Bad Bot from Savvis Communications Corporation in Cary NC?
July 18th, 2008I wrote a post in February 2008 about a badly behaving bot (Limelight Networks in Tempe and Kavam in San Jose). This morning, I’ve received a comment on that post about a potential new badly behaving bot. Here’s the information:
cary: 165.193.254.# (SAVVIS Communications Corporation)
I’m not seeing this bot yet on my web stats - but if any of you are seeing it, please leave a comment. I found some information on Wikipedia about the Savvis Communications Corporation, not very flattering stuff.
UPDATE:
After writing this article, I noticed a visit from the Savvis Communications Corporation in my own website statistics - to this very post - but unfortuately, they didn’t leave a comment. Maybe they’ll return.
Here’s the visit:
Jill--------------
J. Olkoski
Aldebaran Web Design, Seattle
Jill Olkoski has a BS in Engineering, a BS in Computer Science and an MA in Clinical Psychology. She delights in using her advanced technical and psychological skills to help small business owners develop cost-effective and successful websites.
July 18th, 2008 at 10:28 am
thanks for this! just “commenting” so i can get triple backup of any real comments posted
July 18th, 2008 at 12:33 pm
[...] posted about it on Jill Olkoski blog, and she has written more here, which is a better place to post comments or read more about any [...]
July 18th, 2008 at 12:39 pm
Ive just added a post about to one of my blogs here,
http://www.nrac.co.uk/directory/new-bot-coming-from-savvis/
I don’t accept comments, so have pointed anyone who wants to comment about it this way.
July 24th, 2008 at 6:08 am
Hi,
I’m getting consistant and irritating hits from Kavam, Savvis and Limelight on my StatCounter. Does anyone know if they’re all legitimate search engine bots SUPPOSED to allow easier access to my website ?
Thanks,
Ree
July 24th, 2008 at 8:36 am
Hi Ree,
From the best I can tell from my own experience and the experience of many others who have commented, these are not “well-behaved” bots, meaning they don’t respect instructions they should, hit the site more times than they should, etc. They’re not from Google, Yahoo, MSN or another major search engine - so I’d block them all..
August 23rd, 2008 at 10:27 am
I have had Limelight on my stats for more than a year! At first it seems that they were visiting 20-30 pages per day, now it’s multi times EVERY DAY but only one page at a time. Savvis has started the exact same routine daily….. WHY?????
August 23rd, 2008 at 10:27 am
PS…. Is there a way to block them from my site?
August 25th, 2008 at 12:10 pm
Hi Beth,
This article has some ways to block them:
http://aldebaranwebdesign.com/blog/kavam-limelight-network-searchme-robot-website-traffic/
I don’t really know why some companies create these badly behaving bots…there must be a reason…
September 4th, 2008 at 10:16 am
Kavaam is part of Searchme.com. I think the reason why there are so many bots visits is because of search results and bots constantly refreshing the thumbnail of a web site page that shows up on their search. I’ve seen that type of spidering from Alexa when on a vBulletin message board (meaning I would be in the Way Back machine () and visit a site and that site would see massive spider traffic).
Savvis is massively spidering my sites and it is getting annoying. so annoying in fact I may try to pass on this post and others to my web hosting company because they are usually receptive of user input… This is massive and unwanted traffic. What search engine is it part of, anyway?
September 4th, 2008 at 11:36 am
Hi John,
I would recommend passing it on to your hosting company, the more folks who complain the better. I’ve tried to contact the company directly, but to no avail. I don’t know what search engine it’s part of..
September 4th, 2008 at 3:51 pm
I started noticing weird bots about two months ago after I removed some compromised code from my site. Blocking the IP seemed to stop the attacks, but then today I noticed similar behavior from this IP address. I’m not sure who is behind it or if it’s even related, but their server sent about a half a dozen rapid hits to my site and then stopped. The weird part is that all of the hits were for posts that contained embeded music videos from YouTube. I’m not sure if other people have noticed the same behavior but it could be one of Hollywood’s goons trying to sanitize the net?
October 26th, 2008 at 1:46 am
I excluded that IP range from being tracked by the counter on my blog, several months ago. The counter gives limited informations about the visitors, so it took some time for me to decide that this was most likely a bot and not a human fan of my blog.
I came here because I had earlier commented on the Kavam/Limelight case and was consequently notified of your new post.
November 30th, 2008 at 7:21 am
I noticed many bounce hits from LLNW in Tempe earlier in the year. They were an annoyance. I guessed it was some crawler indexing pages, but my tracking is pretty crude and I didn’t identify any particular bot, and I guess I was just a bit annoyed that I didn’t know what it was agthering and why. But ultimately having my links gathered seemed to be a positive thing, provided I could discount the artificial bounce rates from my stats. A minor annoyance.
Recently the hit rate from LLNW in Tempe has surged again, this time a significant proporting do not show up as bounces, but multi-page dwells … which is confusing understanding of my stats even further, and increasing my curiosity.
Does anyone know if there is any “negative” purpose in these bot(s) crawling a blog such as mine ? Obviously I could easily exclude LLNW IP address visits from my stats, and maybe I could exclude specific bots, but what would I be missing ?
http://www.psybertron.org/?p=1840
Regards
Ian
November 30th, 2008 at 10:09 am
Hi Ian,
Other than what you’ve already mentioned (the horrible bounce rate effect), I don’t know of any negative purpose. I have had folks claim they had to close down their websites, but in chatting with them, they were unable to explain to me why this was necessary.
November 30th, 2008 at 11:02 am
I should note that one of my readers sent me an email that took issue with my last comment - that she indeed had to shut down her website due to this bot. I’ll take this opportunity to explain why I still have difficulty understanding why this would be necessary. First off, generally speaking, most hosting companies allow you to block traffic from certain IP addresses. If you track your traffic, you know the IP addresses of these bad bots, and you can block them if you wish. Secondly, even if a bot hits your website and messes up your website traffic stats, this doesn’t necessarily cause your website to crash. Traffic is traffic. And unless you have a website that goes viral and gets a bizillion hits a day that causes the server to crash - just getting hit by this particular bot wouldn’t do that. At most, I only got maybe 10 hits from this bot a day, no where near the magnitude that would cause a server crash. Again, an annoyance, but not enough to functionally cause failure, or to cause me to take down my website.
Now indeed it does mess up your website stats. Some website stat companies will let you block IP addresses from showing up in stats. Or you can simply ignore the traffic. The reader that shut down her site is correct in accusing me of simply not believing her - because I wouldn’t shut down my own website just because there were bot hits in my traffic stats. I don’t understand the nature of her business, but for all the small businesses I’ve worked with over the years, this would not be required at all. Again, let’s separate annoying website traffic from so much traffic that your website server is overwhelmed or causing some other issue that causes you to voluntarily shut down your website. If your website is critical to your business, like mine is, you need to find a solution to this issue, and not simply abandon your business website. Block the IP address from your website, from your statistics (and if your stats don’t do this, find one that does), but don’t just give up and shut down your website. Just because you get spam, you don’t shut down your business email account, right? Same thing here, if your website is critical, these bots are annoying, but harmless, and you - just like me - should be able to banish them from your website traffic. No magic required.
November 30th, 2008 at 11:29 am
Thanks for the feedback Jill.
I think I can block them from my stats anytime I choose. I’m just going to monitor the situation. It skews the stats, but it’s managable, not a critical level for me, even with the recent surge of multiple pages per “visit”.
The sad thing is that SearchMe, the result of this exercise doesn’t really do anything for me. Gimmicky quick scanning of linked pages, but 99% of them are my history going back 7 years, and I can personally monitor newer hits on a daily / weekly basis.
January 6th, 2009 at 10:50 am
In my spy vue I see multiple IPS coming from a server in Cary NC is them? It ismessing up my stats and I need to block them, but with multi Ips how do I do this.
June 30th, 2010 at 1:19 pm
Here’s a list of their IP blocks:
161.69.170.71/32, 161.69.170.72/32, 161.69.170.73/32, 161.69.170.74/32, 161.69.170.75/32, 161.69.170.76/32, 161.69.170.77/32, 161.69.170.78/32, 161.69.170.79/32, 161.69.170.80/32, 161.69.170.81/32, 161.69.170.82/32, 161.69.170.83/32, 161.69.170.84/32, 161.69.170.85/32, 161.69.170.86/32, 165.193.42.64/26, 165.193.42.128/26, 85.92.223.0/26, 217.169.58.64/26, 64.14.3.193/26, 64.41.168.241/28, 216.35.7.96/27, 64.41.140.96/27, 203.82.140.96/28, 203.82.133.128/27
(gathered from http://www.mcafeesecure.com/help/scanips.jsp)
I blocked all of these directly in our firewall because their scanner is far too aggressive.