Bad Bot: Cheeky Scraper campaign, then login attempts

These five lot came on my site with a innocent but fake User Agent name of “Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)”, scraped some documents, and then proceeded to try to break into my site’s security. Cheeky bastards.

Seven attempts at document scraping, followed by 9 attempted logins. The interesting thing is that when you use a computer to do these campaigns, if you are not clever they really do look like a computer generated attempt and are thus easy to identify. Which user would have this behaviour? Of course they have all been banned.

69.160.59.136 avenger.nexcess.net 69.160.48.0 – 69.160.63.255 NEXCESS, US
96.30.34.92 host.roldco.com 96.30.0.0 – 96.30.63.255 WIREDTREE Cogswell Enterprises, US
176.67.160.10 nwfportal.co.uk 176.67.160.0 – 176.67.160.255 UK2, Uk
203.192.102.105 inkoc203192102105.itakita.net 203.192.96.0 – 203.192.127.255 Kitaura Hana, Jp
216.245.199.234 mail.abbacus.in 216.245.192.0 – 216.245.223.255 Limestone Networks, US

I cannot seem to be able to make any connection between these five dissimilar IP addresses, with five separate hosts, but all using the same technique. The user agents are either Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) or Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4

These 5 Ip addresses first scraped me with a fake UA of Googlebot, and then proceeded to try to break into my site. Toronto, Canada

69.160.59.136	[06/Dec/2016:08:42:33	GET /wp/wp-login.php HTTP/1.0	200	2566	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:37	GET /wp/?author=1 HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:41	GET /wp/author/admin/ HTTP/1.1	200	50416	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:45	GET /wp/?author=2 HTTP/1.1	200	19861	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:48	GET /wp/?author=3 HTTP/1.1	404	19574	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:52	GET /wp/?feed=atom HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:55	GET /wp/feed/atom/ HTTP/1.1	200	74996	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
69.160.59.136	[06/Dec/2016:08:42:59	POST /wp/wp-login.php HTTP/1.0	200	2797	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:03	POST /wp/wp-login.php HTTP/1.0	200	2798	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:07	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:11	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:14	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:18	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:22	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:26	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
69.160.59.136	[06/Dec/2016:08:43:30	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:07	GET /wp/wp-login.php HTTP/1.0	200	2566	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:11	GET /wp/?author=1 HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:15	GET /wp/author/admin/ HTTP/1.1	200	50416	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:19	GET /wp/?author=2 HTTP/1.1	200	19861	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:22	GET /wp/?author=3 HTTP/1.1	404	19574	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:26	GET /wp/?feed=atom HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:29	GET /wp/feed/atom/ HTTP/1.1	200	74996	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
96.30.34.92	[06/Dec/2016:06:40:33	POST /wp/wp-login.php HTTP/1.0	200	2797	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:37	POST /wp/wp-login.php HTTP/1.0	200	2798	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:41	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:45	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:48	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:52	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:40:56	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:41:00	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
96.30.34.92	[06/Dec/2016:06:41:04	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:32:50	GET /wp/wp-login.php HTTP/1.0	200	2566	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:32:54	GET /wp/?author=1 HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:32:58	GET /wp/author/admin/ HTTP/1.1	200	50416	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:33:02	GET /wp/?author=2 HTTP/1.1	200	19861	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:33:05	GET /wp/?author=3 HTTP/1.1	404	19574	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:33:09	GET /wp/?feed=atom HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:33:13	GET /wp/feed/atom/ HTTP/1.1	200	74996	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
176.67.160.10	[06/Dec/2016:21:33:17	POST /wp/wp-login.php HTTP/1.0	200	2797	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:21	POST /wp/wp-login.php HTTP/1.0	200	2798	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:25	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:29	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:33	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:37	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:41	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:45	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
176.67.160.10	[06/Dec/2016:21:33:49	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:35:31	GET /wp/wp-login.php HTTP/1.0	200	2566	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:37	GET /wp/?author=1 HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:41	GET /wp/author/admin/ HTTP/1.1	200	50416	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:45	GET /wp/?author=2 HTTP/1.1	200	19861	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:49	GET /wp/?author=3 HTTP/1.1	404	19574	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:53	GET /wp/?feed=atom HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:35:56	GET /wp/feed/atom/ HTTP/1.1	200	74996	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
203.192.102.105	[06/Dec/2016:03:36:01	POST /wp/wp-login.php HTTP/1.0	200	2797	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:05	POST /wp/wp-login.php HTTP/1.0	200	2798	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:09	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:14	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:18	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:23	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:28	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:32	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
203.192.102.105	[06/Dec/2016:03:36:38	POST /wp/wp-login.php HTTP/1.0	200	2812	Mozilla/5.0 (iPad; CPU OS 9_2_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/5.3.48993 Mobile/13D15 Safari/600.1.4
216.245.199.234	[05/Dec/2016:09:02:47	GET /wp/wp-login.php HTTP/1.0	200	2566	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:48	GET /wp/?author=1 HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:48	GET /wp/author/admin/ HTTP/1.1	200	50373	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:49	GET /wp/?author=2 HTTP/1.1	200	19818	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:49	GET /wp/?author=3 HTTP/1.1	404	19531	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:50	GET /wp/?feed=atom HTTP/1.1	301	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:50	GET /wp/feed/atom/ HTTP/1.1	200	74996	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:51	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:51	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:51	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
216.245.199.234	[05/Dec/2016:09:02:52	POST /wp/wp-login.php HTTP/1.0	404	-	Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

Related posts:

Leave a Reply