RBot

[w3bmastine]

Maybe related to this one:
[webmasterworld.com...]

UA: [rbot.info...]
Protocol: HTTP/1.1
Robots.txt: No
Host: urktel (Ukraine Telecom)
95.133.238.31

95.133.238.31 - - [12/Feb/2016:09:54:00 +0100] "GET / HTTP/1.1" 200 1166 "http://rbot.info/link/dritykifudojoly" "Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.16" "example.com"
95.133.238.31 - - [12/Feb/2016:09:54:00 +0100] "GET / HTTP/1.1" 200 1166 "http://rbot.info/link/dritykifudojofo" "Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.16" "example.com"

[lucy24]

Host: urktel (Ukraine Telecom)

Does that mean an infected machine on a human ISP?

Just the other day I met a legitimate site from the .info tld, darn it. Guess they do exist, though probably only because dot com was taken. (Quick detour to htaccess assures me that, nope, I don't block .info categorically as I do .su, .mobi and a handful of others.)

Does "example.com" mean they were inserting your own domain name as UA, or was it more referer spam?

[keyplyr]

I don't block .info categorically as I do .su, .mobi and a handful of others.

If you sold ad space or used any of the ad networks you probably wouldn't block any TLDs, since they would be your customers. Some marketing interests balance their campaigns over several TLD variations for higher saturation.

[lucy24]

Do you really get legitimate referers from .su?!

I block .ru and .ua but make an exception for known search engines. And presumably your ads would come from known entities, so you'd exempt them too.

[keyplyr]

I do get a good amount of valid human traffic from .ru &.ua, in particular a few forums that like my articles and post links. The click-through traffic often includes the referrer.

I deal with malicious traffic in other ways. I don't block TLDs. That's setting yourself up for the baby in the bathwater scenario IMO.

Hassel enough that I need to block IP ranges. A lot of work goes to making constant exceptions in that schema.

[lucy24]

Oh, oops, I think I may have said something other than what I meant. I certainly don't block visitors from Russia and Ukraine. (Besides, would't blocking .ru and the like mean throwing your whole server into lookups mode? Bleahh.) In fact I've been gritting my teeth and just trying to ignore the infected-machine robots, because they're generally here today and gone tomorrow. Still haven't quite figured out if yandex is doing some kind of caching or what, because there are definitely some weirdnesses in request patterns.

I meant that I block referers in .su and select others categorically, and non-search-engine .ua and .ru. They're just robots doing referer spam. (Humans I'd notice.)

At this point do there even exist legitimate .su sites? Time-warped Russians? Same for .mobi: I think it's one of those "it seemed like a good idea at the time" tld's.

[keyplyr]

...do there even exist legitimate .su sites? ...Same for .mobi

I may have never seen .su in my logs, but I *think* I've been to web sites using it (likely when researching corp info.)

I do see .mobi occasionally. AFAIK that was the first wave accommodation for mobile friendly prior to the responsive platform. I think those who spent $5k on a mobile site redo to some SEO sales team back then probably wound not throw it away after establishing traffic.

[w3bmastine]

Does "example.com" mean they were inserting your own domain name as UA, or was it more referer spam?

This col of the log just lists the domain name the current log is for. As I do not want to name the actual domain name, that's example.com.

[keyplyr]

col of the log

Jack London?

[lucy24]

the domain name the current log is for.

Oh, oops, I was reading too fast. Now I see there's an extra category. Whew.

Jack London?

I was thinking Wade Hemsworth.