Fake Google & Trident Bot from IPV6 ip

[MitchNginx]

Just picked these up in one of my logs this morning.

2600:3c00::f03c:91ff:fe1f:**** - - - [29/Mar/2018:09:39:39 +0200] "GET / HTTP/1.1" 302 154 "http://www.google.com/images/url" "Googlebot/2.1; +http://www.google.com/bot.html)" "-"PORT:80 0.000 - . "GZIP:-"
2600:3c00::f03c:91ff:fe1f:**** - - - [29/Mar/2018:09:39:42 +0200] "TRACE / HTTP/1.1" 405 568 "" "Mozilla/5.0 (compatible; MSIE 8.0; MSIE 9.0; Windows NT 6.0; Trident/4.0; InfoPath.1; SV1; .NET CLR 3.8.36217; WOW64; en-US)" "-"PORT:80 0.000 - . "GZIP:-"

- - -

[edited by: keyplyr at 8:02 am (utc) on Mar 29, 2018]
[edit reason] obscured IP address [/edit]

[keyplyr]

Yes, Googlebot is by far the most faked UA. I see it about 50 times every day across my sites.
If you use the Site Search (upper-right corner) you'll find a long list of reports of fake Googlebots.

Many times the perp will continue to try various UAs attempting to gain access.

[MitchNginx]

Thanks keyplyry+ I see it quite a lot too, first time I've noticed them starting to use IPV6 addresses now. I will make sure any future posts blank out the end of the IP, thanks for amending that.

[keyplyr]

Individual IPs should be obscured since many times they are people's ISP accounts or innocent company computers that have been compromised.

It's fine to post ranges.