someone spoofing?

these are some wierd UAs

[wkitty42]

has anyone seen anything like these?

85.255.117.xyz [17/Mar/2007:23:18:20 -0400] "# UA \"Googlebot/Test (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:29:52 -0400] "# Google"
85.255.117.xyz [17/Mar/2007:23:29:53 -0400] "# UA \"Googlebot-Image/1.0\""
85.255.117.xyz [17/Mar/2007:23:29:57 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:23 -0400] "# UA \"Mediapartners-Google/2.1\""
85.255.117.xyz [17/Mar/2007:23:30:28 -0400] "# UA \"Googlebot/2.1 (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:30 -0400] "# Google"
85.255.117.xyz [17/Mar/2007:23:30:30 -0400] "# UA \"Googlebot/Test (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:31 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:32 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:50 -0400] "# UA \"Googlebot/2.1 (+http://www.googlebot.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:51 -0400] "# UA \"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\""
85.255.117.xyz [17/Mar/2007:23:30:53 -0400] "# UA \"Mediapartners-Google/2.1\""

yeah, they're not the full log line... just the IP, time/date and the UA... the thing that triggered my alarms was the timestamps and the quick UA changes... i seem to remember something similar several years back when i used to frequent these forums...

oh yeah, hello to all those who may remember me ;)

[volatilegx]

Yes, a spoofer. I've seen this guy before.

[wilderness]

six UA changes DEMANDS denial ;)

[incrediBILL]

That IP is for Inhoster hosting company and there's a LOT of problems there, you're just looking and the tip of that iceberg. Look up all their ranges and ban them and then watch how much junk shows up in your logs that's being bounced.

Most likely you will be nothing short of amazed.

[edited by: incrediBILL at 10:56 pm (utc) on April 8, 2007]

[yodokame]

That IP is for Inhoster hosting company

Is a list or source of hosting companies available somewhere? For our web site there would never be any need for anyone to access it other than a human sitting at his computer, so I'd like to just ban all these guys. (Or is that a bad idea ...?)