Opal Telecom

[wilderness]

Just a heads up.

2.97.75.zzz - - [27/Jun/2012:21:32:29 +0100] "GET /MyFolder/MySub/MyPage.html HTTP/1.1" 403 - "http://www.google.co.uk/search?hl=en&client=safari&gl=uk&biw=320&bih=416&q=Valid+Keys_Searchd&oq=Valid+Keys_Searchd&gs_l=mobile-gws-serp.3..0i8i30.2112490.2130700.0.2131901.67.37.3.2.4.13.1492.11844.0j9j10j11j1j0j1j2.36.0...0.0.HAmiq04grqE&mvs=0" "Mozilla/5.0 (iPod; CPU iPhone OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3"

74.125.17.218 - - [27/Jun/2012:21:32:51 +0100] "GET /SameFoleder/SameSub/SamePage.html HTTP/1.1" 403 559 "http://www.google.com/m/search" "Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/536.8 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/536.8"
74.125.17.94 - - [27/Jun/2012:21:32:51 +0100] "GET /SameFoleder/SameSub/SamePage.html HTTP/1.1" 403 559 "http://www.google.com/m/search" "Mozilla/5.0 (Linux; U; Android 2.3.4; generic) AppleWebKit/536.8 (KHTML, like Gecko; Google Web Preview) Version/4.0 Mobile Safari/536.8"

62.24.252.zzz - - [27/Jun/2012:21:33:01 +0100] "GET /robots.txt HTTP/1.0" 200 2642 "MyRoot/robots.txt" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"
62.24.252.zzz - - [27/Jun/2012:21:33:01 +0100] "GET /SameFoleder/SameSub/SamePage.html HTTP/1.0" 403 559 "Page URL" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2)"

[lucy24]

:: detour to IP notes to confirm ::

Opal, yup, they've got something to do with TalkTalk which in turn runs a bunch of non-robots including Parental Controls and an anti-virus thingie. I generally see them from 62.24.

Looks like Google Preview is doing the same thing I've recently noticed in my own logs: If someone asks for a page that they haven't snooped into recently, something gets triggered and they scoop up a quick Preview. That's after the human visit, not before.

[dstiles]

I blocked the whole of google's 74.125/16 following the mocality scandal (search for it). And because I do not want web preview visits, of course.

62.24.128/17 - Opal - the range includes lots of bots, webmarketing and HuaweiSymantecSpider. The latter purports to be an anti-virus checker but since it never arrives before the punter has already read the page it's a bit stable-door-locking. One view of the spider is that it's building up advertising information on the opal/talktalk user.