siteintel.net

Forum Moderators: open

Message Too Old, No Replies

siteintel.net

Bot-running bad Opera

Pfui

11:31 pm on Aug 31, 2011 (gmt 0)

siteintel.net
= 213.133.111.12 [projecthoneypot.org...]
= static.213-133-111-12.clients.your-server.de

Asks for robots.txt, then ignores:

15:55:37 /robots.txt (200)
15:55:38 / (403)

UA is coded in quotes (das ist dumm) --

"Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"

-- so raw log entries look like:

""Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10""

Germany-based Hetzner [google.com...] and/or your-server.de have been big havens for bad eggs for ages.

Pfui

8:29 pm on Sep 13, 2011 (gmt 0)

Weekly routine now; siteintel.net gets, and ignores, robots.txt:

00:58:14 /robots.txt (200)
00:58:15 / (302 to...)
00:58:22 /botbait/ (200)

"Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.10"

dstiles

9:06 pm on Sep 13, 2011 (gmt 0)

213.133.96/19 is hetzner - once found, permanently blocked.

Pfui

10:59 pm on Sep 21, 2011 (gmt 0)

So much for changing for the better...

The UA's now bot-runner specific but it's still double-double-quoted-quoted, and still ignores robots.txt:

04:45:59 /robots.txt (200)
04:46:01 / (302 to)
04:46:02 /botbait (200)

UA: "http://SiteIntel.net Bot"
(Raw log: ""http://SiteIntel.net Bot"")

Time to simply 403 this unintelligent thing.

lucy24

12:39 am on Sep 22, 2011 (gmt 0)

Time to simply 403 this unintelligent thing.

Hah! And here I thought I was the only one with the "Too stupid to live" category of 403 ;)

Pfui

8:02 pm on Sep 22, 2011 (gmt 0)

Actually, I reserve 127.0.0.1 for "Too stupid to live."

(Muaha-ha)

Pfui

1:56 pm on Nov 14, 2011 (gmt 0)

UA 'corrected' by bot-runner --

static.106.51.9.176.clients.your-server.de [projecthoneypot.org...]
httpl://SiteIntel.net Bot

-- but still asks for robots.txt, then ignores:

01:50:48 /robots.txt (200)
01:50:49 / (302 to...)
01:50:51 /botbait/ (200)

IP = 176.9.51.106 = Hetzner [robtex.com...]

keyplyr

8:44 pm on Nov 14, 2011 (gmt 0)

Nov 14

176.9.51.106
http://SiteIntel.net Bot

Blocked since it's from hetzner/your-server.de

siteintel.net

Bot-running bad Opera

Pfui

Pfui

dstiles

Pfui

lucy24

Pfui

Pfui

keyplyr

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week