FTAgent

Anyone seen this one?

[mvl22]

User-Agent string is FTAgent
From 61.52.74.49

Just generated several 404s within too short a time frame for a human.

It basically took the file/directory names from one site but the domain name from a different virtualHost. Neither site is the default virtualHost or real IP address, so it's not that it doesn't understand HTTP1.1. I suspect it's having issues with server-side redirection.

I'm going to ban it unless someone can point to it having a legitimate status.

[wilderness]

mvl22,
Unless far east traffic is beneficial to your site?
Consider denying the entire IP range.
61.52.0.0 - 61.54.255.255

To even take it further?
You might consider denying the ENTIRE 61. block with the EXCEPTION of the following ranges;
61.8.0.0 - 61.8.31.255

[mvl22]

I must admit to being very wary of banning IPs, as I feel that's just overkill - effectively saying that everyone in that range is using spambots and the like.

It's an educational site, so will attract some traffic from the far east.

In any case, there are 22 sites on the server and I try to use a global anti-spam config, which wouldn't be possible if I went along the IP-banning route.