Comments on: Block Snoopy http://spamhuntress.com/2006/01/24/block-snoopy/ Just another WordPress weblog Mon, 13 Oct 2008 11:45:03 +0000 http://wordpress.org/?v=2.0.7 by: micenterprise » Blog Archive » Let’s hunt Snoopy http://spamhuntress.com/2006/01/24/block-snoopy/#comment-77442 Thu, 14 Dec 2006 10:38:01 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-77442 [...] Also mein Counterize Plugin von meinem Blog führt ja ne simple Statistik welcher Browser, IP, etc da war. Da gabs jetzt immer einen Browser Snoopy. Dachte jetzt, da die Katrin ja Snoopy mag, hat sie vielleicht ihren Browser getuned dass der behauptet ein Snoopy zu sein. Nun ja wie dem so ist, war Snoopy sehr, SEHR häufig da und gestern beim Chatten hab ich mal gefragt ob ich mir Sorgen machen müsste weil sie alle 2h da wäre. Sie meinte, nö, sie hat nen RSS-Feeder und sieht immer wenn was Neues kommt. Hm hab dann mal nach Snoopy gegoogelt und siehe da Snoopy ist ein kleines Programm dass Webseiten zieht. Frech ne? Ok, nen normaler Browser zieht auch Webseiten aber Snoopy macht das automatisch und simuliert nur den Browser um danach irgendwas anderes mit dem Content zu machen. Jetzt werd ich mir überlegen wie man Snoopy blockiert. Bin auch nicht der erste den Snoopy besucht hat. [...] […] Also mein Counterize Plugin von meinem Blog führt ja ne simple Statistik welcher Browser, IP, etc da war. Da gabs jetzt immer einen Browser Snoopy. Dachte jetzt, da die Katrin ja Snoopy mag, hat sie vielleicht ihren Browser getuned dass der behauptet ein Snoopy zu sein. Nun ja wie dem so ist, war Snoopy sehr, SEHR häufig da und gestern beim Chatten hab ich mal gefragt ob ich mir Sorgen machen müsste weil sie alle 2h da wäre. Sie meinte, nö, sie hat nen RSS-Feeder und sieht immer wenn was Neues kommt. Hm hab dann mal nach Snoopy gegoogelt und siehe da Snoopy ist ein kleines Programm dass Webseiten zieht. Frech ne? Ok, nen normaler Browser zieht auch Webseiten aber Snoopy macht das automatisch und simuliert nur den Browser um danach irgendwas anderes mit dem Content zu machen. Jetzt werd ich mir überlegen wie man Snoopy blockiert. Bin auch nicht der erste den Snoopy besucht hat. […]

]]> by: Clayton http://spamhuntress.com/2006/01/24/block-snoopy/#comment-58140 Sat, 04 Nov 2006 21:55:09 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-58140 You do realize you can change the useragent with snoopy so that it looks as if it real browser traffic.... Snoopy is an amazing class... You do realize you can change the useragent with snoopy so that it looks as if it real browser traffic….

Snoopy is an amazing class…

]]> by: Spamhuntress » Blog Archive » Fighting spam is a full time job http://spamhuntress.com/2006/01/24/block-snoopy/#comment-41074 Wed, 13 Sep 2006 14:37:23 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-41074 [...] The quote is from a comment on the Block Snoopy post. [...] […] The quote is from a comment on the Block Snoopy post. […]

]]> by: Static Brain http://spamhuntress.com/2006/01/24/block-snoopy/#comment-41047 Wed, 13 Sep 2006 13:22:10 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-41047 Snoopy is now ripping me apart from two ips 62.141.58.48 which someone already mentioned and now this one 87.118.100.27 I already banned it. From what I read on it, it can not be good. Thanks for posting this. Fighting spam is a full time job anymore. Snoopy is now ripping me apart from two ips 62.141.58.48 which someone already mentioned and now this one 87.118.100.27 I already banned it. From what I read on it, it can not be good. Thanks for posting this. Fighting spam is a full time job anymore.

]]> by: Dan Gibas http://spamhuntress.com/2006/01/24/block-snoopy/#comment-35337 Tue, 29 Aug 2006 11:49:04 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-35337 Hi All, It seems I had a lucky escape from Snoopy... The site it entered is all on one PHP page with a dynamic variable in the query string. Snoopy failed to navigate my site and do much at all - so it seems it cant handle the query strings. Lucky my site being probed is all on index.php ;o) Here is my custom log of the activity... from this you can also see that it was trying to take 1 page per second (which is really mean and could bring some sites down DOS style). [871] [Date: Tuesday 29th of August 2006 02:20:54 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] [872] [Date: Tuesday 29th of August 2006 02:20:55 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] [873] [Date: Tuesday 29th of August 2006 02:20:56 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] [874] [Date: Tuesday 29th of August 2006 02:20:56 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] [875] [Date: Tuesday 29th of August 2006 02:20:57 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] [876] [Date: Tuesday 29th of August 2006 02:20:58 AM] [IP: 62.141.58.48] [UA: Snoopy v1.2] [Ref: n/a] [Viewed: /index.php?] Final thought... Are the developers paying royalty to Snoopy the cartoon character? Dan Hi All,

It seems I had a lucky escape from Snoopy… The site it entered is all on one PHP page with a dynamic variable in the query string. Snoopy failed to navigate my site and do much at all - so it seems it cant handle the query strings.

Lucky my site being probed is all on index.php ;o)

Here is my custom log of the activity… from this you can also see that it was trying to take 1 page per second (which is really mean and could bring some sites down DOS style).

[871] [Date: Tuesday 29th of August 2006 02:20:54 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

[872] [Date: Tuesday 29th of August 2006 02:20:55 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

[873] [Date: Tuesday 29th of August 2006 02:20:56 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

[874] [Date: Tuesday 29th of August 2006 02:20:56 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

[875] [Date: Tuesday 29th of August 2006 02:20:57 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

[876] [Date: Tuesday 29th of August 2006 02:20:58 AM] [IP: 62.141.58.48]
[UA: Snoopy v1.2]
[Ref: n/a]
[Viewed: /index.php?]

Final thought…

Are the developers paying royalty to Snoopy the cartoon character?

Dan

]]> by: Nigel Horne http://spamhuntress.com/2006/01/24/block-snoopy/#comment-20063 Fri, 23 Jun 2006 11:06:42 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-20063 That's why I wrote mod_spambot! That’s why I wrote mod_spambot!

]]> by: Jason Pearce http://spamhuntress.com/2006/01/24/block-snoopy/#comment-8100 Tue, 02 May 2006 14:18:28 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-8100 Lemat, while I appreciate the humor in your RewriteRule, I don't recommend anyone using it. For starters, it unfairly transfers an attack on one user's website over to Microsoft, which had nothing to do with it. Now I'm not a Microsoft fan, but they receive enough attacks as it is. Lemat, while I appreciate the humor in your RewriteRule, I don’t recommend anyone using it. For starters, it unfairly transfers an attack on one user’s website over to Microsoft, which had nothing to do with it. Now I’m not a Microsoft fan, but they receive enough attacks as it is.

]]> by: Lemat http://spamhuntress.com/2006/01/24/block-snoopy/#comment-6673 Tue, 18 Apr 2006 16:22:40 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-6673 Should do the trick: RewriteCond %{HTTP_USER_AGENT} ^Snoopy [NC] RewriteRule .* http://download.microsoft.com/download/1/6/5/165b076b-aaa9-443d-84f0-73cf11fdcdf8/WindowsXP-KB835935-SP2-ENU.exe [R=301] - it's Apache mod_rewite Should do the trick:

RewriteCond %{HTTP_USER_AGENT} ^Snoopy [NC]
RewriteRule .* http://download.microsoft.com/download/1/6/5/165b076b-aaa9-443d-84f0-73cf11fdcdf8/WindowsXP-KB835935-SP2-ENU.exe [R=301]

- it’s Apache mod_rewite

]]> by: Scott Johnson http://spamhuntress.com/2006/01/24/block-snoopy/#comment-3476 Fri, 17 Feb 2006 15:56:32 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-3476 This fool has sucked up about 1.5GB from one of my sites over the course of the last five days. The IP is already banned. Now I'm trying to decide whether to ban the user agent altogether. The way I see it, a simple HTTP class is really all that's necessary for any legit software. If the software needs to use a package that emulates a browser, it's probably not legit. And yes, if WordPress uses this, I hate it even more. :) This fool has sucked up about 1.5GB from one of my sites over the course of the last five days. The IP is already banned. Now I’m trying to decide whether to ban the user agent altogether. The way I see it, a simple HTTP class is really all that’s necessary for any legit software. If the software needs to use a package that emulates a browser, it’s probably not legit. And yes, if WordPress uses this, I hate it even more. :)

]]> by: Herschel http://spamhuntress.com/2006/01/24/block-snoopy/#comment-2970 Tue, 31 Jan 2006 22:15:36 +0000 http://spamhuntress.com/2006/01/24/block-snoopy/#comment-2970 There shouldn't be a huge impact from blocking the user agent. I checked my logs for one of my sites for 2005, and didn't have a single request from a Snoopy user agent all year. One of the nice things about Snoopy is that it's trivial to change the user agent that it uses. I'd think that a well-behaved Snoopy-using script would have already set the user agent to something that identified what it is. On the other hand, it also means it's easy for the bad scripts to become Internet Explorer. And I'll second the "it's not a site ripper" comment. Snoppy just makes it easy to request pages. If something's spidering your site and grabbing tons of pages, that's not Snoopy's doing; that's some other spidering code in there that's just using Snoopy to fetch each page. There shouldn’t be a huge impact from blocking the user agent. I checked my logs for one of my sites for 2005, and didn’t have a single request from a Snoopy user agent all year.

One of the nice things about Snoopy is that it’s trivial to change the user agent that it uses. I’d think that a well-behaved Snoopy-using script would have already set the user agent to something that identified what it is.

On the other hand, it also means it’s easy for the bad scripts to become Internet Explorer.

And I’ll second the “it’s not a site ripper” comment. Snoppy just makes it easy to request pages. If something’s spidering your site and grabbing tons of pages, that’s not Snoopy’s doing; that’s some other spidering code in there that’s just using Snoopy to fetch each page.

]]>