Comments on: Scam of the Day: LiteFinder.net

By: Andreas Gabler

Andreas Gabler — Wed, 02 Jan 2008 14:46:16 +0000

“Gigamega.bot” is an other harvester.

He visited our web page
http://www.abx-radeberg.de/error.php
on 25th December 2007 at 02:13 CET.

He identified himself as
“Mozilla/5.0 (compatible; Gigamega.bot/1.0;
+http://www.gigamega.net/bot.html)”.

His IP address: 74.86.209.74.

We showed him an email address generated only for him.
We received the first spam for this email address on
27th December 2007.
The email sender was 195.234.132.37.

Regards
Andreas Gabler.

By: Andreas Gabler

Andreas Gabler — Wed, 02 Jan 2008 14:44:58 +0000

“litefinder.net” is a harvester. He collects email addresses from web sites and adds them to spam mailing lists.

He visited our web page http://www.abx.de/error.php on 06th November from 74.86.209.74. We showed him an email address generated only for him. On 11th December we received the first spam for this email address.

He visited us on 12th November from 216.40.222.82. First spam on 18th December.

Visit on 24th November 70.85.113.242. First spam on 15th December.

Regards
Andreas Gabler.

By: CoCaman

CoCaman — Thu, 27 Dec 2007 15:22:38 +0000

Hi Alphane Moon

Thanks for the info. Haven’t seen that one yet. But I think it is only a matter of time before they would show up here.

By: Alphane Moon

Alphane Moon — Thu, 27 Dec 2007 15:15:01 +0000

Hi,

Here is another one following the same pattern:

“gigamega.net is a research project started by a group of Russian candidates from the cities of Saint-Petersburg, Nizhnii Novgorod and Novosibirsk. The project serves as a testing ground for information search technologies and programs, developed by a group of young scientists.”

They don’t want to reveal their IP addresses:

“Can I learn the IP addresses, which Gigamega-Bot comes from?
Unfortunately, You can’t since it is against the rules of our company.”

I highly recommend blocking their abusive bot. Its User-Agent is:

Mozilla/5.0 (compatible; Gigamega.bot/1.0; +h*t*t*p://*w*w*w*.gigamega.net/bot.html)

(Asterisks* in URLs added by me, I don’t want this transformed into a link)

By: Martin

Martin — Sun, 02 Dec 2007 18:44:12 +0000

Have just include your small PHP script on my website – thanks

The following IP addresses was identified as originating from LiteFinder:
60.190.240.73, 67.19.114.226, 70.84.212.114, 70.85.113.242, 74.53.249.34, 74.86.14.10, 74.86.209.74, 75.125.47.162, 208.101.44.3, 216.40.222.50, 216.40.222.98

Martin.

By: CoCaman

CoCaman — Sat, 01 Dec 2007 14:29:05 +0000

@Roel
Thanks for you input.
Yeah, texts look very the same. Glad I am not the only one having a problem with their “service”.

By: Roel

Roel — Sat, 01 Dec 2007 13:16:37 +0000

I just also ran into LiteFinder, and I thought I recognised a pattern; earlier this year, I got plundered by something called IDBot. From http://id-search.org/bot.html :

“ID-Search.org is a research project started by a group of Russian candidates from the cities of Saint-Petersburg, Nizhnii Novgorod and Novosibirsk. The project serves as a testing ground for information search technologies…”

From http://www.litefinder.net/about.html :

“LiteFinder Network Crawler is a research project started by a group of Indian candidates from the cities of Bangalore, Patna and Jaipur. The project serves as a testing ground for information search…”

Neither will reveal their robots’ IPs because of “company policy”.

‘Nuff said, methinks. Blocked.