Who is this? December 27. 2004


Since December 25th at about nine in the morning I've been having some really strange requests to my blog. They are coming from literally hundreds of different IP addresses (all seem to be DSL ip addresses) but all requesting the same few pages.

A tiny white ghost
Human Rights Violations
A Funeral for the Iraqi Civilians
AYEEEE, So much to do
No Lazzies

The only constant (and what I'm using to send them 403 Forbidden messages using mod_rewrite) is the User-Agent:

Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)

I've done some checking and no one has anything to report as far as what these people are doing other than taking up bandwidth. Their User-Agent is prolific over the Internet. I've had over 2000 requests in 2 days from that particular User-Agent and they show no signs of stopping. I'm thinking about redirecting them here just so it takes them a bit do download the page but that wouldn't be nice of me.

The only thing I can guess is they are trying to scrape email addresses from my site. Bastards!

| Top Exits (0)

Vote for articles fresher than 14 days!
Current karma: 0, 0 vote(s) 1384 hits
David  Monday, December 27. 2004 @ 13:19
3 Comments Link to entry

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

No recent news about this at the Internet Storm Center - http://isc.sans.org - but Technorati did come up with some clues that confirm your suspicions:

http://themaingate.net/blog/index.php?p=54
s/he mentions that this particular browser was being blocked to keep spammers out.

http://genfu.org/index.php?p=37
s/he seems particularly elated that s/he blocked a spammer using this browser. i like this blog entry. :-)
#1 Justin (Homepage) on 2004-12-27 15:10 (Reply)
(PS- your comments feed doesn't convert bbcode to html before it sends it)
#1.1 Justin (Homepage) on 2004-12-27 16:35 (Reply)
Hmm... and I thought that was only my email notice that it didn't convert.

I'll look into it.

Thanks!
#1.1.1 David (Homepage) on 2004-12-27 16:37 (Reply)

Add Comment

Enclosing [B][/B] marks text as bold ([B]some words[/B]), underscore are made via [U]some words[/U], italics are made via [I]some words[/I], hyper-links are made via [LINK]URI[/LINK].

Standard emoticons like :-) and ;-) are converted to images.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA