Iptcbot

[JAB Creations]

User Agent: Mozilla/5.0 (compatible; IPTCBOT;
IP Address: 82.165.37.69
Host: 1.onlinehome-server.info

This bot first arrived at my site on Fri Aug 5th, 2011 at 09:04PM. It is sending referrers most of which look spammy though the last few link to valerie-bistro.de/robot.html?=example.com (my domain instead).

Doing a search for "IPTCBOT" (without quotes) a Twitter account comes up with the following description...

Unofficial bot that publishes things that might be about the IPTC, by @smyles

That account doesn't seem related to the main page linked in the referrer. It's been rejected by my site and will continue to however I am curious if anyone could find something a bit more solid on this?

- John

[Staffa]

If have seen it a few times but I have no better idea of what it's about than you do.
They seem to have changed their UA lately. Sunday it dropped by in the same way you described with my site name as example.com, before that they used :

Mozilla/5.0 (compatible; IPTCBOT; SessionID=; favoriteColor= http://example.blogspot.com//

where the URL part varied and, I guess because of how the UA is formatted, the URL showed as the referrer.

[Pfui]

Confirming the OP's Host/IP and bot, on Aug. 8th:

s15525901.onlinehome-server.info
Mozilla/5.0 (compatible; IPTCBOT;

robots.txt? NO
Fake REF? Yes

IP = 82.165.37.69 [projecthoneypot.org...]

The IP is block-worthy given the constellation of UAs indicated in that PHP data:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB6; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)
Mozilla/5.0 (compatible; IPTCBOT;
Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10)

In addition, here's another, 'newer' variation of the OP's UA from the exact same IP, on Oct. 5th. Note that IPTCBOT is now robot.html:

s15525901.onlinehome-server.info
Mozilla/5.0 (compatible; robot.html;

robots.txt? NO
Fake REF? Yes

FWIW: onlinehome-server.info [robtex.com...] has been a source of trouble for a long time. [google.com...]

[Staffa]

onlinehome-server.info is hosted on :
inetnum: 212.227.134.0 - 212.227.143.255
netname: SCHLUND-CUSTOMERS
descr: 1&1 Internet AG
country: DE

82.165.37.69 is hosted on :
inetnum: 82.165.32.0 - 82.165.47.255
netname: SCHLUND-CUSTOMERS
descr: 1&1 Internet AG
country: DE

SCHLUND has been host to many unsavouries for many years. Usually, when I see a bot come from there (with whatever UA) its range gets blocked. The whole is pretty much the same environment as the likes of SoftLayer, etc.

[dstiles]

The whole 1&1 / Schlund server network is blockworthy out of hand.