Menu

BadRoboT

Romance Scams using BOTS, websites, AWS stores.

, , , 0

Single? Dating? even sites of family/friends are targeted for Romance doesn’t befall the Redlight district. which is another beast altogether.   Instead, these scams are designed to target the Heart and then the wallet.

the common stake is of course catfishing or the art of sockpuppeteer.  This is when the scammer acts as someone completely different or fakes an account.  Sometimes the work of a single person, groups, and even bots ( who fetch for their owner.)  to the elaborate 14-day heist/invest/transfer (most popular,) and the 21-day trade sting makes quite the intricate multi payout easily missed.

you can be trolled by a “pickup” bot, which brings you to the real person working the profile. You could find yourself keying in vital info into a fake website by going to any .com  or be directed to a real but burnable amazon store from a hacked account, many times not working alone but in groups with bots.  Be careful what you put in print, one can find themselves quickly overwhelmed and suffer vital information attacks from the simplest of incursions.

 

badbot capture

, , , , , 0

bothearding a lost bot herd, bad botcaputre.

https://www.theregister.com/2008/03/14/bot_herder_cops_plea/

i knew him as LSDLiquid dopping the lsd due pressure peer. to -)sK(- Liquid.
   we were fighting the mygots straight outofbox, no easy keys , and and idea to be undefeated even when the MYGoTs entered game. we fought for the round win rare the ban vote.
.  he was amuzed at our antics portray in CS as the arena and our solidity of resposible responce of out of arena when it came to that )end(
i spent hours on coms hearing the gurgle of water on open mic from his vector.
we could sure use his native abilities right now.
just following the simplicity . he was capable of capturing lost bots and attacking a bot king pool they fell off off, flipping a corporation. the issue as always was replication and abuse without ask.
however his lost bot finding abiliy remains a need to reduce ripple effect,
do you want ants ? because this is how you get ants. exponitially.

badrobot

, , 0

blocking BadRobot accessing get.track.file. at the web ns level apache/cpanel/htaccess WIF. whats in your file.

Set before Fuzzy Lop

From WHM select: Apache Configuration > Include Editor > ‘Pre Main Include’ > Select All Versions

exa:

<Directory “/home”>
SetEnvIfNoCase User-Agent “MJ12bot” bad_bots
SetEnvIfNoCase User-Agent “coccocbot-image” bad_bots
SetEnvIfNoCase User-Agent “Baiduspider” bad_bots
SetEnvIfNoCase User-Agent “AhrefsBot” bad_bots
SetEnvIfNoCase User-Agent “SemrushBot” bad_bots
SetEnvIfNoCase User-Agent “DotBot” bad_bots
SetEnvIfNoCase User-Agent “AlphaBot” bad_bots
SetEnvIfNoCase User-Agent “ZoominfoBot” bad_bots

<RequireAll>
Require all granted
Require not env bad_bots
</RequireAll>
</Directory>

 

HTaccess version :

# Block Bad Bots & Scrapers
SetEnvIfNoCase User-Agent “MJ12bot” bad_bot
SetEnvIfNoCase User-Agent “pingdom” bad_bot
SetEnvIfNoCase User-Agent “Aboundex” bad_bot
SetEnvIfNoCase User-Agent “80legs” bad_bot
SetEnvIfNoCase User-Agent “360Spider” bad_bot
SetEnvIfNoCase User-Agent “^Java” bad_bot
SetEnvIfNoCase User-Agent “^Cogentbot” bad_bot
SetEnvIfNoCase User-Agent “^Alexibot” bad_bot
SetEnvIfNoCase User-Agent “^asterias” bad_bot
SetEnvIfNoCase User-Agent “^attach” bad_bot
SetEnvIfNoCase User-Agent “^BackDoorBot” bad_bot
SetEnvIfNoCase User-Agent “^BackWeb” bad_bot
SetEnvIfNoCase User-Agent “Bandit” bad_bot
SetEnvIfNoCase User-Agent “^BatchFTP” bad_bot
SetEnvIfNoCase User-Agent “^Bigfoot” bad_bot
SetEnvIfNoCase User-Agent “^Black.Hole” bad_bot
SetEnvIfNoCase User-Agent “^BlackWidow” bad_bot
SetEnvIfNoCase User-Agent “^BlowFish” bad_bot
SetEnvIfNoCase User-Agent “^BotALot” bad_bot
SetEnvIfNoCase User-Agent “Buddy” bad_bot
SetEnvIfNoCase User-Agent “^BuiltBotTough” bad_bot
SetEnvIfNoCase User-Agent “^Bullseye” bad_bot
SetEnvIfNoCase User-Agent “^BunnySlippers” bad_bot
SetEnvIfNoCase User-Agent “^Cegbfeieh” bad_bot
SetEnvIfNoCase User-Agent “^CheeseBot” bad_bot
SetEnvIfNoCase User-Agent “^CherryPicker” bad_bot
SetEnvIfNoCase User-Agent “^ChinaClaw” bad_bot
SetEnvIfNoCase User-Agent “Collector” bad_bot
SetEnvIfNoCase User-Agent “Copier” bad_bot
SetEnvIfNoCase User-Agent “^CopyRightCheck” bad_bot
SetEnvIfNoCase User-Agent “^cosmos” bad_bot
SetEnvIfNoCase User-Agent “^Crescent” bad_bot
SetEnvIfNoCase User-Agent “^Custo” bad_bot
SetEnvIfNoCase User-Agent “^AIBOT” bad_bot
SetEnvIfNoCase User-Agent “^DISCo” bad_bot
SetEnvIfNoCase User-Agent “^DIIbot” bad_bot
SetEnvIfNoCase User-Agent “^DittoSpyder” bad_bot
SetEnvIfNoCase User-Agent “^Download\ Demon” bad_bot
SetEnvIfNoCase User-Agent “^Download\ Devil” bad_bot
SetEnvIfNoCase User-Agent “^Download\ Wonder” bad_bot
SetEnvIfNoCase User-Agent “^dragonfly” bad_bot
SetEnvIfNoCase User-Agent “^Drip” bad_bot
SetEnvIfNoCase User-Agent “^eCatch” bad_bot
SetEnvIfNoCase User-Agent “^EasyDL” bad_bot
SetEnvIfNoCase User-Agent “^ebingbong” bad_bot
SetEnvIfNoCase User-Agent “^EirGrabber” bad_bot
SetEnvIfNoCase User-Agent “^EmailCollector” bad_bot
SetEnvIfNoCase User-Agent “^EmailSiphon” bad_bot
SetEnvIfNoCase User-Agent “^EmailWolf” bad_bot
SetEnvIfNoCase User-Agent “^EroCrawler” bad_bot
SetEnvIfNoCase User-Agent “^Exabot” bad_bot
SetEnvIfNoCase User-Agent “^Express\ WebPictures” bad_bot
SetEnvIfNoCase User-Agent “Extractor” bad_bot
SetEnvIfNoCase User-Agent “^EyeNetIE” bad_bot
SetEnvIfNoCase User-Agent “^Foobot” bad_bot
SetEnvIfNoCase User-Agent “^flunky” bad_bot
SetEnvIfNoCase User-Agent “^FrontPage” bad_bot
SetEnvIfNoCase User-Agent “^Go-Ahead-Got-It” bad_bot
SetEnvIfNoCase User-Agent “^gotit” bad_bot
SetEnvIfNoCase User-Agent “^GrabNet” bad_bot
SetEnvIfNoCase User-Agent “^Grafula” bad_bot
SetEnvIfNoCase User-Agent “^Harvest” bad_bot
SetEnvIfNoCase User-Agent “^hloader” bad_bot
SetEnvIfNoCase User-Agent “^HMView” bad_bot
SetEnvIfNoCase User-Agent “^HTTrack” bad_bot
SetEnvIfNoCase User-Agent “^humanlinks” bad_bot
SetEnvIfNoCase User-Agent “^IlseBot” bad_bot
SetEnvIfNoCase User-Agent “^Image\ Stripper” bad_bot
SetEnvIfNoCase User-Agent “^Image\ Sucker” bad_bot
SetEnvIfNoCase User-Agent “Indy\ Library” bad_bot
SetEnvIfNoCase User-Agent “^InfoNaviRobot” bad_bot
SetEnvIfNoCase User-Agent “^InfoTekies” bad_bot
SetEnvIfNoCase User-Agent “^Intelliseek” bad_bot
SetEnvIfNoCase User-Agent “^InterGET” bad_bot
SetEnvIfNoCase User-Agent “^Internet\ Ninja” bad_bot
SetEnvIfNoCase User-Agent “^Iria” bad_bot
SetEnvIfNoCase User-Agent “^Jakarta” bad_bot
SetEnvIfNoCase User-Agent “^JennyBot” bad_bot
SetEnvIfNoCase User-Agent “^JetCar” bad_bot
SetEnvIfNoCase User-Agent “^JOC” bad_bot
SetEnvIfNoCase User-Agent “^JustView” bad_bot
SetEnvIfNoCase User-Agent “^Jyxobot” bad_bot
SetEnvIfNoCase User-Agent “^Kenjin.Spider” bad_bot
SetEnvIfNoCase User-Agent “^Keyword.Density” bad_bot
SetEnvIfNoCase User-Agent “^larbin” bad_bot
SetEnvIfNoCase User-Agent “^LexiBot” bad_bot
SetEnvIfNoCase User-Agent “^lftp” bad_bot
SetEnvIfNoCase User-Agent “^libWeb/clsHTTP” bad_bot
SetEnvIfNoCase User-Agent “^likse” bad_bot
SetEnvIfNoCase User-Agent “^LinkextractorPro” bad_bot
SetEnvIfNoCase User-Agent “^LinkScan/8.1a.Unix” bad_bot
SetEnvIfNoCase User-Agent “^LNSpiderguy” bad_bot
SetEnvIfNoCase User-Agent “^LinkWalker” bad_bot
SetEnvIfNoCase User-Agent “^lwp-trivial” bad_bot
SetEnvIfNoCase User-Agent “^LWP::Simple” bad_bot
SetEnvIfNoCase User-Agent “^Magnet” bad_bot
SetEnvIfNoCase User-Agent “^Mag-Net” bad_bot
SetEnvIfNoCase User-Agent “^MarkWatch” bad_bot
SetEnvIfNoCase User-Agent “^Mass\ Downloader” bad_bot
SetEnvIfNoCase User-Agent “^Mata.Hari” bad_bot
SetEnvIfNoCase User-Agent “^Memo” bad_bot
SetEnvIfNoCase User-Agent “^Microsoft.URL” bad_bot
SetEnvIfNoCase User-Agent “^Microsoft\ URL\ Control” bad_bot
SetEnvIfNoCase User-Agent “^MIDown\ tool” bad_bot
SetEnvIfNoCase User-Agent “^MIIxpc” bad_bot
SetEnvIfNoCase User-Agent “^Mirror” bad_bot
SetEnvIfNoCase User-Agent “^Missigua\ Locator” bad_bot
SetEnvIfNoCase User-Agent “^Mister\ PiX” bad_bot
SetEnvIfNoCase User-Agent “^moget” bad_bot
SetEnvIfNoCase User-Agent “^Mozilla/3.Mozilla/2.01” bad_bot
SetEnvIfNoCase User-Agent “^Mozilla.*NEWT” bad_bot
SetEnvIfNoCase User-Agent “^NAMEPROTECT” bad_bot
SetEnvIfNoCase User-Agent “^Navroad” bad_bot
SetEnvIfNoCase User-Agent “^NearSite” bad_bot
SetEnvIfNoCase User-Agent “^NetAnts” bad_bot
SetEnvIfNoCase User-Agent “^Netcraft” bad_bot
SetEnvIfNoCase User-Agent “^NetMechanic” bad_bot
SetEnvIfNoCase User-Agent “^NetSpider” bad_bot
SetEnvIfNoCase User-Agent “^Net\ Vampire” bad_bot
SetEnvIfNoCase User-Agent “^NetZIP” bad_bot
SetEnvIfNoCase User-Agent “^NextGenSearchBot” bad_bot
SetEnvIfNoCase User-Agent “^NG” bad_bot
SetEnvIfNoCase User-Agent “^NICErsPRO” bad_bot
SetEnvIfNoCase User-Agent “^niki-bot” bad_bot
SetEnvIfNoCase User-Agent “^NimbleCrawler” bad_bot
SetEnvIfNoCase User-Agent “^Ninja” bad_bot
SetEnvIfNoCase User-Agent “^NPbot” bad_bot
SetEnvIfNoCase User-Agent “^Octopus” bad_bot
SetEnvIfNoCase User-Agent “^Offline\ Explorer” bad_bot
SetEnvIfNoCase User-Agent “^Offline\ Navigator” bad_bot
SetEnvIfNoCase User-Agent “^Openfind” bad_bot
SetEnvIfNoCase User-Agent “^OutfoxBot” bad_bot
SetEnvIfNoCase User-Agent “^PageGrabber” bad_bot
SetEnvIfNoCase User-Agent “^Papa\ Foto” bad_bot
SetEnvIfNoCase User-Agent “^pavuk” bad_bot
SetEnvIfNoCase User-Agent “^pcBrowser” bad_bot
SetEnvIfNoCase User-Agent “^PHP\ version\ tracker” bad_bot
SetEnvIfNoCase User-Agent “^Pockey” bad_bot
SetEnvIfNoCase User-Agent “^ProPowerBot/2.14” bad_bot
SetEnvIfNoCase User-Agent “^ProWebWalker” bad_bot
SetEnvIfNoCase User-Agent “^psbot” bad_bot
SetEnvIfNoCase User-Agent “^Pump” bad_bot
SetEnvIfNoCase User-Agent “^QueryN.Metasearch” bad_bot
SetEnvIfNoCase User-Agent “^RealDownload” bad_bot
SetEnvIfNoCase User-Agent “Reaper” bad_bot
SetEnvIfNoCase User-Agent “Recorder” bad_bot
SetEnvIfNoCase User-Agent “^ReGet” bad_bot
SetEnvIfNoCase User-Agent “^RepoMonkey” bad_bot
SetEnvIfNoCase User-Agent “^RMA” bad_bot
SetEnvIfNoCase User-Agent “Siphon” bad_bot
SetEnvIfNoCase User-Agent “^SiteSnagger” bad_bot
SetEnvIfNoCase User-Agent “^SlySearch” bad_bot
SetEnvIfNoCase User-Agent “^SmartDownload” bad_bot
SetEnvIfNoCase User-Agent “^Snake” bad_bot
SetEnvIfNoCase User-Agent “^Snapbot” bad_bot
SetEnvIfNoCase User-Agent “^Snoopy” bad_bot
SetEnvIfNoCase User-Agent “^sogou” bad_bot
SetEnvIfNoCase User-Agent “^SpaceBison” bad_bot
SetEnvIfNoCase User-Agent “^SpankBot” bad_bot
SetEnvIfNoCase User-Agent “^spanner” bad_bot
SetEnvIfNoCase User-Agent “^Sqworm” bad_bot
SetEnvIfNoCase User-Agent “Stripper” bad_bot
SetEnvIfNoCase User-Agent “Sucker” bad_bot
SetEnvIfNoCase User-Agent “^SuperBot” bad_bot
SetEnvIfNoCase User-Agent “^SuperHTTP” bad_bot
SetEnvIfNoCase User-Agent “^Surfbot” bad_bot
SetEnvIfNoCase User-Agent “^suzuran” bad_bot
SetEnvIfNoCase User-Agent “^Szukacz/1.4” bad_bot
SetEnvIfNoCase User-Agent “^tAkeOut” bad_bot
SetEnvIfNoCase User-Agent “^Teleport” bad_bot
SetEnvIfNoCase User-Agent “^Telesoft” bad_bot
SetEnvIfNoCase User-Agent “^TurnitinBot/1.5” bad_bot
SetEnvIfNoCase User-Agent “^The.Intraformant” bad_bot
SetEnvIfNoCase User-Agent “^TheNomad” bad_bot
SetEnvIfNoCase User-Agent “^TightTwatBot” bad_bot
SetEnvIfNoCase User-Agent “^Titan” bad_bot
SetEnvIfNoCase User-Agent “^True_Robot” bad_bot
SetEnvIfNoCase User-Agent “^turingos” bad_bot
SetEnvIfNoCase User-Agent “^TurnitinBot” bad_bot
SetEnvIfNoCase User-Agent “^URLy.Warning” bad_bot
SetEnvIfNoCase User-Agent “^Vacuum” bad_bot
SetEnvIfNoCase User-Agent “^VCI” bad_bot
SetEnvIfNoCase User-Agent “^VoidEYE” bad_bot
SetEnvIfNoCase User-Agent “^Web\ Image\ Collector” bad_bot
SetEnvIfNoCase User-Agent “^Web\ Sucker” bad_bot
SetEnvIfNoCase User-Agent “^WebAuto” bad_bot
SetEnvIfNoCase User-Agent “^WebBandit” bad_bot
SetEnvIfNoCase User-Agent “^Webclipping.com” bad_bot
SetEnvIfNoCase User-Agent “^WebCopier” bad_bot
SetEnvIfNoCase User-Agent “^WebEMailExtrac.*” bad_bot
SetEnvIfNoCase User-Agent “^WebEnhancer” bad_bot
SetEnvIfNoCase User-Agent “^WebFetch” bad_bot
SetEnvIfNoCase User-Agent “^WebGo\ IS” bad_bot
SetEnvIfNoCase User-Agent “^Web.Image.Collector” bad_bot
SetEnvIfNoCase User-Agent “^WebLeacher” bad_bot
SetEnvIfNoCase User-Agent “^WebmasterWorldForumBot” bad_bot
SetEnvIfNoCase User-Agent “^WebReaper” bad_bot
SetEnvIfNoCase User-Agent “^WebSauger” bad_bot
SetEnvIfNoCase User-Agent “^Website\ eXtractor” bad_bot
SetEnvIfNoCase User-Agent “^Website\ Quester” bad_bot
SetEnvIfNoCase User-Agent “^Webster” bad_bot
SetEnvIfNoCase User-Agent “^WebStripper” bad_bot
SetEnvIfNoCase User-Agent “^WebWhacker” bad_bot
SetEnvIfNoCase User-Agent “^WebZIP” bad_bot
SetEnvIfNoCase User-Agent “Whacker” bad_bot
SetEnvIfNoCase User-Agent “^Widow” bad_bot
SetEnvIfNoCase User-Agent “^WISENutbot” bad_bot
SetEnvIfNoCase User-Agent “^WWWOFFLE” bad_bot
SetEnvIfNoCase User-Agent “^WWW-Collector-E” bad_bot
SetEnvIfNoCase User-Agent “^Xaldon” bad_bot
SetEnvIfNoCase User-Agent “^Xenu” bad_bot
SetEnvIfNoCase User-Agent “^Zeus” bad_bot
SetEnvIfNoCase User-Agent “ZmEu” bad_bot
SetEnvIfNoCase User-Agent “^Zyborg” bad_bot
# Vulnerability Scanners
SetEnvIfNoCase User-Agent “Acunetix” bad_bot
SetEnvIfNoCase User-Agent “FHscan” bad_bot
# Aggressive Chinese Search Engine
SetEnvIfNoCase User-Agent “Baiduspider” bad_bot
# Aggressive Russian Search Engine
SetEnvIfNoCase User-Agent “Yandex” bad_bot
<Limit GET POST HEAD>
Order Allow,Deny
Allow from all
# Cyveillance
deny from 38.100.19.8/29
deny from 38.100.21.0/24
deny from 38.100.41.64/26
deny from 38.105.71.0/25
deny from 38.105.83.0/27
deny from 38.112.21.140/30
deny from 38.118.42.32/29
deny from 65.213.208.128/27
deny from 65.222.176.96/27
deny from 65.222.185.72/29
Deny from env=bad_bot
</Limit>

 

crediting

Alojamiento de páginas Web Hosting y Outsourcing :: Castris

https://forums.cpanel.net/members/vs-nu.669691/

nunoleite

Well-Known Member
Hi!
I have made some changes…
I have added this 3 rules:

Code:
SecRule REQUEST_HEADERS:User-Agent "@rx (?:AhrefsBot)" "msg:'AhrefsBot Spiderbot blocked',phase:1,log,id:7777771,t:none,block,status:403"
SecRule REQUEST_HEADERS:User-Agent "@rx (?:MJ12bot)" "msg:'MJ12bot Spiderbot blocked',phase:1,log,id:7777772,t:none,block,status:403"
SecRule REQUEST_HEADERS:User-Agent "@rx (?:Yandex)" "msg:'Yandex Spiderbot blocked',phase:1,log,id:7777773,t:none,block,status:403"

With these 3 rules i know in the “hits list” what is going on with each bot and what is hitting the rule, because they are being logged separately.

If i understand right the bots still have access to sites, but they receive 0bytes and an 403 http error.
After some hits the CSF firewall blocks permanently the IP. Is this right? And is this the right behavior?

cPanelMichael

cPanelMichael

Administrator
Staff member
nunoleite said:
After some hits the CSF firewall blocks permanently the IP. Is this right? And is this the right behavior?

Hello @nunoleite,

Yes, this is the case as long as you have enabled the LF_MODSEC feature in CSF.

Thank you.