0

I hope I am not that wrong at webmasters.

Recently I'm seeing something like this in my logs:

146.0.32.XXX - - [07/Jun/2015:18:38:32 +0200] "GET / HTTP/1.1" 200 8330 "-" "Mozilla/5.0 (compatible; savetheworldheritage.org/1.1; +crawl@savetheworldheritage.org)"

I think it's a crawler but what is it crawling for? I mean I can't find anything on the internet about it and it's clearly not a search engine.

It wouldn't bother me but it's completely ignoring nofollow links which is annoying.

So what is it? Hope you can help!

  • It doesn't appear to be malicious. Could be a bad bot spoofing itself. – John Conde Jun 7 '15 at 16:48
  • OK so it appears to not be an important bot and furthermore it comes from the same IP every time. I think I should just block it. Thanks – sleepless Jun 7 '15 at 17:00
2

This site is hosted on GoDaddy and is parked for the moment.

The IP address for savetheworldheritage.org is 50.63.202.37. There is no specific information about this host that can be relied upon at this point.

I have these similar IP address in my database:

AS Number AS47147 - VisNetwork Media SRL
146.0.32.13
146.0.32.144

Of these, I have several domain names as well as these IP address which have indications of spam:

146.0.32.144
RBL: bl.csma.biz
Visit http://bl.csma.biz/ for more information.

b02.a01.ca
RBL: - clear

epow0.org
RBL: rhsbl.ahbl.org
Visit http://www.ahbl.org/documents/rhsbl for more information.

tor.epow0.org
RBL: rhsbl.ahbl.org
Visit http://www.ahbl.org/documents/rhsbl for more information.

146.0.32.13
RBL: bl.csma.biz
Visit http://bl.csma.biz/ for more information.

tecnobilisim.com
RBL: rhsbl.ahbl.org
Visit http://www.ahbl.org/documents/rhsbl for more information.

ca012.calcit.fastwebserver.de
RBL: rhsbl.ahbl.org
Visit http://www.ahbl.org/documents/rhsbl for more information.

I am not sure if these IP addresses apply to your situation, however, I thought I would at least report on them anyway.

Here is the IP address block info:

IP Address Range:

146.0.32.0 - 146.0.63.255

NetMask:

Block: 146.0.32.0/19
Base Address: 146.0.32.0
Broadcast Address: 146.0.63.255
Net Mask: 255.255.224.0
Host Mask: 0.0.31.255
Bits: 19
Size: 8192
2nd Element: 146.0.32.2
Block by IP Address Block

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^146\.0\.(0*[3-6]+[2-3]+)\.([0-2]+[0-5]+[0-5]+)$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-146-0-32-0-19 deny ip 146.0.32.0 0.0.31.255 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 146.0.32.0/19;

How to block by IP address block using Linux IPTables Firewall. **Note: Use with caution.

/sbin/iptables -A INPUT -s 146.0.32.0/19 -j DROP

Microsoft IIS Web Server

<rule name="abort ip address block 146.0.32.0/19" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^146\.0\.63\..*$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-block-146-0-32-0-19" dir=in interface=any action=block remoteip=146.0.32.0/19

Or you can use the following code as an example to block the specific IP address:

Apache .htaccess File

RewriteCond %{REMOTE_ADDR} ^146\.0\.32\.1$ [NC]
RewriteRule .* - [F,L]

Cisco Firewall

access-list deny-146-0-32-1-32 deny ip 146.0.32.1 any
permit ip any any

Nginx

Edit nginx.conf and insert include blockips.conf; if it does not exist. Edit blockips.conf and add the following:

deny 146.0.32.1;

Microsoft IIS Web Server

<rule name="abort ip address 146.0.32.1/32" stopProcessing="true">
 <match url=".*" />
  <conditions>
   <add input="{REMOTE_ADDR}" pattern="^146\.0\.32\.1$" />
  </conditions>
 <action type="AbortRequest" />
</rule>

Windows netsh ADVFirewall Firewall

netsh advfirewall firewall add rule name="block-ip-146-0-32-1-32" dir=in interface=any action=block remoteip=146.0.32.1/32

You will need to change the IP address where you see it.

It is not clear if these are tied together. It is not uncommon that a website exists on one host and a bot used on another. I would at least block the specific IP address or the entire block. This is not a subscriber block so you will not be blocking any users.

  • @sleepless Anytime!! This is at least part of what I do. – closetnoc Jun 7 '15 at 23:18
1

The most important thing that identifies the source of the request is the IP address. The savetheworldheritage.org part is a user-agent string that anyone can manipulate if they have the correct tools. In fact, on http://www.webpagetest.org/, one can change the user agent in the "chrome" tab.

Just make sure you check the IP address by searching for it on whois.com and if it seems like a source you don't trust then block the IP for a definite period of time then unblock. I say definite because an IP address could be temporary hijacked. For example, an innocent computer could suddenly catch a nasty virus which causes it to send spam. and if that IP address is blocked forever, and that computer with a virus has been cleaned, then the poor innocent user won't have access to your site because of the permanent block you made.

  • What?? You do not recommend they look for any bad IP addresses and domain names on my site's list of Internet 5h17 birds? ;-) – closetnoc Jun 8 '15 at 5:09
  • I didn't know you run your own public honeypot? – Mike Jun 8 '15 at 5:19
  • Yes. Sorta. I get a bunch of hackers, bots, and bears oh my! I did create a bunch of traps and sensors along the way and a bot trap before the honeypots really took off. I call it my [derogatory term for the male anatomy] list. I used it as part of some of the research I do and recently began automating some of my off-line work and have been building 8 years worth of data. It is going to take 2 years total to get it all into place- 6 months left. I will be adding some fairly interesting tidbits in a while. My code is being rewritten to be web friendly including some schema changes. – closetnoc Jun 8 '15 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.