Is there a recent thread that sheds light on this entity?
66.249.92.181 - - [04/Jun/2014:04:31:29 -0700] "GET /fonts/images/keyboardrats.png HTTP/1.1" 200 6789 "-" "Mozilla"
66.249.92.181 - - [04/Jun/2014:07:01:48 -0700] "GET /hovercraft/hansard/images/hansard.png HTTP/1.1" 200 5219 "-" "Mozilla"
66.249.92.168 - - [04/Jun/2014:07:03:39 -0700] "GET /hovercraft/words/aktarit.jpg HTTP/1.1" 200 32786 "-" "Mozilla"
They showed up in late May, but I didn't notice until they requested 30 images-- it's always images-- on a single day. On my site, that counts as jumping up & down waving your arms for attention. (My log processing flags multiple image requests without referer, mainly to filter out human browsers that don't send a referer header. Like, ahem, a lot of WebmasterWorld readers.)
My first thought was to block anything from 66.249.80.0/20 that didn't have "Google" in the UA string. The range includes legitimate agents like site verification, translate and wireless transcoder-- for me these tend to be real humans rather than scrapers-- so I can't block it outright. And then I found an Android from the same range, so who knows what's up.
The part that makes me a little uneasy is that I'd really like to know how they learn about the specific images they're requesting. There doesn't seem to be any pattern to them. They seem to be especially interested in the Paston letters (public domain) but other than that it's completely arbitrary.
