sexodrome.net HITBOT traffic
 

Beware with sexodrome.net, if you trade with him, check webserver logs

All visitors have exactly the same user agent
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)"

Any visitor accepts cookies (Not a single one)

All visitor's browser send an Accept-Language header "fr", but IPs are from USA, i don't think US people use french browsers

graphics are not loaded, (counters aren't loaded also, so you will not get the traffic reported)

webmaster is now on icq claiming he is not cheating, so here are weblogs


68.8.76.17 - - [28/Jun/2004:12:14:56 +0000] "GET / HTTP/1.1" 200 21080 "http://w
ww.sexodrome.net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)"
-
68.8.76.17 - - [28/Jun/2004:12:14:57 +0000] "GET /cgi-bin/out.cgi?s=60&gr=fr&l=t
h1286&u=http://gallys.nastydollars.com/mh/213/?id=wintel&t=rand HTTP/1.1" 302 32
4 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0;
Q312461)" -

no more accesses from that IP, not a single graphic

24.243.2.48 - - [28/Jun/2004:12:21:34 +0000] "GET / HTTP/1.1" 200 21080 "http://
www.sexodrome.net/main.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0
; Q312461)" -
24.243.2.48 - - [28/Jun/2004:12:21:35 +0000] "GET /cgi-bin/out.cgi?s=60&gr=fr&l=
th1812&u=http://gallys.nastydollars.com/sb/23/?id=wintel&t=rand HTTP/1.1" 302 32
3 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0;
Q312461)" -

no more access from that IP

216.214.203.174 - - [28/Jun/2004:12:24:59 +0000] "GET / HTTP/1.1" 200 21080 "htt
p://www.sexodrome.net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312
461)" -
216.214.203.174 - - [28/Jun/2004:12:25:07 +0000] "GET /cgi-bin/out.cgi?s=60&gr=f
r&l=th1812&u=http://gallys.nastydollars.com/sb/23/?id=wintel&t=rand HTTP/1.1" 30
2 323 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0; Q312461)" -

same

172.151.146.63 - - [28/Jun/2004:12:25:09 +0000] "GET / HTTP/1.1" 200 21080 "http
://www.sexodrome.net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q3124
61)" -
172.151.146.63 - - [28/Jun/2004:12:25:12 +0000] "GET /cgi-bin/out.cgi?s=60&gr=fr
&l=th1758&u=http://gallys.nastydollars.com/sl/185/?id=wintel&t=rand HTTP/1.1" 30
2 324 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0; Q312461)" -

same

172.147.78.15 - - [28/Jun/2004:12:25:55 +0000] "GET / HTTP/1.1" 200 21080 "http:
//www.sexodrome.net/main.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5
.0; Q312461)" -
172.147.78.15 - - [28/Jun/2004:12:25:57 +0000] "GET /cgi-bin/out.cgi?s=60&gr=fr&
l=th1812&u=http://gallys.nastydollars.com/sb/23/?id=wintel&t=rand HTTP/1.1" 302
323 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.
0; Q312461)" -

24.140.10.181 - - [28/Jun/2004:12:25:58 +0000] "GET / HTTP/1.1" 200 21080 "http:
//www.sexodrome.net/main.shtml" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5
.0; Q312461)" -
24.140.10.181 - - [28/Jun/2004:12:26:01 +0000] "GET /cgi-bin/out.cgi?s=60&gr=fr&
l=th6261&u=http://www.galleryhost.com/1002689/1/grandegirls/9354/007/ HTTP/1.1"
302 323 "http://www.suckbabe.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows N
T 5.0; Q312461)" -

and hundreds more like this

Also said in ICQ "man i sent you two outs how can you tell that i send you hitbots ? why such a conclusion ?"

So, if his trading script didn't send the hits, he is not being hitted by a hitbot, but i am being with his referer