onyphe bot

[thomaslegg]

Unfortunately onyphe uses a random user agent string mimicking a typical browser.

websites for a few of the "probes"
http://fuentes.probe.onyphe.net/
http://dunlop.probe.onyphe.net/

Is this for Addition / Removal?

• [x ] Addition
• Removal
• Keep a watch on this one

Did the User-Agent request robots.txt first?

• Yes
• [ x] No

Post Log Excerpt to show User-Agent behavior (10-20 lines is enough)

188.165.87.97 - - [31/Jul/2024:10:25:54 +0000] "GET / HTTP/1.1" 200 6974 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0"

Additional information

Looking at their FAQ on their probe websites, onyphe requires either an email to them or blocking the ip ranges of their scanners.

51.255.62.0/28, 188.165.87.96/28, 37.187.215.240/28, 178.32.170.16/28, 45.43.33.218/32, 139.99.9.160/32, 178.32.197.80/28, 15.204.52.61/32, 142.4.218.114/32, 79.137.65.46/32, 213.32.25.76/32, 213.32.39.32/28, 51.254.49.96/28, 139.99.68.96/32, 15.235.189.144/28, 51.255.109.160/28, 51.91.233.195/32, 40.160.12.147/32, 146.59.184.0/28, 144.217.24.0/28, 192.99.175.176/28, 5.135.173.112/28, 51.161.50.176/28, 147.135.236.160/28, 167.114.24.176/28, 2001:41d0:403:1f43::1000/124, 134.209.101.182/32, 23.239.29.109/32, 45.43.33.210/32, 91.134.185.80/28, 151.80.91.208/28, 137.74.239.144/28, 147.135.23.96/28