Attributor: Abuse other people’s resources with confidence

Posted 2008-03-12 in Spam by Johann.

Attributor constantly scans billions of web pages to find copies of your content across the Internet

…in stealth mode, of course.

$ egrep '^64.41.145.' <logfile>
64.41.145.193 … "GET /blog/?flavor=rss2 HTTP/1.1" 301 0 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705)" "-"
64.41.145.193 … "GET /blog/ HTTP/1.1" 200 18934 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 1.0.3705)" "-"

Their other crawler is slightly more “open”:

64.41.145.167 … "GET /software/stringsearch/ HTTP/1.0" 403 4252 "…" "Mozilla/5.0 (compatible; attributor/1.13.2 +http://www.attributor.com)" "-"

Block Attributor

Let’s perform the standard RDNS trick.

(Asked whois.arin.net:43 about +64.41.145.193)
…
 OrgName:    Attributor Corporation 
 OrgID:      ATTRI 
 Address:    1779 Woodside Road  Suite 200 
 Address:    ATTN Adrian McDermott 
 City:       REDWOOD CITY 
 StateProv:  CA 
 PostalCode: 94061 
 Country:    US 
 NetRange:   64.41.145.0 - 64.41.145.255 
 CIDR:       64.41.145.0/24 

Attributor’s netblock: 64.41.145.0/24.