Twiceler

Twiceler is a web crawler from the "upcoming" Cuill corporation.

IP involvement

Way-too-much traffic from Twiceler comes from 38.99.44.0/24

Block?

Twiceler pulls down a whole lot of pages and seems confused when crawling. Then again, official website story is that it is "experimental".

Blocking Twiceler is highly recommended regardless of it's very bad behavior being caused intentionally or by error.

Official story

Their story regarding their robot can be read here: http://cuill.com/twiceler/robot.html

That story does not hold water.

What is Cuill? What is Twiceler?, it's just new kind of spam

by Darcy Whyte

Official story of Cuill is Nonsense, it's just new kind of spam.

They claim that they are experimental and "Stealth". If you look at the log entries that they create when their crawler tromps across a Web site it's fairly clear what's going on. It is one or both of the following (I have pasted a small sample below for anybodies convenience:

Spam:

Every Web master gets a lot of links to their Web site (Name Servers are with Register.com). Their traffic is just a lot of Web masters coming to find out why their logs are full of garbage and their band width is being wasted.

Discovery of Vulnerabilities:

If you look at the sample log entries below, many of the querystring variables are made up. (I know because the Web site that this came from was designed by me and it doesn't have those varables). So the system is very possibly looking for some sort of hole or vulnerability. Perhaps looking for an in for an injection attack.

They do not follow the robots.txt, don't respond to phone calls, clearly are wasting people's time and getting attention for being a menace not for any legitimate start-up activity.

Sample log entries from a Web site their Bot has been to:

64.1.215.166 - - [17/Feb/2008:06:34:10 -0500] "GET /index.php?V=&d=2&action=events&c=20090106 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:35:43 -0500] "GET /index.php?d=&action=events&c=20080907 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:36:41 -0500] "GET /index.php?VenueID=459&action=event&d=5 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:39:09 -0500] "GET /index.php?action=events&c=20080531&d=2 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:39:30 -0500] "GET /index.php?c=20070613&action=event&d=2 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:40:13 -0500] "GET /index.php?w=&action=events&c=20071223 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:41:54 -0500] "GET /index.php?key=&action=events&c=20080905 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:42:37 -0500] "GET /index.php?action=events&c=20070906&d=49 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:43:27 -0500] "GET /index.php?d=250&action=events&c=20070519 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:44:07 -0500] "GET /index.php?c=20070705&action=event&d=20 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:47:11 -0500] "GET /index.php?ke=&action=events&c=20070928 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:48:22 -0500] "GET /index.php?w=&action=events&c=20080802 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:48:35 -0500] "GET /index.php?action=events&c=20070321&d=250 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:48:56 -0500] "GET /index.php?action=events&c=20070704&d=2 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:49:12 -0500] "GET /index.php?widt=&action=events&c=20070824 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:51:17 -0500] "GET /index.php?action=events&c=20080427&d=49 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"
64.1.215.166 - - [17/Feb/2008:06:51:52 -0500] "GET /index.php?action=events&c=20070424&d=99 HTTP/1.0" 302 - "-" "Mozilla/5.0 (Twiceler-0.9 http://www.cuill.com/twiceler/robot.html)"