Heads-up about a rouge bot - intelium_bot

For those that are interested, I just got hit by a content scraper bot that totally ignored robots.txt. It targets both your site and the root of your domain, so if you want to IP block it (159.253.145.175) you will need to do so from the root of your domain.

Here are some of entry points it has tried:

   example.com/cms/_top
   example.com/cms/4
   example.com/cms/Usergroups:
   example.com/cms/Members:
   example.com/cms/Forums:
   example.com/cms/Polls:
   example.com/cms/Music:
   example.com/cms/Gallery:
   example.com/cms/Miscellaneous:
   example.com/cms/Blogs:
   example.com/cms/Episodes:
   example.com/cms/site/site_contact
   example.com/cms/site/site_privacy
   example.com/cms/site/3
   example.com/cms/site/0
   example.com/cms/site/1
   example.com/cms/site/g
   example.com/cms/site/4
   example.com/cms/site/Polls:
   example.com/cms/site/Music:
   example.com/cms/site/Gallery:
   example.com/cms/site/Miscellaneous:
   example.com/cms/site/Blogs:
   example.com/cms/site/Episodes:
   example.com/cms/site/Usergroups:
   example.com/cms/site/Members:
   example.com/cms/site/Rules:
   example.com/cms/site/Forums:
   example.com/cms/site/_self
   example.com/cms/site_contact
   example.com/cms/site_privacy
   example.com/cms/3
   example.com/cms/g
   example.com/cms/1
   example.com/cms/0
   example.com/cms/_self
   example.com/Members:
   example.com/Forums:
   example.com/Polls:
   example.com/Usergroups:
   example.com/Gallery:
   example.com/Music:
   example.com/_self
   example.com/Episodes:
   example.com/Miscellaneous:
   example.com/Blogs:

More info about this bot can be found here: http://riskyinternet.com/what-is/crawler/MTI5NzMwMA==/

Thanks for the report, temp.

I ran the OcCLE antispam_check on the IP and it came up clean (not listed) but when I checked Project Honey Pot, the IP is reported as a "rule breaker" with a threat rating of 46 first reported 5 months ago and most recently seen in the last week. It's score would have slipped past my anti-spam settings but I wonder why the antispam_check command shows it as unlisted.

I've blocked the IP in CloudFlare which should keep it from hitting my site.

Bob

EDIT: Ahh, no suspicious activity in the past three months so it is unreported I guess.
https://www.projecthoneypot.org/ip_159.253.145.175

BobS said

I wonder why the antispam_check command shows it as unlisted.

Probably because its a minor bot and not wide spread.

If you have access to the servers blacklist place it there. Thanks for reporting

thanks for this…i very rarely look at this sort of thing on my site, but funnily enough i did spot it and was wondering what it was.

Thanks Temp