:: obligatory run to raw logs ::

Oh, there it is, across all sites, always sets of three requests for root in rapid succession, all to http, all with a lovely 403 and/or 429. Out of sight, out of mind.

:: further run to logged headers ::

Four distinct header anomalies, hurrah, including bad_range. (I sometimes use this instead of “Require ip” to allow for legitimate robots using Usual Suspects ranges.) All requests, regardless of site, are to example.com without leading www.