Dodgy Verizon Behaviour
I’ve just had 7 IP addresses from Verizon crawl through almost every page on my domain. That is blog.sweetnam.eu, tech.sweetnam.eu, www.sweetnam.eu and sweetnam.eu.
A total of 5368 requests, in 3 hours!
Odd things is that none of the IPs in question were typical crawlers as each IP requested an entire page at a time.
Given that there is 7 IP addresses involved and they are all in sequence I would imagine that a single Verizon customer has something nasty installed.
Here are the IPs (which I have since blocked)
65.208.151.112
65.208.151.113
65.208.151.114
65.208.151.115
65.208.151.116
65.208.151.117
65.208.151.118
The user agent:
“Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)”
Grep of my logs:
robert@cache:/var/log/squid# cat access.log | grep 65.208.151 -c
5368
Whois of IP:
MCI Communications Services, Inc. d/b/a Verizon Business UUNET65 (NET-65-192-0-0-1)
65.192.0.0 – 65.223.255.255
Kintiskton LLC UU-65-208-151-112-D1 (NET-65-208-151-112-1)
65.208.151.112 – 65.208.151.119
Dodgy stuff.
22 queries. 0.494 seconds.
bit more digging…
http://www.botsvsbrowsers.com/ip/65.208.151.112/index.html
owned by a site called MySite. seems like a spam site… ugh…. more spammer sites…
Thought it might have been something like that Tiernan. The crawler was avoiding javascripts.
Won’t be long now before I start blocking Internet explorer 6 and other browsers claiming to be ie 6.
Who ever it is must be paying a fair bit for those 7 IP addresses. last time i checked a static IP with them cost about $50 per month. more even