Blocking the Java UA

Some kind of scumbot (?) requesting non-existent pages

[MatthewHSE]

I've got some kind of bot requesting a bunch of non-existent pages on my site. From the file names they're looking for, my guess is that they're either looking for content to scrape and steal, or (more likely) looking for particular software installations to try to exploit known vulnerabilities.

Obviously I'd like to block this type of request, but I'm having trouble doing it. They're using a lot of slightly-different UA's, such as the following:

Java/1.5.0_01

The "Java/" part is the same for all of them, but the numbers change frequently. My problem is how to block all such user agents, but NOT block any legitimate traffic that may be using the word "java" in the UA string (I've heard there are some like that).

Essentially I'm lost. What can I add to my .htaccess file to make sure this scumbot, or whatever it is, just doesn't get access to my site anymore?

Thanks,

Matthew

[encyclo]

It could be difficult. For the problematic bot, would it be possible to ban it by IP address instead?

[MatthewHSE]

No, it uses all different IP's. It strikes about two or three times per week, always using a different IP address and often a slightly different version number in the UA string.

[jdMorgan]

I've blocked Java and Python by user-agent using this:

# Block Java and Python URLlib except from Google and Yahoo Python
RewriteCond %{HTTP_USER_AGENT} ^(Python[-.]?urllib¦Java/?[1-9]\.[0-9]) [NC]
RewriteCond %{REMOTE_ADDR}!^207\.126\.2(2[4-9]¦3[0-9])\.
RewriteCond %{REMOTE_ADDR}!^216\.239\.(3[2-9]¦[45][0-9]¦6[0-3])\.
RewriteRule .* - [F]

The IP address exceptions allow me to use the Google and Yahoo tools that rely on Java and Python.

I have never seen a "legitimate" Java user-agent since doing so.

Jim