Forum Moderators: open
Someone requested help locating the PicScout image copyright crawler and I've dug up some data and hope someone else can confirm this activity on other servers, especially if you have a lot of photos.
Since there was NO information on the net about them, no user agent, nothing, I started with their domain name and where it was hosted.
host picscout.com
picscout.com has address 82.80.254.37host 82.80.254.37
37.254.80.82.in-addr.arpa domain name pointer bzq-80-254-37.dcenter.bezeqint.net.inetnum: 82.80.248.0 - 82.80.255.255
netname: BEZEQINT-HOSTING
descr: BEZEQINT-HOSTING
country: IL
This led to a list of high volume crawling from these IP's in that range that was trapped by my bot blocker automatically and they never answered the challenges, so it was definitely bot traffic.
82.80.249.195
82.80.249.196
82.80.249.197
82.80.249.201
82.80.249.202
82.80.249.203
82.80.249.204
82.80.252.130
These IPs have only been spotted using the two following user agents:
Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; (R1 1.1); .NET CLR 1.1.4322)
After posting that data on my blog, PicScout hit my site 5 times from this IP block:
inetnum: 62.0.8.0 - 62.0.8.255
netname: NV-PICSCOUT
descr: NV-PICSCOUT
country: IL
admin-c: OG570-RIPE
tech-c: NN105-RIPE
status: ASSIGNED PA
mnt-by: NV-MNT-RIPE
mnt-lower: NV-MNT-RIPE
source: RIPE # Filtered
Anything anyone can confirm on either range of IPs would be great.
Anyone?
Anything?
82.80.249.193 - - [09/Aug/2006:02:48:21 -0400] "GET / HTTP/1.1" 200 29019 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; (R1 1.1); .NET CLR 1.1.4322)"
82.80.249.193 - - [09/Aug/2006:02:48:23 -0400] "GET / HTTP/1.1" 200 29019 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)"
82.80.249.193 - - [09/Aug/2006:02:48:24 -0400] "GET /logo.gif HTTP/1.1" 403 471 "-" "-"
Hopefully, someone with more traffic can contribute more/better info than I can.
Jim
No traffic from the second -62.0.8.0-255
malformed NT 5.1 UA
That one was blocked, they saw no pages, I used passive blocking so I can still track activity attempts. That was from 82.80.252.130 and I don't think that was them, but it was in the same general range so who knows.
Other than that one IP, I think it sounds like we're on the right trail.
Other than that one IP, I think it sounds like we're on the right trail.
Bill,
As I have the majority of both RIPE and APNIC denied any feed back from me would be useless.
I utilize:
deny from 62.
deny from 82.
(and many more).
That's my own choice and NOT for every webmaster.
