mfibot/1.1

[w3bmastine]

UA: mfibot/1.1 (http://www.mfisoft.ru/analyst/; [[e-mail]]; en-RU)
Protocol: HTTP/1.1
Robots.txt: No
Host: ?
188.42.240.119

188.42.240.119 - - [03/Feb/2016:03:20:57 +0100] "GET / HTTP/1.1" 200 1707 "-" "mfibot/1.1 (http://www.mfisoft.ru/analyst/; [[e-mail]]; en-RU)" "example.com"

They claim to scan to provide information security products.

[keyplyr]

Host: ServerClub
188.42.240.0 - 188.42.247.255
188.42.240.0/21

I've had this range blocked for about 4 years. ServerClub is in Fort Lauderdale, FL, USA however the company is registered in Luxembourg.

[keyplyr]

Now coming from a DSL range on Rostelecom, RU
213.177.107.32 - 213.177.107.255

[lucy24]

Now coming from a DSL range

Infected machine, or the company's going belly-up and is reduced to botrunning off the owner's home IP?

[keyplyr]

sneaky

[keyplyr]

Still coming from that IP address within the RU DSL range.