dstiles - 9:42 pm on Jul 6, 2010 (gmt 0)
Not just casper. I would suggest anything with "bot search" in the UA as that seems to be common to many (all?) I've seen so far, including "dex" and "plaNETWORK" (sic).
Ok, blocking "bot search" may be a little drastic... Does anyone know if any genuine bot has that phrase in its UA?
All those I've seen seem to come from compromised servers from ThePlanet down to tin-pot little RIP ones I've never encountered before. In fact there have been a lot of the latter!
I've only caught two new IPs today (although several old ones) so perhaps they're running out of server farms I haven't yet blocked.
And most are from server farms, with just two or three from business ranges that are probably running open servers.
I still can't understand why they're only hitting one site out of several dozen, and only a single page. Seems very inefficient to me. But hey! let's root for inefficiency! :)