bots no luar …

e aí mr.tecnologia …
pensou que pode roubar?
vai tomar um pouco luar …

aqui um dos modos operandi dos gangster bots que passam pela internet fazendo arrastão, pegando propriedade intellectual como fosse capim no mato

aqui as fotos são minhas, você vai e suma

observe o funcionamento, os bots aparecem numa rajada rápida somente acessando as páginas de galerias de fotos (HFEED), nessa fase a operação é idêntica ao acesso de um visitante com navegador,mas o que fazem é apenas coletar os links de paginação

em princípio nada ilícito nisso, só que a segunda fase releva a verdadeira intenção

o importante de observar aqui é, para fins de camuflagem da intenção cada um desses acesso vem de um outro endereço IP, uma rajada de 66 acessos em menos de 27 segundos …

13/09/26 11:08:29  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 200.80.102.222 ...   13/09/26 11:08:28  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 189.40.83.221 ...   13/09/26 11:08:26  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 170.254.206.0 ...   13/09/26 11:08:26  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 128.121.220.231 ...   13/09/26 11:08:26  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.239.11.231 ...   13/09/26 11:08:25  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.166.207.247 ...   13/09/26 11:08:25  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 78.99.146.205 ...   13/09/26 11:08:24  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 200.236.195.73 ...   13/09/26 11:08:24  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 167.160.173.96 ...   13/09/26 11:08:24  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 168.196.162.194 ...   13/09/26 11:08:23  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 189.6.209.142 ...   13/09/26 11:08:23  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 168.228.67.126 ...   13/09/26 11:08:23  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 190.0.247.36 ...   13/09/26 11:08:23  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 161.123.92.151 ...   13/09/26 11:08:23  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 177.10.181.30 ...   13/09/26 11:08:22  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 179.57.102.216 ...   13/09/26 11:08:22  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 167.234.109.10 ...   13/09/26 11:08:22  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 74.244.135.218 ...   13/09/26 11:08:22  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 191.243.89.58 ...   13/09/26 11:08:21  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.228.136.191 ...   13/09/26 11:08:21  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 209.139.50.43 ...   13/09/26 11:08:21  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.171.221.36 ...   13/09/26 11:08:21  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 207.248.4.252 ...   13/09/26 11:08:21  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 177.129.69.172 ...   13/09/26 11:08:20  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 191.54.87.98 ...   13/09/26 11:08:20  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 177.75.137.220 ...   13/09/26 11:08:19  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 177.200.148.226 ...   13/09/26 11:08:19  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 202.81.214.55 ...   13/09/26 11:08:19  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 132.255.159.99 ...   13/09/26 11:08:19  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.160.84.141 ...   13/09/26 11:08:19  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 177.73.43.42 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 190.229.186.134 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 167.234.120.28 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 142.147.146.93 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 128.121.227.136 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 179.0.58.34 ...   13/09/26 11:08:18  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 180.92.146.223 ...   13/09/26 11:08:17  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.78.94.170 ...   13/09/26 11:08:17  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 173.254.208.229 ...   13/09/26 11:08:17  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 91.233.109.204 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 142.147.152.13 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 80.76.54.92 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 62.101.189.54 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 209.207.182.227 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 180.92.146.223 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 209.207.166.77 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 162.43.224.191 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 152.39.176.13 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 194.135.26.34 ...   13/09/26 11:08:16  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 62.112.12.214 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 222.167.117.22 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 154.17.140.106 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 173.254.208.43 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 64.105.210.90 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 157.254.120.48 ...   13/09/26 11:08:15  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 64.144.205.45 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 66.167.64.121 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 222.167.101.44 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 64.144.203.170 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 209.207.238.212 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 157.254.112.7 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 222.167.111.40 ...   13/09/26 11:08:14  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 103.206.162.62 ...   13/09/26 11:08:12  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 198.145.141.172 ...   13/09/26 11:08:12  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 157.254.107.155 ...   13/09/26 11:08:12  HFEED FT  L201  New Query or Search with [18] Posts, displaying Feed Page for 45.59.17.254 ...  

segue a segunda fase, revelada por meu sistema de rastreamento fino e oculto, pegando eles no ato de querer extrair as imagens em cada página obtida na fase um, é a PESCADA (fishing) e não confundir com phishing

observe as marcas de tempo, e o endereço IP, a expansão dos dados pelo primeiro acesso é imediata, agora os acessos tem nome de onde viram …

13/09/26 11:08:29  200.80.102.222  applewebkit  Gangster Bot  fishing  CHARON  AS271359  BR ss fiber telecom eireli  linha-de-tempo-em-ordem-descente/page/36   13/09/26 11:08:29  189.40.83.221  applewebkit  Gangster Bot  fishing  CHARON  AS26615  BR tim s/a  linha-de-tempo-em-ordem-descente/page/35   13/09/26 11:08:27  170.254.206.0  applewebkit  Gangster Bot  fishing  CHARON  AS52307  AR corpico ltda  linha-de-tempo-em-ordem-descente/page/25   13/09/26 11:08:26  128.121.220.231 applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/36   13/09/26 11:08:26  45.239.11.231  applewebkit  Gangster Bot  fishing  CHARON  AS264562  BR pbr servicos de telecomu linha-de-tempo-em-ordem-descente/page/57   13/09/26 11:08:25  45.166.207.247  applewebkit  Gangster Bot  fishing  CHARON  AS262481  BR vero s.a  linha-de-tempo-em-ordem-descente/page/34   13/09/26 11:08:25  78.99.146.205  applewebkit  Gangster Bot  fishing  CHARON  AS6855  SK slovak telekom, a.s.  linha-de-tempo-em-ordem-descente/page/37   13/09/26 11:08:24  200.236.195.73  applewebkit  Gangster Bot  fishing  CHARON  AS28649  BR desktop sigmanet comunic linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:24  168.196.162.194 applewebkit  Gangster Bot  fishing  CHARON  AS265465  BR jjva provedor de interne linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:24  167.160.173.96  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/25   13/09/26 11:08:24  189.6.209.142  applewebkit  Gangster Bot  fishing  CHARON  AS28573  BR claro nxt telecomunicaco linha-de-tempo-em-ordem-descente/page/22   13/09/26 11:08:24  168.228.67.126  applewebkit  Gangster Bot  fishing  CHARON  AS264912  BR alcantara e oliveira ltd linha-de-tempo-em-ordem-descente/page/3   13/09/26 11:08:23  190.0.247.36  applewebkit  Gangster Bot  fishing  CHARON  AS27951  CO media commerce partners  linha-de-tempo-em-ordem-descente/page/26   13/09/26 11:08:23  161.123.92.151  applewebkit  Gangster Bot  fishing  CHARON  AS207990  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/35   13/09/26 11:08:23  177.10.181.30  applewebkit  Gangster Bot  fishing  CHARON  AS52933  BR conectiva tecnologia ltd linha-de-tempo-em-ordem-descente/page/38   13/09/26 11:08:22  179.57.102.216  applewebkit  Gangster Bot  fishing  CHARON  AS14117  CL telefonica del sur s.a.  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:22  167.234.109.10  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/57   13/09/26 11:08:22  74.244.135.218  applewebkit  Gangster Bot  fishing  CHARON  AS14593  US space exploration techno linha-de-tempo-em-ordem-descente/page/36   13/09/26 11:08:22  191.243.89.58  applewebkit  Gangster Bot  fishing  CHARON  AS28210  BR giga mais fibra telecomu linha-de-tempo-em-ordem-descente/page/58   13/09/26 11:08:21  45.228.136.191  applewebkit  Gangster Bot  fishing  CHARON  AS266673  PY flytec telecom sociedad  linha-de-tempo-em-ordem-descente/page/37   13/09/26 11:08:21  209.139.50.43  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/34   13/09/26 11:08:21  45.171.221.36  applewebkit  Gangster Bot  fishing  CHARON  AS267776  CL optiwisp spa  linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:21  177.129.69.172  applewebkit  Gangster Bot  fishing  CHARON  AS28639  BR localnet network  linha-de-tempo-em-ordem-descente/page/29   13/09/26 11:08:21  207.248.4.252  applewebkit  Gangster Bot  fishing  CHARON  AS271330  BR dide telecomunicacoes lt linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:20  191.54.87.98  applewebkit  Gangster Bot  fishing  CHARON  AS53006  BR algar telecom s/a  linha-de-tempo-em-ordem-descente/page/23   13/09/26 11:08:20  177.200.148.226 applewebkit  Gangster Bot  fishing  CHARON  AS52793  BR kelvyn sat comercio e te linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:20  177.75.137.220  applewebkit  Gangster Bot  fishing  CHARON  AS28146  BR mhnet telecom  linha-de-tempo-em-ordem-descente/page/21   13/09/26 11:08:20  202.81.214.55  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/37   13/09/26 11:08:19  132.255.159.99  applewebkit  Gangster Bot  fishing  CHARON  AS262404  BR jc servicos de internet  linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:19  45.160.84.141  applewebkit  Gangster Bot  fishing  CHARON  AS268404  BR digital virtual ltda - m linha-de-tempo-em-ordem-descente/page/35   13/09/26 11:08:19  177.73.43.42  applewebkit  Gangster Bot  fishing  CHARON  AS265475  BR muvnet telecom  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:19  167.234.120.28  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/22   13/09/26 11:08:19  190.229.186.134 applewebkit  Gangster Bot  fishing  CHARON  AS7303  AR telecom argentina s.a.  linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:18  142.147.146.93  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/3   13/09/26 11:08:18  128.121.227.136 applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/58   13/09/26 11:08:18  179.0.58.34  applewebkit  Gangster Bot  fishing  CHARON  AS271498  BR zen internet e telecomun linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:18  180.92.146.223  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:17  45.78.94.170  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/23   13/09/26 11:08:17  173.254.208.229 applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/26   13/09/26 11:08:17  91.233.109.204  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/25   13/09/26 11:08:17  80.76.54.92  applewebkit  Gangster Bot  fishing  CHARON  AS9009  RO m247 europe srl  linha-de-tempo-em-ordem-descente/page/36   13/09/26 11:08:17  142.147.152.13  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:16  62.101.189.54  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/36   13/09/26 11:08:16  209.207.182.227 applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:16  180.92.146.223  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/38   13/09/26 11:08:16  152.39.176.13  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:16  209.207.166.77  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/35   13/09/26 11:08:16  162.43.224.191  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/29   13/09/26 11:08:16  194.135.26.34  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:16  222.167.117.22  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/37   13/09/26 11:08:16  62.112.12.214  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:15  154.17.140.106  applewebkit  Gangster Bot  fishing  CHARON  AS46261  US quickpacket, llc  linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:15  173.254.208.43  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:15  64.105.210.90  applewebkit  Gangster Bot  fishing  CHARON  AS30058  US fdcservers.net  linha-de-tempo-em-ordem-descente/page/35   13/09/26 11:08:15  157.254.120.48  applewebkit  Gangster Bot  fishing  CHARON  AS9009  RO m247 europe srl  linha-de-tempo-em-ordem-descente/page/34   13/09/26 11:08:15  64.144.205.45  applewebkit  Gangster Bot  fishing  CHARON  AS30058  US fdcservers.net  linha-de-tempo-em-ordem-descente/page/37   13/09/26 11:08:15  66.167.64.121  applewebkit  Gangster Bot  fishing  CHARON  AS30058  US fdcservers.net  linha-de-tempo-em-ordem-descente/page/3   13/09/26 11:08:15  222.167.101.44  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/57   13/09/26 11:08:14  64.144.203.170  applewebkit  Gangster Bot  fishing  CHARON  AS30058  US fdcservers.net  linha-de-tempo-em-ordem-descente/page/58   13/09/26 11:08:14  209.207.238.212 applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/21   13/09/26 11:08:14  157.254.112.7  applewebkit  Gangster Bot  fishing  CHARON  AS9009  RO m247 europe srl  linha-de-tempo-em-ordem-descente/page/31   13/09/26 11:08:14  222.167.111.40  applewebkit  Gangster Bot  fishing  CHARON  AS20473  US the constant company, ll linha-de-tempo-em-ordem-descente/page/27   13/09/26 11:08:14  103.206.162.62  applewebkit  Gangster Bot  fishing  CHARON  AS203020  IN hostroyale technologies  linha-de-tempo-em-ordem-descente/page/33   13/09/26 11:08:13  198.145.141.172 applewebkit  Gangster Bot  fishing  CHARON  AS64249  US charles river operation  linha-de-tempo-em-ordem-descente/page/26   13/09/26 11:08:12  157.254.107.155 applewebkit  Gangster Bot  fishing  CHARON  AS9009  RO m247 europe srl  linha-de-tempo-em-ordem-descente/page/25   13/09/26 11:08:12  45.59.17.254  applewebkit  Gangster Bot  fishing  CHARON  AS262287  BR latitude.sh ltda  linha-de-tempo-em-ordem-descente/page/23

estas rajadas aparecem várias vezes durante o dia e em números de acessos variados, não existe regra

existem outro métodos, este modo demonstrado aqui é o mais simples,mas ao mesmo tempo sofisticado suficiente para que a segunda fase não aparece em logs normais dos servidores, passa também facilmente pelas plugins ou aplicativos tipo WAF (Web Application Firewall) que na verdade não é firewall nenhum, apenas um nome interessante para vender …

surge uma dúvida – como pode ter tantos IPs diferente e de operadoras distintas?

existem várias teorias e não passam de ser teoria, de acordo com fingerprints nos logs acreditamos que se trata de roteadores comprometidos nas casas dos usuários, em termos técnicos com backdoor … durante a analise conseguimos acessar alguns desses IPs e apareceu a tela administrativo roteadores típicos

sem mais delongas, está suficientemente explicado para entender o negócio culto em volta dos bots, que segundo entendimentos comuns e pronunciamentos de operadores de bots, servem para “melhorar a experiência dos usuários” …

espero que deu para entender, tire sua conclusão sobre a realidade mostrada vs as conversas nas redes …


esta foi a treceira postagem sobre a Gangster Bot Máfia, mais informações nos seguintes links, primeira postagem: relógio para gangster bots ticando e a segunda: gangster bots modo de operação

here the english text:

"bots in the moonlight" <image full moon in a hand> e aí mr.technology ... thought you could steal? go and take some moonlight ... here is one of the modus operandi of the gangster bots that roam the internet doing a sweep, grabbing intellectual property as if it were grass in the wild here the photos are mine, go away and don´t come back ! observe the operation, the bots appear in a quick burst only accessing the photo gallery pages (HFEED), in this phase the operation is identical to the access of a visitor with a browser,but what they do is only collect the pagination links in principle there is nothing illicit in this, except that the second phase reveals the true intention the important thing to observe here is, for the purpose of camouflaging the intention each one of these accesses comes from a different IP address, a burst of 66 accesses in less than 27 seconds ... <first log excerpt> here comes the second phase, revealed by my fine-grained and hidden tracking system, catching them in the act of trying to extract the images on each page obtained in phase one, it is the FISHING and don't confuse it with phishing observe the timestamps, and the IP addresses, the expansion of the data from the first access is immediate, now the accesses have the name of where each came from ... <second log excerpt> these bursts appear several times during the day and with varying numbers of accesses, there is no rule there are other methods, this mode demonstrated here is the simplest,but at the same time sophisticated enough that the second phase does not appear in normal server logs, it also easily passes through plugins or applications like WAF (Web Application Firewall) which in fact is not a firewall at all, just an interesting name to sell ... a question arises - how can there be so many different IPs and from different operators? there are several theories and they are nothing more than theories, according to fingerprints in the logs we believe that these are compromised routers in users' homes, in technical terms with a backdoor ... during the analysis we managed to access some of these IPs and the administrative screen of typical routers appeared without further ado, this is sufficiently explained to understand the cult business around bots, which according to common understandings and statements by bot operators, are used to "improve the user experience" ... hope you got the real picture ...