Tuesday, August 08, 2006

Taiwan Scraping from C and D-Blocks

Didn't check the archive file to see if this was more widespread because as this was a single instance today of a coordinated scrape attempt from multiple IPs at the same time.

The D-block scraping attempt from "61.66.36" was nothing new as small blocks of scraping IPs turn up all the time.

However, the C-block scraping from "218.162." at the same has implications as this normally would've been harder to identify in small 1-4 page bursts.

The scraping C-block:

61.66.36.185 [adsl-61-66-36-185.TC.sparqnet.net.] requested 2 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
61.66.36.186 [adsl-61-66-36-186.TC.sparqnet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
61.66.36.187 [adsl-61-66-36-187.TC.sparqnet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
The scraping D-block:
218.162.169.65 [218-162-169-65.dynamic.hinet.net.] requested 1 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.170.209 [218-162-170-209.dynamic.hinet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.172.171 [218-162-172-171.dynamic.hinet.net.] requested 4 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.175.60 [218-162-175-60.dynamic.hinet.net.] requested 3 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
218.162.179.74 [218-162-179-74.dynamic.hinet.net.] requested 1 pages as "Mozilla/4.0 (compatible ; MSIE 6.0; Windows NT 5.1)"
Looks like they're getting smarter and your average webmaster will never spot this kind of activity.

Time to block Taiwan entirely?

No comments: