AwarioSmartBot/1.0

[tangor]

UA: AwarioSmartBot/1.0 (+https://awario.com/bots.html; [e-mail])
Robots.txt: NO
IP: 136.243.70.nnn
ISP: Hetzner

Inner page, multiple times, no image, css

Outta here!

[tangor]

Oh, meant to add their web presence admits they are a spy bot and lead collector for social media. :)

[lucy24]

Oh yes indeed. (But why do I even recognize the name? Logs say they’re always blocked.) Isolated visit in February, and then more frequent from June on. Total of 23 requests, asking for the same six deep-interior* pages over and over again, sometimes as many as four in a row. That does point to following-up leads from some outside source or sources.

Edit after deeper delving into archived logs:

136.243.70.abc - - [01/Dec/2019:09:01:53 -0800] "GET /robots.txt HTTP/1.1" 200 3318 "-" "AwarioSmartBot/1.0 (+https://awario.com/bots.html; [e-mail])"

Active from mid-November through early December 2019, frequent enough that there’s a Disallow in robots.txt. A final quirk revealed by logged headers is that robots.txt was always requested HTTP, while pages are always requested HTTPS. Wonder why they decided to stop asking?


* Where “interior” = /blahblah while “deep interior” = /directory/blahblah.

[tangor]

Well, a new wrinkle, some five days after they first hit me:

Email sent to me that opens:

YAAAS, you’re in!

Welcome to the Awario fam! Your free trial starts today.

We've automatically generated a password for you; you can change it anytime under Account Settings.

[tangor]

Needless to say the deny will be further hardened!

[lucy24]

We've automatically generated a password for you; you can change it anytime under Account Settings.

Poor Awario! The credit they accrued by using a semicolon instead of the customary comma splice ... is lost a few words later when they said “anytime” (adverbial phrase, not adjective) as a single word.