Found this mucking around, it is one I haven't seen before and can't find any info here for the UA: 220.127.116.11 - - [21/Jan/2013:17:26:57 -0600] "GET /products/ HTTP/1.1" 200 27445 "http://www.example.com/?s=blue%20widget" "ZTE-Z431/1.4.0 NetFront/4.2 QTV5.1 Profile/MIDP-2.1 Configuration/CLDC-1.1"
The search almost makes it look human, but the files requested had nothing to do with the query and the refering directory only URL does not exist. 32 files in under 2 minutes. ARIN gives me: 18.104.22.168 - 22.214.171.124 126.96.36.199/9 Service Provider Corporation
That's odd. I looked up that range just the other day for some reason that now escapes me. I'd got them labeled as Cingular Mobile, with assorted sublets. This is probably backward, though.
Incidentally, I know we are Not Supposed To Do This, but if you google "Wireless Data Service Provider Corporation" the SERP text in the first hit --first for me anyway-- is pretty hilarious. I believe the operative word is "cloaking" :)