A half-dozen bloggers emailed with a similar experience with Cyveillance 'bots showing up after they had written about music-related stuff. A really interesting note came from Arlen who runs a chess site with no music commentary whatsoever.

A 'bot from 63.148.99.247 ran over his site, hitting every html file in his directories in the order in which they were listed on pages, including PGN files (portable game notation - wonder if it's looking for copyrighted binaries). The 'bot identified itself as "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)", but never downloaded graphics, CSS or java files, so I guess it was 'spoofing' (referrers, I'm told, being easy to spoof).

Arlen's site was scanned once, and no returns so far... so it does seem like Cyveillance' attention is topic driven: Arlen's chess site, no music copy, has had 52 visits, www.gulker.com, that hotbed of opinion about the future, including the future of entertainment, has had nearly 1000 since December 15.

At around 1 PM, a 'bot (63.148.99.232) came in on a link from Dave Winer's site, and at about 4:30 it came back on a link from Stefan Smalla's. It has yet, however, to jump on the bot-bait; I'm curious to see its behavior in that particular directory. Stay tuned. Many thanks to all for the pointers to Webmasterworld.com etc.

Comments 8:50:30 PM    

From arin.net:

Cyveillance (NETBLK-QWEST-63-148-99-224) QWEST-63-148-99-224 63.148.99.224 - 63.148.99.255

In one thread, a writer says that he has received 'cease and desist' letters for posting comments about Cyveillance clients. Creepy...
Comments 9:58:43 AM    

The IP addresses that access my site most often are 63.148.99.229, 63.148.99.232, and 63.148.99.247. The behavior looks like a crawler - it has followed links from scriptingnews.com, doc.weblogs.com, ridey.net, radiofreeblogistan.com, archipelago.phrasewise.com, as well as indexes like Daypop and Technorati so I'm guessing those sites are being crawled as well.

What I see in the April access log is that within a day or two of writing about music, publishing, copyright, electronic distribution etc., there is a pattern of access or crawling, particularly from 63.148.99.232. I'm trying to see if there is a wider pattern... drop me a line if you see the same...
Comments 9:26:48 AM    

Chris Gulker's view from Silicon Valley - in words and pictures