Spoofing as GoogleBot

[keyplyr]

217.160.230.*** - - [23/Oct/2006:00:29:26 -0400] "GET /page.html HTTP/1.0" 200 4903 "http://www.referrer.com" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

I'm not aware of this IP address being used by Google. Anyone?

[the_nerd]

looks like the whole class c network belongs to a hosting company in Germany.

the-nerd.

[jdMorgan]

Notwithstanding the odd-ball IP, that's still a pretty sure bet as a spoof, since Gbot doesn't typically include a referrer.

Jim

[keyplyr]

The referrer was actually the very web page that was being requested each time. I've seen this before, always with rather dubious circumstances. Only web pages were taken. Took about 2 dozen before I caught it and banned the IP address. He came back an hour later, got one 403 and went away. I'm guessing it was a private bot or downloading agent.

In my archived log files, I found a record of this IP address (except very last number in D class) exhibiting same behavior spoofing as AOL 6 months ago.