If I knew what was going on here, I might know which forum to post this question in. This is from a few days ago.
The Cast:
74.125.et cetera (you know whoo)
190.56.nnn.nnn (an IP in Guatemala)
As far as I can tell, I've never had any other visit from this IP range-- or anywhere else in Guatemala.
The Crew, with spaces added by me:
UA: Mozilla/ 5.0 (Windows NT 5.1; rv:6.0) Gecko/ 20100101 Firefox/ 6.0, gzip(gfe) (via translate.google.com)
with one exception (below) Referer: ht
tp://translate.googleusercontent.com/translate_c ?hl=es &rurl=translate.google.com.gt &sl=es &tl=en &u=http://www.example.com/ebooks/{see below for exact files} &usg={long string of alphanumerics, presumably session ID, here}
Note this detail:
&sl=es &tl=en. I am very familiar with Google translations
from English
into Spanish, because the e-book "Perez the Mouse" is popular in Spanish-speaking countries. (The Spanish original is now available online-- I've got a link to it-- but the pictures aren't nearly as pretty. Both versions are probably public domain everywhere in the world.) But here we've got translations
from Spanish
into English. If they are real translations they are pretty impressive btw, apart from an inexplicable fondness for Title Case. I checked a few of the referer links.
I can't figure this out. The overall pattern-- in particular, the load time of images and the sequence of referers-- suggests a human, but is it a benign one or a not-nice one?
In what follows, I've substituted the e-book titles for the actual filenames.
Oh yes and... I've got hotlink blocking in place, substituting a garish image. The authorized exceptions do not happen to include any variant of "google", and there is no allowance for referers that put my domain in the query string.
Mainly because it never before occurred to me. Google: 17:24:44 Perez the Mouse ("Perez")
Guatemala: 17:24:45 all 36 images; referer Perez1 (that is, the first of three sessionIDs used to retrieve images for this title)
Google: 17:25:51 Three Blind Mice ("BlindMice"); referer Perez1
Guatemala: 17:25:52 all 56 images; referer BlindMice
Guatemala: 17:26:36 all 36 Perez images again; referer Perez2 (that is, a fresh sessionID)
Guatemala: 17:27:31 31 Perez images, excluding five of the larger ones
Two things are different about this attempt: there is no referer (thereby getting past the no-hotlinks rule, though the user doesn't seem to have realized that this was the variable),
and for this batch of images only, they tried a different browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; BTRS122176; InfoPath.2; MSOffice 12)
Google: 17:28:22 The Mouse and the Christmas Cake ("Christmas"); referer Perez1
Google: 17:28:23 The Mouse and the Christmas Cake; referer Perez1
Guatemala: 17:28:23 all 5 images; referer Christmas
The user must really dislike MSIE. After that one 31-image sweep, they went right back to Firefox and stayed there.
Google: 17:29:03 Perez the Mouse; no referer
Guatemala: 17:29:03 all 36 images; referer Perez2
Google: 17:29:30 The Mouse and the Christmas Cake; referer Perez1
Google: 17:29:30 The Mouse and the Christmas Cake; referer Perez1
I don't know what g### was doing here. It's the only pickup that didn't come with a corresponding human download of all images.
Google: 17:29:50 Nine Lives of a Cat ("NineLives"); referer Christmas
Google: 17:29:50 Nine Lives of a Cat; referer Christmas
Google: 17:29:51 Nine Lives of a Cat; referer Christmas
Guatemala: 17:29:51 all 53 images; referer NineLives
Guatemala: 17:29:58 31 Perez images, again excluding five of the larger ones, but not the same five as above; referer Perez2
Google: 17:32:12 Frederick Hale ("Hale"); referer Perez3
Guatemala: 17:32:13 all 3 images; referer Hale
I would love to know why they included this title, skipping a couple of picture books. I mean, it's awfully funny, but more in an "I guess you had to be there" way.
Google: 17:32:25 Grandmother Puss ("Grandmother"); referer Hale
Google: 17:32:25 Grandmother Puss; referer Hale
Guatemala: 17:32:26 all 5 images; referer Grandmother
And then they packed up and went away. We don't seem to have a "what the ###?" emoticon.
