ahem yourself :)
"1.0.0" just looks inherently suspicious, doesn't it? Especially if the string has never had any other value.
They must like your site better than mine, because raw logs can only offer up one lone visit.
175.157.112.abc - - [29/Jan/2015:10:04:53 -0800] "GET /ebooks/paston/images/titlepageVI.png HTTP/1.1" 403 1772 "-" "Dorado WAP-Browser/1.0.0/powerplay/2"
175.157.112.abc - - [29/Jan/2015:10:05:13 -0800] "GET /favicon.ico HTTP/1.1" 200 662 "-" "Dorado WAP-Browser/1.0.0/powerplay/2"
AND (different site)
175.157.112.abc - - [29/Jan/2015:10:05:07 -0800] "GET /piwik/piwik.php?idsite=3&rec=1 HTTP/1.1" 403 1584 "-" "Dorado WAP-Browser/1.0.0/powerplay/2"
(piwik lives on a different site, and that's the noscript version) Image files such as the originally requested .png don't invoke piwik-- but the 403 page does. Can't help but notice, however, that they did
not request the expected errorstyles.css.
Sri Lanka, of all places. It isn't a blocked range, so I have to guess there was something unacceptable in the headers. (I don't keep headers very long, so can't confirm.) Don't know what they were searching for, but I seriously doubt it was the title page of Volume VI of the Paston Letters. (If you put in some weird text and claim to be searching for images, then sure it might come up on the SERP-- this is a recurring problem with Old and Middle English content-- but why on earth would you actually go to the file, when you've already seen that it isn't what you're looking for?)
Looking closer, I notice also that it seems to have taken them an awfully long time to go from first request (10:04:53) to piwik (10:05:07, i.e. fourteen seconds later) to favicon (10:05:13, a further six seconds). That's not a dialup range, is it?
