What spider is THIS?

**ADAM Web Design** · 06-06-2006, 03:05 PM

A client of mine noticed something really unusual on his site through his site stats over the last four days and I'm trying to get a read on exactly what it is.

We're seeing a lot of crawler activity from the following IPs:

202.96.51.150
CNCGROUP Beijing province network

219.142.118.54
CHINANET beijing province network

219.142.118.40
CHINANET beijing province network

219.142.118.16
CHINANET beijing province network

219.142.118.12
CHINANET beijing province network

2006-06-06 18:59:48 219.142.118.12 - W3SVC103 SEC520WIN2K 216.89.218.168 80 GET /robots.txt - 200 0 400 72 265 HTTP/1.0 www.hibiscusflorals.com - -
2006-06-06 18:59:48 219.142.118.40 - W3SVC103 SEC520WIN2K 216.89.218.168 80 GET /robots.txt - 200 0 400 72 297 HTTP/1.0 www.hibiscusflorals.com - -
2006-06-06 16:35:44 202.96.51.150 - W3SVC103 SEC520WIN2K 216.89.218.168 80 GET /404.asp 404;http://www.hibiscusflorals.com/faq 200 0 0 193 312 HTTP/1.0 www.hibiscusflorals.com bot/1.0 -

So, from what I can gather, it's some form of a bot. But what is it (possibly BaiduSpider)? What's it looking for on a silk flower site?

**ADAM Web Design** · 06-06-2006, 03:12 PM

Update: I just found out that the 202 IP appears to be Microsoft China. But why the secrecy? And why doesn't it identify itself as an MSN bot?

**WebProfit** · 06-07-2006, 12:31 AM

I believe bots can have different names, they aren't always named after the search engines and some dont have a name at all.

Are you sure its from MS?

**ADAM Web Design** · 01:38 AM

Not really. I'm only going by this (hence the reason I used the phrase "appears to be"):

http://www.dnsstuff.com/tools/whois.....150&cache=off

Quote:

% [whois.apnic.net node-2]% Whois data copyright terms http://www.apnic.net/db/dbcopyright.htmlinet
num: 202.96.51.128 - 202.96.51.255
netname: MICROSOFT-CO
descr: Microsft (China) Co.Ltd
country: CN
admin-c: WG271-AP
tech-c: WG271-AP
mnt-by: MAINT-CNCGROUP-BJ
changed: ********@publicf.bta.net.cn 20060605
status: ALLOCATED NON-PORTABLE
source: APNIC
changed: ********@publicf.bta.net.cn 20060605

person: Wang Ge
address: Zhi Chun Lu 49 Hai Dian District Beijing
country: CN
nic-hdl: WG271-AP
phone: +86-10-62617711-5776
fax-no: +86-10-62617711
e-mail: ******@microsoft.com
mnt-by: MAINT-CNCGROUP-BJ
changed: ********@publicf.bta.net.cn 20060602
source: APNIC

Note: the Microsft portion isn't a typo. That's the part that showed up.

**megamoose** · 06-11-2006, 10:13 AM

That's very strange, but as long as it's not doing any damage do you really need to worry about it? I'd say keep an eye on what it does for a while, and if it doesn't attempt any hacking or damaging actions, just ignore it. If it does though, you should ban it by IP maybe.

Hope it's nothing too serious.

Mark

**msb** · 07-30-2006, 10:58 AM

Quote:

Originally Posted by WebProfit

I believe bots can have different names, they aren't always named after the search engines and some dont have a name at all.

Are you sure its from MS?

I think that this is answer...

**Karacus** · 12-09-2007, 10:01 PM

I had some spammer from china emailing me saying he wanted me to buy several domain names before he bought them... he has emailed me 3 times now. I checked out my stat counter and found this same chinese ip address, that's how I found this discussion. He only checks the site once if it's him...no additional hits on my site. could be a spam bot of sorts? is there such a thing?

**IncrediBILL** · 12-23-2007, 02:40 AM

I can't believe you just didn't ask me Adam, sheesh.

What's commonly seen in that range is:
219.142.118.* "Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)"

However, what you're seeing isn't a spider, it's a very lame user agent or referral spammer. This is intended for "SEO" in blogs and log analytics.

Since Google actually indexes a ton of log files analytics reports, if they stuff your server enough times it may show up in the top 30 user agents or referrals.

It's just spam and another reason I advocate the Great Firewall of China because I get very little legit traffic from China, not enough to put up with all the abusive crawls, spams, you name it.

**ADAM Web Design** · 12-23-2007, 11:29 AM

I didn't know you back then, Bill. That's my excuse.

What you're saying does make sense, though. I had a hunch at the time it was some referral spam variant.

**IncrediBILL** · 12-23-2007, 04:58 PM

OK, it was late and I didn't notice the post was over a year old.

Oh well, at least I added value to a dead thread

**mihai074** · 12-26-2007, 12:14 PM

so what was that actualy ?

**ADAM Web Design** · 12-26-2007, 01:28 PM

It was what Bill said it was...a referral spammer bot from China pretending to be a Microsoft bot.

Bill is the expert on all things automated and disgusting, especially when it comes to his favorite country in the world.

**eminents** · 01-10-2008, 09:04 PM

This is quite interesting. I m gonna have to check it out tonight myself and try it with other spiders.