191.255

Did a quick check and there are at least 3 scrapers coming from that range:

69.50.176.34 ""
69.50.189.186 ""
69.50.190.242 "Snoopy v1.2"

Where there's smoke, there's fire, block block block.

Prolific Spammer Thwarted

Last month I wrote that Blog Spam Is Not A Problem as I was easily able to write a quick filter that eliminated all automated spam from my site [not this site] and since then have only suffered thru a handful of manual posts that I had to delete which is a drop in the bucket compared to an automated flood.

Just out of curiosity, I checked my 'bounced post' log today to see who was the most prolific at their attempted spamming and some Ukrainian fucker from 195.225.177.6 wins the prize.

All of his attempted posts start out as domains that aren't even active, sometimes not even registered, and once they become active are quickly disabled:

Account has been suspended

This account has been suspended because of abuse. Account user, please contact support for more information.

Most of the domains, with a few exceptions, claim to be registered to this asshole with what appears to be fake information:

Registrant Name:Rick Quickly
Registrant Organization:N/A
Registrant Street1:Lenina 120-345
Registrant Street2:
Registrant Street3:
Registrant City:Moscow
Registrant State/Province:0
Registrant Postal Code:0
Registrant Country:CN
Registrant Phone:+7.95345567
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:RickQuickly@nonamegirls.com

Keep in mind, not a single of these attempted spams got past my new filter, but this asshole is very determined and they come non-stop.

Here's a shitload of domains you can filter out:

http://loversweekend.org/~ahmad_3139/files/hornyhousewives.html
http://lovingvacation.org/~ahmad_3139/files/amateursex.html
http://realromanticlove.org/~ahmad_3139/files/wifelovers.html
http://romanticdirect.org/~ahmad_3139/files/amatuersex.html
http://thefranticromantic.org/~ahmad_3139/files/amatuersex.html
http://theromanticwoman.org/~ahmad_3139/files/amateurbus.html
http://amateursasian.org/~ahmad_3139/files/amateurs.html
http://amateursbig.org/~ahmad_3139/files/amatuerpages.html
http://hotamateursfree.org/~ahmad_3139/files/housewifes.html
http://hotnewamateurs.org/~ahmad_3139/files/sementwilightdrinkpicturesmen.html
http://realamateurspix.org/~ahmad_3139/files/meninshowerlockerrooms.html
http://therealamateurs.org/~ahmad_3139/files/twink.html
http://anycitypersonals.org/~ahmad_3139/files/amateurporn.html
http://bestindividuals.org/~ahmad_3139/files/dating.html
http://individualsdating.org/~ahmad_3139/files/passwordtoadultfriendfinder.html
http://individualssex.org/~ahmad_3139/files/thegirlnextdoor.html
http://superindividuals.org/~ahmad_3139/files/gaydating.html
http://thebigpersonals.org/~ahmad_3139/files/adultpersonals.html
http://advanceddatingsites.org/~ahmad_3139/files/wwwadultfriendfindercom.html
http://bestforeigndating.org/~ahmad_3139/files/wwwwifeloverscom.html
http://christiandatingmall.org/~ahmad_3139/files/amatuerpages.html
http://courtingguide.org/~ahmad_3139/files/wifelover.html
http://courtingsites.org/~ahmad_3139/files/musiciansfriend.html
http://freecourting.org/~ahmad_3139/files/bondagesex.html
http://greatdatingdirectory.org/~ahmad_3139/files/sexslaves.html
http://greatdatingfree.org/~ahmad_3139/files/freefemdom.html
http://starsinternetdating.org/~ahmad_3139/files/clipspanking.html
http://allflirtchat.org/~ahmad_3139/files/picpostcom.html
http://camflirtguide.org/~ahmad_3139/files/adultfriendfinder.html
http://funflirtline.org/~ahmad_3139/files/swingersclubs.html
http://funflirtsite.org/~ahmad_3139/files/chatrooms.html
http://happyflirtline.org/~ahmad_3139/files/swingersuk.html
http://superflirtbox.org/~ahmad_3139/files/facesitting.html
http://supermaxflirt.org/~ahmad_3139/files/hogtied.html
http://teenflirtrooms.org/~ahmad_3139/files/thepunisher.html
http://theflirtcatalog.org/~ahmad_3139/files/domination.html
http://womenflirt.org/~ahmad_3139/files/breastbondage.html
http://bestslotsfree.org/~ahmad_3139/files/onlinecasino.html
http://greatslotspoker.org/~ahmad_3139/files/texaslotto.html
http://hotfreeslots.org/~ahmad_3139/files/poker.html
http://superslotsfree.org/~ahmad_3139/files/floridalottery.html
http://thefreeslots.org/~ahmad_3139/files/freecasinogames.html
http://theslotscasino.org/~ahmad_3139/files/casinos.html
http://theslotsgame.org/~ahmad_3139/files/onlinepoker.html
http://wonlineslots.org/~ahmad_3139/files/backgammon.html
http://yourslotsgames.org/~ahmad_3139/files/freestrippoker.html
http://yourslotsonline.org/~ahmad_3139/files/texaslottery.html
http://bestbeachblog.org/~ahmad_3139/files/freecasinogames.html
http://bestbloggin.org/~ahmad_3139/files/slotmachines.html
http://blogginbayou.org/~ahmad_3139/files/gambling.html
http://boardjournal.org/~ahmad_3139/files/camelcasinocodes.html
http://diarygers.org/~ahmad_3139/files/texaslottery.html
http://journalgers.org/~ahmad_3139/files/lottery.html
http://supertargetblog.org/~ahmad_3139/files/onlinepoker.html
http://blackbdsmworld.org/~ahmad_3139/files/breastbondage.html
http://freshfreebdsm.org/~ahmad_3139/files/torture.html
http://greatbdsm.org/~ahmad_3139/files/enemas.html
http://superbdsmfree.org/~ahmad_3139/files/girlslikespanking.html
http://thebdsmpics.org/~ahmad_3139/files/nippletorture.html
http://thebdsmsex.org/~ahmad_3139/files/enemas.html
http://anybondagefree.org/~ahmad_3139/files/beltspanking.html
http://slaveriesbondage.org/~ahmad_3139/files/slave.html
http://thebondagefetish.org/~ahmad_3139/files/whippedass.html
http://bestgayhost.org/~ahmad_3139/files/menmasturbating.html
http://bestgaymale.org/~ahmad_3139/files/hotgaysex.html
http://freequeermen.org/~ahmad_3139/files/gayincest.html
http://gaysqueer.org/~ahmad_3139/files/gayhentai.html
http://supergayhome.org/~ahmad_3139/files/freegay.html
http://thegaypride.org/~ahmad_3139/files/menwearinghighheels.html
http://thequeerboy.org/~ahmad_3139/files/falloutboy.html
http://videohotgay.org/~ahmad_3139/files/ofmiceandmen.html
http://wapgayguide.org/~ahmad_3139/files/hairymen.html
http://yourgaymen.org/~ahmad_3139/files/menhavingsexwithanimals.html
http://antiquejewelry.thejewelryonline.com/~ahmad_3139/files/marilynmonroeonjewelrypictures.html
http://gmctrucks.jewelwealth.com/~ahmad_3139/files/gmctahoereviews.html
http://jewelrystores.greatjewelbox.com/~ahmad_3139/files/amazoncouponsjewelry.html
http://carbabes.gemgets.com/~ahmad_3139/files/cheapcartires.html
http://americanlegion.ferser.com/~ahmad_3139/files/narutoamericanthemesongmp3.html
http://lonelyhousewives.bestcourting.com/~ahmad_3139/files/amatuerhousewivespictures.html
http://amaturecurves.preved.name/~ahmad_3139/files/matureamatureanalsex.html
http://amateurpagescom.superdatingsearch.com/~ahmad_3139/files/irelandmatchmakingfestivalhorse.html
http://gradetesting.org/~ahmad_3139/files/pregnantbellygallery.html
http://individualsaving.org/~ahmad_3139/files/lesbianstrapon.html
http://indistinctive.org/~ahmad_3139/files/teensmoking.html
http://indivertible.org/~ahmad_3139/files/softcore.html
http://individualdemands.org/~ahmad_3139/files/youngteensex.html
http://individually.org/~ahmad_3139/files/animegirls.html
http://importable.org/~ahmad_3139/files/translator.html
http://imperishable.org/~ahmad_3139/files/schoolgirlsex.html
http://pasquinade.org/~ahmad_3139/files/projectvoyeur.html
http://personalties.org/~ahmad_3139/files/usedmobilehomes.html
http://personation.org/~ahmad_3139/files/motorolaringtonesfree.html
http://personified.org/~ahmad_3139/files/adultfriendfinder.html
http://petroleous.org/~ahmad_3139/files/mp3ringtones.html
http://philological.org/~ahmad_3139/files/polyphonicringtones.html
http://alltelringtones.picaresque.org/~ahmad_3139/files/verizionringtonesforlgvx8100.html
http://picaroon.org/~ahmad_3139/files/freecellphoneringtones.html
http://piccalilli.org/~ahmad_3139/files/fuckmywife.html
http://displayable.org/~ahmad_3139/files/samesexmarriage.html
http://displease.org/~ahmad_3139/files/chat.html
http://disseminating.org/~ahmad_3139/files/adultfriendfinder.html
http://draftee.org/~ahmad_3139/files/amateurbus.html
http://drafty.org/~ahmad_3139/files/freepersonals.html
http://drowse.org/~ahmad_3139/files/rentalcars.html
http://drubbing.org/~ahmad_3139/files/classicfords.html
http://earliness.org/~ahmad_3139/files/dodgedurango.html
http://edulcoration.org/~ahmad_3139/files/smokingfetish.html
http://effectivepower.org/~ahmad_3139/files/internetdating.html
http://effervesence.org/~ahmad_3139/files/babyfurniture.html
http://bestqueerguy.org/~ahmad_3139/files/freegaygalleries.html
http://glbtqueer.org/~ahmad_3139/files/gayporn.html
http://greatgayboy.org/~ahmad_3139/files/freegaygalleries.html
http://isaqueersite.org/~ahmad_3139/files/menwearinghighheels.html
http://myqueersite.org/~ahmad_3139/files/gaybears.html
http://queereyetour.org/~ahmad_3139/files/gaysexpositions.html
http://queersouth.org/~ahmad_3139/files/gayyaoi.html
http://supergayboy.org/~ahmad_3139/files/gaypersonals.html
http://thegayblack.org/~ahmad_3139/files/gaysex.html
http://yourqueereye.org/~ahmad_3139/files/boy.html
http://alltwinkworld.org/~ahmad_3139/files/dadandsongaysex.html
http://bestgayteen.org/~ahmad_3139/files/malesex.html
http://boytoytwink.org/~ahmad_3139/files/gayvideos.html
http://sexgayworld.org/~ahmad_3139/files/marvingaye.html
http://supertwinkfan.org/~ahmad_3139/files/bestmanspeech.html
http://twinkboynet.org/~ahmad_3139/files/freegayporn.html
http://ablackstud.org/~ahmad_3139/files/bluemangroup.html
http://beststudfarm.org/~ahmad_3139/files/gaydar.html
http://twinkfanclub.org/~ahmad_3139/files/gaypics.html
http://mrsuperstud.org/~ahmad_3139/files/malepornstars.html
http://efficiently.org/~ahmad_3139/files/amatuers.html
http://proapproval.org/~ahmad_3139/files/fingerfucking.html
http://brazilmen.org/~ahmad_3139/files/adultdating.html
http://trustedlocation.com/~ahmad_3139/files/interracialdating.html
http://trustedplace.com/~ahmad_3139/files/yahoopersonals.html
http://trustedsiteguide.com/~ahmad_3139/files/amatuers.html
http://besttwink.org/~ahmad_3139/files/marvingaye.html
http://freetwinkscoupon.org/~ahmad_3139/files/gaychat.html
http://greattwinkspic.org/~ahmad_3139/files/menhavingsexwithanimals.html
http://hotcybertwinks.org/~ahmad_3139/files/men.html
http://twinksdirect.org/~ahmad_3139/files/twinks.html
http://twinksguide.org/~ahmad_3139/files/gaywrestling.html
http://twinksyoung.org/~ahmad_3139/files/meninunderwear.html
http://wwwsupertwinks.org/~ahmad_3139/files/gayunderwear.html
http://yourtwinksgay.org/~ahmad_3139/files/gaydick.html
http://ufaman.org/~ahmad_3139/files/teenchat1319.html
http://semantically.org/~ahmad_3139/files/wives.html
http://semiactive.org/~ahmad_3139/files/ringtones.html
http://semidry.org/~ahmad_3139/files/meetthefockers.html
http://semifixed.org/~ahmad_3139/files/cellphonenumbersearch.html
http://signification.org/~ahmad_3139/files/latinpussy.html
http://pantomimist.org/~ahmad_3139/files/incestsexstories.html
http://ceolivechat.org/~ahmad_3139/files/datingservices.html
http://teenchattv.org/~ahmad_3139/files/
http://livechatplaza.org/~ahmad_3139/files/isonlinedatingcheating.html
http://chatlinksite.org/~ahmad_3139/files/isnellyandashantidating.html
http://pabular.org/~ahmad_3139/files/cuckoldinterracial.html
http://pacifically.org/~ahmad_3139/files/homemadesextoys.html
http://paged.org/~ahmad_3139/files/maturebabes.html
http://semifixed.org/~ahmad_3139/files/cellphonecases.html
http://semifrozen.org/~ahmad_3139/files/verizonringtones.html
http://ufaman.org/~ahmad_3139/files/amateurgangbang.html
http://ineffect.org/~ahmad_3139/files/clonazepam.html
http://infull.org/~ahmad_3139/files/celexa.html
http://bestslotsfree.org/~ahmad_3139/files/blackjack.html
http://bestbeachblog.org/~ahmad_3139/files/internetcasino.html
http://bestgayhost.org/~ahmad_3139/files/gayincest.html
http://lugubrious.org/~ahmad_3139/files/nextdoornikki.html
http://payorder.org/~ahmad_3139/files/teenchatrooms.html
http://permissibly.org/~ahmad_3139/files/chatroom.html
http://permitholder.org/~ahmad_3139/files/amateur.html
http://phenonmenon.org/~ahmad_3139/files/swinging.html
http://hostelry.org/~ahmad_3139/files/musiciansfriend.html
http://hotshort.org/~ahmad_3139/files/amaturepages.html
http://multiaddress.org/~ahmad_3139/files/amatuers.html
http://inparameter.org/~ahmad_3139/files/medicaldictionary.html
http://finalconsumption.org/~ahmad_3139/files/ciprofloxacin.html
http://finalpay.com/~ahmad_3139/files/drugstorecom.html
http://blogsadice.org/~ahmad_3139/files/amaturepages.html
http://blogsdiaries.org/~ahmad_3139/files/friendfinder.html
http://blogsjournals.org/~ahmad_3139/files/trucchattechaleur.html
http://blogstal.org/couplesswapping.html
http://canadamoblogs.org/boymeetsworld.html
http://cheapestmoblogs.org/datingservice.html
http://flashmoblogs.org/americandatingcustoms.html
http://moblogscentral.org/isportiaderossidatingellen.html
http://diariesworld.org/americandatingsites.html
http://journalssite.org/isonlinedatingsafe.html
http://airfriendsclub.org/h4wives.html
http://alloldfriends.org/ukdesperatehousewives.html
http://bestcollegefriends.org/memberswivesinpantyhosecom.html
http://buddiesfriends.org/disciplinedwives.html
http://friendsbuddies.org/yucodesperatehousewives.html
http://friendspals.org/2wives.html
http://mateswood.org/e4desperatehousewives.html
http://oldfriendsinc.org/ukdesperatehousewives.html
http://ouroldfriends.org/homegrownwives.html
http://palsfriends.org/whyhusbandscheatontheirwives.html
http://venial.org/freedietplans.html
http://krakozyabra.org/medications.html
http://exciseduty.org/naproxen.html
http://articulately.org/medicalabbreviations.html
http://ewivesclub.org/longislandswingdance.html
http://hotrealwives.org/exchange2000swingmigration.html
http://mrsswives.org/isswinginglegal.html
http://therosswives.org/billswingle.html
http://wivessite.org/exchange2003swingmigration.html
http://wiveswho.org/northwestswingersclubs.html
http://youngcheatingwives.org/discswing.html
http://youngwivesclub.org/
http://bestfrenchdating.org/thesongmyboyfriendsback.html
http://bestjapanesedating.org/yournumberisonmygirlfriendsphonebill.html
http://bestthailanddating.org/quotesaboutyourbestfriends.html
http://courtingfree.org/
http://matchmakingcourting.org/earthfriendlyfarmfriendly.html
http://meetingpersonals.org/ihadagirlfriendlyrics.html
http://premierdatingsites.org/marlborofriendsmeeting.html
http://superdatingdirect.org/
http://theultimatedating.org/quotesaboutyourfriends.html
http://catholicfamilycamping.org/longislandcatholicdiocese.html
http://catholicfamilytours.org/islentforcatholics.html
http://catholicfamilytravel.org/indianacatholicschools.html
http://religiondiocese.org/northumberlandcatholicschool.html
http://religionfamily.org/americancatholicpress.html
http://romancatholicworld.org/discernmentcatholic.html
http://supercatholic.org/issmokingasincatholic.html
http://thefirstcatholic.org/whyimacatholic.html
http://tvcatholicchurch.org/northwestcatholicct.html
http://yourreligious.org/whyibecameacatholic.html
http://articulating.org/diet.html
http://cessionary.org/cvspharmacy.html
http://artificially.org/birthcontrolpill.html
http://artificialness.org/drugtests.html
http://artillerist.org/medications.html
http://artilleryman.org/pills.html
http://asagainst.org/potassiumpermanganate.html
http://asfrom.org/realmusicringtones.html
http://asthough.org/freeringtonessamsung.html
http://asyet.org/freeringtones.html
http://ascertainable.org/freeringtones.html
http://ascetically.org/cellphoneringtones.html
http://ascorbic.org/cellphoneringtones.html
http://ascribable.org/freesprintringtones.html
http://aseptically.org/chatavenue.html
http://ashamedly.org/hornyhousewives.html
http://ashoulder.org/passwordtoadultfriendfinder.html
http://asiatics.org/amaturegirls.html
http://asininely.org/freedating.html
http://asininity.org/amateursex.html
http://aspectual.org/amateurfacials.html
http://bestchristianchurch.org/istheagonyscenechristian.html
http://christianartsacademy.org/issoulflychristian.html
http://christianbusinessmall.org/ispodachristianband.html
http://freechristianchurch.org/isthriceachristianband.html
http://greatchristianschool.org/thesongchristianradiostation.html
http://ourchristianschool.org/northwesternchristianbookstores.html
http://pachristianschool.org/isterrellowensachristian.html
http://superchristianschool.org/isthecallingachristianband.html
http://yourchristianchurch.org/isthepopechristian.html
http://yourchristiansingles.org/whyisjerusalemimportanttothechristians.html
http://greatjewish.org/isrupertmurdochjewish.html
http://ijewishmusic.org/israchelbilsonjewish.html
http://jewishgiftonline.org/isparishiltonjewish.html
http://nicereligion.org/issarahmichellegellarjewish.html
http://religionsingle.org/ispetesamprasjewish.html
http://superjewish.org/isscarlettjohanssonjewish.html
http://thejewishcentre.org/issamwaltonjewish.html
http://thejewishgenome.org/israchelweiszjewish.html
http://thejewishhat.org/isringostarrjewish.html
http://bestflirting.org/bestfriendsong.html
http://bestflirtingsignals.org/iwantyourgirlfriendlyrics.html
http://fabulousflirtingtip.org/iwanttobeyourgirlfriendlyrics.html
http://flirtingsite.org/1boyfriend.html
http://freeflirtingtip.org/membersmyfriendshotmomcom.html
http://isheflirting.org/whyfriendshipsfail.html
http://superflirtingtip.org/homeinvitechatmyprofilefriends.html
http://teenflirtingtip.org/whyhonestyisimportantinafriendship.html
http://theflirting.org/quotesfromfriendstv.html
http://theflirtingthing.org/sharjacksonnewboyfriend.html
http://datenetmatch.org/
http://hotmatchlife.org/
http://matchclub.org/matchstickmenandmatchstickcatsanddogs.html
http://matchcommunity.org/theskinbitmapwasnotfoundmusicmatch.html
http://matchforum.org/shardtrackerversionmismatch.html
http://matchreviews.org/matchbox20longdaytab.html
http://matchsite.org/2matchu.html
http://freeagentmarriage.org/isthereamarriagepenalty.html
http://greatmarriagebook.org/thesixtyminutemarriage.html
http://lawwedding.org/whygaymarriagesshouldbebanned.html
http://marriageonlinenow.org/istomcruisesmarriagehangingbyathread.html
http://mygreatmarriage.org/ismarriageoutofdate.html
http://themarriageview.org/whyismarriagesoimportant.html
http://thepowermarriage.org/whyismarriageimportant.html
http://therealmarriage.org/whyisgaymarriagewrong.html
http://topmarriagesite.org/
http://bigcitywedding.org/weddingreceptionmansfieldohio.html
http://assimilable.org/marriagecelebrant.html
http://assister.org/amatuer.html
http://assize.org/psychicchatonline.html
http://bestmailaddress.org/roadrunneremailcfl.html
http://aspersions.org/wifelover.html
http://asported.org/hotwives.html
http://assents.org/amatuerpages.html
http://asserted.org/secretfriends.html
http://assiduities.org/yahoochat.html
http://assizes.org/nokiaringtones.html
http://atomization.org/freeverizonringtones.html
http://attainder.org/freeringtones.html
http://attaint.org/freecingularringtones.html

For the naysayers that whine that blocking spam is hard, you can see for yourself it's not THAT hard and these idiots can be easily stopped.

Now go whine some more while I bask in the comfort of automatic spam stopping.

Danger and Avantgo mobile devices passed the test

Couple of the mobile providers Danger and AvantGo made reasonable user agents, unlike the usual cesspool of mobile user agents, that passed the bot blocker without slamming into a brick wall.

Here's their user agents:

Mozilla/5.0 (Danger hiptop 2.0; U; AvantGo 3.2)

Mozilla/4.0 (compatible; AvantGo 6.0; FreeBSD)

Wow, look at that, simple, straightforward, what a concept.

Will the real Google please stand up?

The same lame attempts to crawl as "google" always come from the same IP's in China all the time so I decided to take a look and see what else these brain damaged fart knockers were doing.

Here's the wannabe-Googlers from China:

61.135.134.99 "google"
61.135.131.122 "google"
220.181.20.41 "google"
220.181.20.42 "google"
220.181.26.73 "google"

So I looked a little deeper to see what else they were calling themselves and got the following:

Activity in the 61.135.131.* block:

61.135.131.122 google
61.135.131.173 ""
61.135.131.173 sohu agent

Activity in the 220.181.26.* block:

220.181.26.73 "google"
220.181.26.79 "sogou spider"
220.181.26.103 ""
220.181.26.103 "sohu agent"
220.181.26.115 ""
220.181.26.115 "sogou spider"
220.181.26.116 "sogou spider"
220.181.26.121 ""
220.181.26.121 "sogou spider"

Looks like same exact bullshit being run from two blocks of IP's so zap their ass and have a nice day.

GoDaddy Suspended DesertWalls

A couple of weeks ago I reported 1&1 Web Host Goes Spamming and now GoDaddy appears to have suspended the source of the spam which was DesertWalls.com.

Registrant:
Total solutions
4520 Ficus Tree Road
Boynton beach, Florida 33436
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: DESERTWALLS.COM
Created on: 10-Jul-06
Expires on: 11-Jul-07
Last Updated on: 10-Jul-06

Administrative Contact:
Cohen, Bruce mohi@gate.net
Total solutions
4520 Ficus Tree Road
Boynton beach, Florida 33436
United States
(561) 734-8122

Domain servers in listed order:
NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM
NS2.SUSPENDED-FOR.SPAM-AND-ABUSE.COM

Not that it really solves any problems as the spammers will just factor the $10 domain names into the cost of doing business but it's nice to see them being punished just a little.

LinkTiger Declawed

Another fucking link checker, there are so many I barely mention them anymore but something called LinkTiger had good headline potential.

Blah.

Here's da shit:

72.22.64.242 - "Mozilla/5.0 (compatible; linktiger/1.0; +http://www.linktiger.com/)

Didn't ask for robots.txt, some do, some don't, and is hosted on the dedicated server jungle at ipowerweb.com which is another worthwhile place to block:

OrgName: iPowerWeb, Inc.
NetRange: 72.22.64.0 - 72.22.95.255

Sorry LinkTiger, my Serengeti is off limits to you.

Taggers Target Their Ass With My Foot

Some bullshit crawler called "TargetYourNews.com bot" from the Land Down Under looks at robots.txt with the lame ass default user agent of the Python library before exposing their actual user agent.

72.36.160.114 - "GET /robots.txt" "Python-urllib/1.16"

72.36.160.114 - "GET /" "http://TargetYourNews.com/?cmd=targeting&urlid=xxx" "TargetYourNews.com bot"

Reverse DNS of the IP resolves to collabrank.org which redirects to toptaggers.com which is a bunch of Digg wannabe mother fuckers and the bot claims it's crawling for TargetYourNews.com and it all looks related, boring as hell, who gives a fuck.

Go fuck a kangaroo and keep my server out of your mental masturbation clusterfuck operation as I don't want to be digged, dugg or tagged, just piss off.

Ah, I feel better now.

Block Browsezilla malware

This so-called browser named Browsezilla used to get onto my site with the old UA:

"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Browsezilla; .NET CLR 1.1.4322)"

Then those obnoxious assholes stepped it up a level by inserting a goddamn HTML hyperlink into the UA which my bot blocker stops instantly thinking it's referrer spam.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; <a href=http://browsezilla.org>Browsezilla </a>)

Almost felt bad for the assholes using this shit browser being blocked and almost unblocked it for them, but decided to do a little research first and HOLY SHIT this thing appears to be evil.

Read this InternetNews alert and this Panda alert and this detailed post by Oliver on a NotePet and you'll probably agree it's a good idea all around just to block Browsezilla so their users will abandon this fucking malware before it's an epidemic

I'm thinking it's best left blocked and possibly redirected to the InternetNews article to scare the shit out of people using the damn thing.

EmeraldPantyShield

Nothing pisses me off more than some company like EmeralShield sending a bot that masks who they are when they request robots.txt files and then proceeds to crawl with the actual user agent name.

Look at this shit:

82.165.186.202 - "GET /robots.txt" "-" "-"

82.165.186.202 - "GET /" "EmeraldShield.com Web Spider (http://www.emeraldshield.com/webbot.aspx)"

I was curious who these dumb fucks were so I checked and found a thread on WebmasterWorld and then some bigger horseshit in their forum.

We also use the webbot with our web filter service. Customers visit sites that we don't know about and we use the webbot to go and dig the site. In this case we are looking primarily to filter porn for our customers. The site pages that are downloaded are fed into a scan engine that attempts to determine if the site is objectionable or not.

Well dig this, your customers can grow the fuck up and be adults about the 'net as you aren't digging my fucking website as I have too many little piss ants like your crawler all trying to get a piece of my website so you get ... NOTHING! NOT A SINGLE FUCKING PAGE!

Dig that?

I bet not.

Crayon Crawler Outside the Lines

I can't determine if the supposedly kid friendly Crayon Crawler is a crawler or the browser, their site is down in flames at the moment, but anyone stupid enough to put the word CRAWLER in the user agent deserves to get dumped anyway.

Probably a browser, who cares:

64.62.18.59 "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; Crayon Crawler)"

71.212.59.132 "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Crayon Crawler; FunWebProducts; .NET CLR 1.1.4322; MSN 9.0;MSN 9.1; MSNbQ002; MSNmen-us; MSNcOTH; MPLUS)"

64.12.116.14 "Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1; Crayon Crawler; SV1)"

Don't need any snotty faced zip-popping brats on my site anyway.

Blah.

Finding Cellphone User Agents Rosetta Stone

I'm sure I could upgrade how I process user agents to accomodate all these mobile freaks that can't tear themselves away from the internet but I'm not sure I want to mess with it.

In order to lock out most of the bad bots I only allow user agents that start with "Mozilla/" or "Opera/" as the very first part of the string which seems to work real well.

Well, unfortunately the assholes that make cellphones don't seem to give a shit about fitting into an easily identifiable group of browsers and have a bazillion user agents.

Something like this doesn't even fit the mobile user agent definitions:

HTC-8100/1.2 Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; PPC; 240x320) UP.Link/6.3.0.0.0"

The only upside here is this one tells us it's screen size in the UA which is useful to know.

Why can't all of these dickheads at least do ONE THING in the user agent that just screams out "THIS A WIRELESS DEVICE OR CELLPHONE" like prefixing them all with "WAP/" or something civilized like that instead of having to know all the goddamn vendors and part numbers?

The closest thing I came to finding a reasonably identifiable fingerprint for a mobile device was looking for "Profile/MIDP", "MMP/" or "Configuration/CLDC" which seem to be a few good checks for most things mobile.

Just look at examples of all this gibberish:

Nokia6600/1.0 (4.09.1) SymbianOS/7.0s Series60/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.0

Samsung-SPHA880 AU-MIC-A880/2.0 MMP/2.0 Profile/MIDP-2.0 Configuration/CLDC-1.1

SANYO-S750/2.130 UP.Browser/7.0.2.1.sn.1.222 (GUI) MMP/2.0

BlackBerry8700/4.1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 VendorID/102

SonyEricssonP900/R102 Profile/MIDP-2.0 Configuration/CLDC-1.0

MOT-C650/0B.D2.23R MIB/2.2.1 Profile/MIDP-2.0 Configuration/CLDC-1.0 (Google WAP Proxy/1.0

Vodafone/1.0/703SH/SHG001 Browser/UP.Browser/7.0.2.1 Profile/MIDP-2.0 Configuration/CLDC-1.1 Ext-J-Profile/JSCL-1.2.2 Ext-V-Profile/VSCL-2.0.0

SCH-A950 UP.Browser/6.2.3.2 (GUI) MMP/2.0

LGE-PM225/1.0 UP.Browser/6.2.3.7.e.1.101 (GUI) MMP/2.0

SHARP-TQ-GX25/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.0 UP.Browser/6.2.3.3.d.1.109 (GUI) MMP/2.0 UP.Link/6.3.1.13.0

and on and on and on...

Yeah, I read the spec on wireless user agents and it's just a big old fucking mess of gibberish that opens the door for scrapers to pretend they're cell phones with javascript disabled and scrape the fuck out of a website.

Well you could argue that wireless devices don't use too many pages so just limit their access and I'll counter that containment method with a shitload of anonymous proxies and/or a small fleet of $2/month hosting accounts.

The problem with blocking proxies is just about all of these freaking toys with browsers use proxy servers to convert web pages to a few lines of links and text so just blocking any old proxy they use will typically block them altogether.

It's a gaping hole that can barely be contained and my best strategy to date is by only allowing these devices access via IP's that resolve to wireless service providers which is sketchy at best.

Why is this sketchy?

Someone can scrape over a 3G network at speeds of 400K-700K or better.

Not highly likely, but definitely probable and easily doable.

I'm getting annoyed as the tighter I make the noose, the more obvious it's weaknesses thanks to the swiss cheese that is the internet and all the bungling engineers.

It's a prime example of that old technology law:
"If builders built buildings the way programmers wrote programs, then the first woodpecker that came along would destroy civilization"

Roffle from CCBill

I keep getting hit by this bizarre user agent Roffle and there isn't much information at all that I can find about this on the net as it doesn't even appear in most of the user agent resource sites.

Here's what I know about it:

64.38.240.97 "Roffle/l.ol(compatible; MSIE 6.0; Windows NT 5.0;"

In my case it always crawls from the same IP address which oddly enough is owned by CCBill LLC:

whois 64.38.240.97
CCBill LLC CCBILL-PRODUCTION-SYSTEM (NET-64-38-240-0-1)
64.38.240.0 - 64.38.240.255

whois NET-64-38-240-0-1

OrgName: CCBill LLC
OrgID: CCBIL
Address: 1501 W 17th St
City: Tempe
StateProv: AZ
PostalCode: 85281
Country: US

NetRange: 64.38.240.0 - 64.38.240.255
CIDR: 64.38.240.0/24
NetName: CCBILL-PRODUCTION-SYSTEM

So why in the hell does an internet billing system have a bot crawling the net?

Guess I could ask them, but that's not as much fun as figuring it out with clues on the net!

Scrapers Switching Bot Software

Here's another example of a scraper that switched software. This time the scraper went from something using random user agents to some other bot that's detectable because of the "compatible ;" flaw, note the space before the semicolon, in the user agent making it easily blockable.

07/13/2006 12.30.91.69 "4jkjhm4lgkualkihgfm nSriexn"
07/13/2006 12.30.91.69 "gu EeoiEmwbrqufoktaitgirh3sso3Ex"
07/13/2006 12.30.91.69 "yjiu k4smuqlvj4qreip l em4vjngywrv"
07/13/2006 12.30.91.69 "tfdgevSbyefsSoevhrrr"
07/14/2006 12.30.91.69 "c xqxrwgt kfrod oUwxmqxbooewtUrxgUplr"
07/14/2006 12.30.91.69 "agnesmynnlihdiunsutxxn5skoY5jsgmx"
07/14/2006 12.30.91.69 "aqtcc2dfklcrdymQQlhqclpcx2km2"
07/14/2006 12.30.91.69 "nBnwsmracuwd7ovdnmgnora"
07/14/2006 12.30.91.69 "vuqWfxtekvxi8relwfx8ejrto"
07/14/2006 12.30.91.69 "9fxebywuwjbpdbfnesfvpqygondkiqtrfdkaskj"
07/14/2006 12.30.91.69 "mst xfwkpktrkfymy2owm wu2"
07/14/2006 12.30.91.69 "xdgdmncxnhjqrvudftxnyrqwqyfiecdclqpmg"
07/14/2006 12.30.91.69 "5sieornr5ksjimfykxyoimyyfuedthnyuuijeb"
07/14/2006 12.30.91.69 "vhryqjhtkmpysfwhmrfcfotgkkkvQdjvtdgyr h"
07/17/2006 12.30.91.69 "ahBuu0xghlmhxaketqo0jjuyxxqxugilvtciso"
07/17/2006 12.30.91.69 "modJjnbqrprdhbwJcpohw prj4"
07/22/2006 12.30.91.69 "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
07/22/2006 12.30.91.69 "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"

This is a prime example of why I advocate tracking where the little scumbags operate opposed to just blocking by user agent as this cable client might upgrade to something even better and slide under my radar next time.

Another one I spotted switched from something in Java to the "compatible ;" bot:

62.194.21.116 Java/1.4.1_04
62.194.21.116 "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"

I'm sure there's more, still compiling the results, should be interesting.

Huge Yahoo SERP Upheavals or just a Tweak?

The other day I was posting a about my position in Yahoo for the silly term "Lava Pockets" and suddenly today it shot all the way down to #133. I see our old snack food friend Hot Pockets is still holding strong at #20 but they dropped the hammer on my ass.

Could it be they got pissed at my post and gave me a hand job?

Probably not because I started looking around and noticed someone on WebmasterWorld posted today about many blogs appear to have plunged suddenly in Yahoo and others suggested it was a tweak. Not sure it's just a tweak as some of my SERPs not related to any blogs moved up and down all over the place.

Looks like Yahoo has installed the new much anticipated "amusement park" algorithm as that's the only explanation I can find for the constant rollercoaster results this month.

Stay tuned as Yahoo's next algorithm is rumored to be tied to their stock price.

Robots, Spiders and Dumbass Delphi Clients, OH MY!

Never heard of this one but out of the blue someone in France hit me with TALWinHttpClient which is some Delphi plug-in and the French must be the only ones still clinging to Delphi as nobody worth a hookers time still uses that shit.

86.202.105.134 [ANice-152-1-99-134.w86-202.abo.wanadoo.fr.] requested 1 pages as "Mozilla/3.0 (compatible; TALWinHttpClient)"

Figures, something comes crawling from France and puts up a white flag after just one page.

C'est la vie.

VIVA LA GUERRE DES BOTS!

Double Agent Trapped by Bot Blocker

The title wouldn't be so funny except this double agent originated from the Defense Contract Management Agency (DCMA).

Here's the user agent string that caused the problem:

144.183.226.xxx [xxx.dcma.mil.] requested 2 pages as "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 (compatible; MSIE 3.3; Windows NT; DCMA 5.5 r.2.0); .NET CLR 1.0.3705; .NET CLR 1.1.4322; InfoPath.1)"

Anyone notice the double agent in the string?

It was the second "Windows NT;" without the version number, which is technically invalid, that caused them to get snared.

Oopsy, military intelligence stikes again.

Just hope whoever did that doesn't contribute code to the missile defense systems!

MetagerBot powered by Exalead - First Look

Looks like I'm on the bleeding edge with MetagerBot as there's almost a void of information about this bot that comes calling from the University of Hannover.

130.75.2.12 [kursix.rrzn.uni-hannover.de.] requested 1 pages as "MetagerBot/0.8-dev (MetagerBot; http://metager.de; )"

The part that I'm confused about is what do they need their own bot for as they're claiming to be a meta search engine powered by Exalead?

Some references indicated they were using [big shock] nutch:

metagerbot/0.8-dev-mnebel-20050827 (mgbot; http://metager.de/; __nutch-agent@metager.de)

Played around with their search for a bit and it did cough up a few new things of interest I hadn't encountered, but it was slower than shit most of the time and waiting on results can be a bit tedious.

So does this mean we should let Exalead crawl?

No clue.

StupidHijacking

Here's a simple example of how the proxy sites hijack listings.

72.51.33.237 [server1.stupidcensorship.com.] requested 2 pages as "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Yes, that was really Googlebot that tried to crawl my server via the proxy hosted on that server.

Amazingly you won't see any links for Google to crawl my site or any other site via this proxy server which is why I always assume there is a cloaked list of URLs being fed to Google as this happens all the time from all sorts of proxy sites of this type.

Cell Phone ALMOST passed the test

With the myriad of cellphone user agents it's almost impossible to track them but this one ALMOST got thru with a minor exception:

The user agent was:

"Dopod818Pro/Mozilla/4.0 (compatible; MSIE 4.01; Windows CE; PPC; 240x320; Dopod818 Pro)"

If they hadn't redundantly put "Dopod818Pro/" on the front it would've passed thru to the website.

Oh well, better luck next time.

ActiveTouristBot - First Look

Welcome to the wonderful world of dumb fucking robots that haven't a goddamn clue.

Maybe ActiveTourist was attempting referrer spam as I have no idea what this digital dungheap was actually doing.

See for yourself:

80.229.187.190 -"GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 -"GET /AnActualFuckingPage.html HTTP/1.1" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /AnotherFuckingPage.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /TheFuckOffMyServer.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /YourHeadOutOfYourAss.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /robots.txt" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /MoreRobotsTxtFilesYummy.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /MoreShitYouArentGetting.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"
80.229.187.190 - "GET /AFuckingClue.html" "Mozilla/4.0 (ActiveTouristBot V1.2 ;http://www.activetourist.com)"

This spastic fucking bot eats robot.txt files like they're candy.

Didn't find any specific information on that tragedy they call a website about what they even support in robots.txt, but it doesn't really matter as they got nothing from me except a place of honor on my blog.

Hooters Casino Crawling or Breached?

This is the same exact scenario that I saw with the Tireman site and several others.

All dedicated servers, yet the SAME crawler with the exact same behavior is operating from this server:

24.120.182.161 [mail.hooterslv.com.] requested 29 pages as "Java/1.4.2_06"

I don't think these are a coincidence as it's starting to look like a botnet of some sort, perhaps spambot scrapers, no clue what they're looking for at this point.