bezeqint.net content spammed me, so naturally I researched them. They are very smart, these Israelis, and employ a variety of anti-bot software techniques, in order to evade identification. Hats off to them for deploying these tactics. I hope they keep up the good work.
Observation:
Pattern:
red: reverse first 3 octets, add 4th
red, static.dcenter: straight 4 octets
cablep, red: host name has 3 octets, special number for first octet
Research:
bot , Tech ban , ban IP , bezeqint.net , bot , cablep , content scraper , cust , dcenter , internet security , ip address , pattern , red , research , spam , static , static.dcenter , strategy
reverse.completel.fr gave me some error 404s, so I thought to look them up. This research excludes reverse.completel.net. Be careful here because though you could ban the whole /16 range you would exclude a whole bunch of French people, and that would be bad.
46.218.12.177 46.218.0.0 – 46.218.255.255 46.218.0.0/16
Permanent link to this post (90 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , completel.fr , content scraper , internet security , ip address , research , reverse.completel.fr , spam , strategy
ioflood.com piqueted my interest in their novel hostname: we.love.servers.at.ioflood.com. This turned out to be a barrage of IP addresses, something I did not expect.
Observations:
Research:
Permanent link to this post (93 words, 0 images, estimated 22 secs reading time)
bot , Tech ban , ban IP , bot , content scraper , internet security , ioflood.com , ip address , research , spam , strategy , we.love.servers.at.ioflood.com
Voxility has been scraping me for a while and I’ve banned their hostnames, but I could not look up lh27033.voxility.net, so this started the research.
Observation:
Research:
lh17088.voxility.net 39.41.114.93
bot , Tech ban , ban IP , blazingfast.io , bot , content scraper , internet security , ip address , research , spam , strategy , voxility.net
hosted-by.blazingfast.io spammed me, so I looked them up. They are an orderly shop.
Observation:
Research:
185.11.145.4 185.11.145.0 – 185.11.148.255 185.11.145.0/22
185.61.136.34 185.61.136.0 – 185.61.139.255 185.61.136.0/22
185.62.188.3 185.62.188.0 – 185.62.191.255 185.62.188.0/22
188.209.49.34 188.209.49.0/24
188.209.52.34 188.209.52.0/24
Permanent link to this post (82 words, 0 images, estimated 20 secs reading time)
bot , Tech ban , ban IP , blazingfast.io , bot , content scraper , customer.clientshostname.com , hosted-by.blazingfast.io , internet security , ip address , research , spam , strategy
client.yota.ru spammed me so I did research. This Russian spammer makes it difficult to track them down. They are prolific. They also have the host name wimax-client.yota.ru that they also use to spam.
Observations:
bot , Tech ban , ban IP , bot , client.yota.ru , content scraper , internet security , ip address , research , spam , strategy , wimax-client.yota.ru , yota.ru
customer.clientshostname.com scraped me, and the name is very generic, so I thought to research it. clientshostname.com has a lot of customer names prepended to it, so this excludes all their names. Three IP ranges should do you.
Observed:
Research:
Permanent link to this post (82 words, 0 images, estimated 20 secs reading time)
bot , Tech ban , ban IP , bot , clientshostname.com , content scraper , customer.clientshostname.com , internet security , ip address , research , spam , strategy
c8fb265ea92a.softphone.blizoo.bg scraped me, but this one is tough.
Observation:
Research:
c8fb265ea1a7.softphone.blizoo.bg 130.204.57.130 130.204.0.0 – 130.204.255.255 130.204.0.0/16 BLIZOO Bg
Permanent link to this post (52 words, 0 images, estimated 12 secs reading time)
bot , Tech ban , ban IP , blizoo.bg , bot , content scraper , internet security , ip address , key , research , softphone , spam , strategy
host671420043112.direcway.com is a whisper bot that content scraped me. They are unique in that their hostname is somewhat ambiguous, making machine reading more difficult. All octets can be 2 or 3 digits long, allowing for much ambiguity.
whisper is a very much hated botnet that continues to attack my site, one ip at a time, small but relentless.
Observation:
Pattern:
bot , Tech ban , ban IP , bot , content scraper , direcway.com , internet security , ip address , research , spam , strategy , whisper , whisper botnet
network-consulting.fr had content spammed me, so I looked them up. They are interesting with its host name usage. if they spam me again i will be ready.
79.98.16.0 – 79.98.23.255 Network Consulting Fr
Observation:
Pattern:
From this pattern they can go up to “H”
Research:
Permanent link to this post (104 words, 0 images, estimated 25 secs reading time)
bot , Tech ban , ban IP , bot , content scraper , internet security , ip address , network-consulting , network-consulting.fr , research , spam , strategy
