Message Board

Newbie/Basic Questions

psycheclone

Author: S.Oconnor (27 Jun 06 6:27pm)

Has anyone come across a bot called psycheclone before? I just pulled this from my logs. It looks promising as an email harvester....

208.66.195.4 - - [27/Jun/2006:19:22:09 +0100] "GET /wordpress/javascript:popwin(1); HTTP/1.1" 200 11394 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:32 +0100] "GET /antispam1.htm HTTP/1.1" 200 13568 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:35 +0100] "GET /antispam2.htm HTTP/1.1" 200 13620 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:37 +0100] "GET /antispam3.htm HTTP/1.1" 200 13861 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:39 +0100] "GET /antispam4.htm HTTP/1.1" 200 16052 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:42 +0100] "GET /antispam5.htm HTTP/1.1" 200 16722 "-" "psycheclone"
62.254.64.19 - - [27/Jun/2006:19:22:44 +0100] "GET /img/aspam.gif HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
208.66.195.4 - - [27/Jun/2006:19:22:45 +0100] "GET /antispam6.htm HTTP/1.1" 200 16433 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:48 +0100] "GET /antispam7.htm HTTP/1.1" 200 18753 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:49 +0100] "GET /antispam8.htm HTTP/1.1" 200 20646 "-" "psycheclone"
62.254.64.19 - - [27/Jun/2006:19:22:51 +0100] "GET /img/aspam.gif HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
208.66.195.4 - - [27/Jun/2006:19:22:52 +0100] "GET /antispam9.htm HTTP/1.1" 200 23867 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:54 +0100] "GET /antispam10.htm HTTP/1.1" 200 22037 "-" "psycheclone"
62.254.64.19 - - [27/Jun/2006:19:22:55 +0100] "GET /img/aspam.gif HTTP/1.1" 304 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
208.66.195.4 - - [27/Jun/2006:19:22:57 +0100] "GET /antispam11.htm HTTP/1.1" 200 22325 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:22:59 +0100] "GET /antispam12.htm HTTP/1.1" 200 24176 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:03 +0100] "GET /antispam13.htm HTTP/1.1" 200 24218 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:05 +0100] "GET /antispam14.htm HTTP/1.1" 200 21471 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:08 +0100] "GET /antispam16.htm HTTP/1.1" 200 22447 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:10 +0100] "GET /antispam15.htm HTTP/1.1" 200 21481 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:12 +0100] "GET /antispam17.htm HTTP/1.1" 200 20677 "-" "psycheclone"
84.29.177.85 - - [27/Jun/2006:19:23:14 +0100] "GET /img/aspam.gif HTTP/1.1" 200 1573 "http://www.bored.me.uk/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; nl; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4"
208.66.195.4 - - [27/Jun/2006:19:23:14 +0100] "GET /antispam18.htm HTTP/1.1" 200 23612 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:16 +0100] "GET /antispam19.htm HTTP/1.1" 200 28706 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:18 +0100] "GET /antispam20.htm HTTP/1.1" 200 24139 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:21 +0100] "GET /antispam21.htm HTTP/1.1" 200 24868 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:23 +0100] "GET /antispam22.htm HTTP/1.1" 200 24114 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:25 +0100] "GET /antispam23.htm HTTP/1.1" 200 20007 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:27 +0100] "GET /antispam24.htm HTTP/1.1" 200 34573 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:29 +0100] "GET /antispam25.htm HTTP/1.1" 200 40795 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:33 +0100] "GET /antispam26.htm HTTP/1.1" 200 34984 "-" "psycheclone"
208.66.195.4 - - [27/Jun/2006:19:23:36 +0100] "GET /muddled.php HTTP/1.1" 200 9646 "-" "psycheclone"

Re: psycheclone

Author: M.Prince (29 Jun 06 5:28pm)

Yep, it's an email harvester running on about 10 IPs. For example, check out:

http://projecthoneypot.org/ip_inspector.php?iph=1299a9a3d18c6b320f13d564d05f55e7

Can follow the IPs in the neighborhood.

Matthew.

Re: psycheclone

Author: S.Oconnor (5 Jul 06 3:33pm)

Ah, Thanks Matthew.

Thats why I posted it in the newbie secion!

Cheers,
Shaun