This host name is constantly scraping my site, but when I look it up it does not resolve. Searches on Google reveal that they seem to change their IP address very often. Many other sites are getting spammed and content scraped by this host. I have no alternative than to ban the whole IP range of customer.worldstream.nl.
I read my raw access log and the first column provides me with an IP address or host name. This first column is usually enough to target the specific IP that is errant, and I ban the last IP octet of 256 addresses.
In the case of the host name customer.worldstream.nl, the host command returns unresolved. customer.worldstream.nl seems to keep coming back on a regular basis, scraping images. Google research on them seems to indicate that they change their ip address on a regular basis, maybe in an effort to evade detection? I don’t know.
The final solution is to ban all the IP addresses of worldstream.nl, and this is not easy to find. I could not find a list of all the worldstream.nl IPs on the internet. Yes, you can WHOIS a specific IP address, but start with a host name and you cannot go backwards and find IP addresses. Anyway, manually researching backwards, here is my list. I will ban all these IP ranges.
93.190.136.0 – 93.190.143.255 93.190.136.0/21
109.236.80.0 – 109.236.95.255 109.236.80.0/20
217.23.0.0 – 217.23.15.255 217.23.0.0/20
I realize that this locks out a huge number of IP addresses, which is not fair to all those that use worldstrean.nl for their internet.
Observations:
93.190.141.209 customer.worldstream.nl 2017-feb-12
109.236.81.168 customer.worldstream.nl 2016-dec-16
109.236.86.17 customer.worldstream.nl 2016-dec-01
109.236.89.202 customer.worldstream.nl 2016-oct-12
109.236.90.209
109.236.92.172 customer.worldstream.nl 2017-jan-30
217.23.3.185 2016-sept-21
217.23.7.196 2016-nov-07
217.23.11.79 customer.worldstream.nl 2016-nov-08
217.23.7.79 customer.worldstream.nl 2016-nov-08
217.23.8.40 customer.worldstream.nl 2016-nov-08
217.23.14.168
I’ll try these two IP ranges first.
