Fake Google & Trident Bot from IPV6 ip

Forum Moderators: open

Message Too Old, No Replies

Fake Google & Trident Bot from IPV6 ip

MitchNginx

7:46 am on Mar 29, 2018 (gmt 0)

Just picked these up in one of my logs this morning.

2600:3c00::f03c:91ff:fe1f:**** - - - [29/Mar/2018:09:39:39 +0200] "GET / HTTP/1.1" 302 154 "http://www.google.com/images/url" "Googlebot/2.1; +http://www.google.com/bot.html)" "-"PORT:80 0.000 - . "GZIP:-"
2600:3c00::f03c:91ff:fe1f:**** - - - [29/Mar/2018:09:39:42 +0200] "TRACE / HTTP/1.1" 405 568 "" "Mozilla/5.0 (compatible; MSIE 8.0; MSIE 9.0; Windows NT 6.0; Trident/4.0; InfoPath.1; SV1; .NET CLR 3.8.36217; WOW64; en-US)" "-"PORT:80 0.000 - . "GZIP:-"

- - -

[edited by: keyplyr at 8:02 am (utc) on Mar 29, 2018]
[edit reason] obscured IP address [/edit]

keyplyr

7:53 am on Mar 29, 2018 (gmt 0)

Yes, Googlebot is by far the most faked UA. I see it about 50 times every day across my sites.
If you use the Site Search (upper-right corner) you'll find a long list of reports of fake Googlebots.

Many times the perp will continue to try various UAs attempting to gain access.

MitchNginx

8:11 am on Mar 29, 2018 (gmt 0)

Thanks keyplyry+ I see it quite a lot too, first time I've noticed them starting to use IPV6 addresses now. I will make sure any future posts blank out the end of the IP, thanks for amending that.

keyplyr

8:17 am on Mar 29, 2018 (gmt 0)

Individual IPs should be obscured since many times they are people's ISP accounts or innocent company computers that have been compromised.

It's fine to post ranges.