ua: Hello

Now this one is nasty

[FineWare]

Bunch of entries in yesterday's logs that contained the UA of just 'HELLO'. But that's not the bad part. It rapidly changed to a set of obviously spoofed IPs:
- ct (spoofed RDNS)
- 202.54.65.65 (*.vsnl.net.in - no resolve)
- 200.184.43.67 (200-184-43-67.redebrasil.tv.br)
- 212.116.183.34 (212.116.183.34.knet.co.il)
- 213.249.155.235 (*.kcom.com - no resolve)
- 193.251.68.36 (AAnnecy-101-2-1-36.w193-251.abo.wanadoo.fr)

Guess it's time to add another one to the list:
RewriteCond %{HTTP_USER_AGENT} ^HELLO$ [OR]

[wilderness]

Could it be appie?
http ://www.walhello.com/

[nuhkweb]

Hi,

First have a look if it's really downloading a file, meaning the file-size it's taking.

"Hello" can also be a small search- engine or directory that is just checcking if the link to you that they have in their directory is still up and valid.

and "Hello" can also be, a part of a reciprocal link program, if you have added your link somewhere, that checks if you are linking back to them.

As I think it is not possible for the same Bot/Spider to come from all the different IP's you have listed.

Greetings,

[FineWare]

You're right, assuming the IPs are not spoofed. But all within a minute?