This year, 2016, is a an excellent year for my crab apple tree. The blossoms are really pretty, and the weather has cooperated. They will stay fresh for only 5 days max, and then will die. For now we can enjoy them, as they splash their pink hue from outside into our house. The tree is male, so bears no apples.
2016 Crab Apple Tree, male, a couple of days before full bloom. Toronto, Ontario, Canada. Photo by Don Tai
2016 Crab Apple Tree bloom, a couple of days before full bloom. Toronto, Ontario, Canada. Photo 1 by Don Tai
Speaking Chinese and English, it is what I do. As my mother tongue is English and I live in Toronto, Canada, it was natural for me to post in English and use Google, Bing, Yahoo, DuckDuckGo and other English biased search engines. I also have the ability to speak and write in Chinese, so I often do bilingual posts just for fun. As I regularly monitor my raw access server log, I can see that Google, Bing, Yahoo, DuckDuckGo, Baidu, Sogou, 360, Yandex and other search engines regularly index my content. I wondered how well they index my posts, and if there are any hints and tips that might make getting my content indexed better.
Persistent this botnet is. It’s like a virus that mutates but does not go away. Or an itch you scratch but does not stop. virtua.com.br has a content scraping bot going at my site that I need to stop. virtua.com.br is part of a large Semalt-led botnet I am trying to remove. They have no website. The host addresses I receive on my access log do not resolve, and there’s nothing specific on Google. I’m just giving this a simple domain ban to see how it goes. They also have a huge number of IP blocks, as they are connected to Akamai in the US.
Both keywords-monitoring-your-success.com and free-video-tool.com are Semalt tools for content scraping. This botnet is pretty extensive and tiring to kill.
The raw access log entries look seemingly legit, but being referred from the two Semalt tools, they could not be legit users.
These host names and Ip address, masquerading as valid browsers, took up a lot of my bandwidth. This botnet used mainly companies from Brazil such as TELEFÔNICA BRASIL, Vivo, Global Village, Brasil Telecom, Yawl, portalmail but also used a bunch of Italian and US companies as well.
Virtua.com.br continues to content scrape for Semalt. I have a separate research report on them.
This one is difficult. They are elusive. They use partial IP ranges that start randomly, like a disk that needs defragmenting. This masks their use of larger IP ranges. The names James Prado and Private Layer are always involved. What they do is bury the hosted-ny.securefastserver into small IP segments, but the IP ranges before and after are also owned by the same company but are under the Private Layer or James Prado name. Tricky. Just ban the complete range, as it is the same company.
DNS Record:
Fast Serv Inc. d.b.a. QHoster.com
1 Mapp Str.
Belize City, Belize
Maps, I do like. Not only are they pretty, they are pretty useful, especially if you are unfamiliar with the area. Map and compass in hand, you can walk at your leisure and not get lost, or at least be able to get help from the locals when you do. But which maps are the best for China? I thought I’d do a map slugfest, comparing Google (line and satellite), 360, Sougou and Baidu. I chose 150 meters of Shandong, Changdao on Jiefang (Liberation) Road as an example.
This content scraper pinspb.ru is a regular on my site and I’d like to ban it. Very mysterious and hard to pin down. Not much on the DNS record. At least they have a web site. They look like an ISP. They have a lot of IP blocks.
My content scraper host name was 98-68.furanet.com. It looks like their pattern or strategy is a reverse order domain name with the first 2 octets missing. Looking at their IP range I would guess 93.93.64.0/21, which covers the 68 of 98-68.furanet.com. From my Google search I’ve added 91.192.108.0/22 which they also commonly use.
Ban these most commonly used IPs:
91.192.108.0/22
93.93.64.0/21
My site has been getting content and image scraped by bb-81-107.018.net.il and bb-153-46.018.net.il, but these two host names do not resolve. Furthermore there is very little on the internet on them. My next step is to ban their complete IP range.
Pattern:
If there are 4 octets in the host name, then reverse the octets. If there are only 2 octets then these are the last 2 of the IP. You will need to use the host command and try the first 2 octets of their common ranges.
Hit I was, by a terribly time wasteful spambot pushing weight loss ads. Yes, my Recaptcha did send them to my spam folder for analysis, but it was still a lot. I just wished they would simply stop. All the comment spammers were pushing weight loss. I’m sure they are telling me something about my slightly widening girth, but I am already making amends. There is no need for added pressure, nor waste of bandwidth and technology.
