Over the span of a couple of hours, three sites were swept by a flurry of page-only requests. All different IPs, all different UAs--except that the entire thing, whatever it happened to be, was lower-case: chrome, firefox, ios and so on. As it happens, one of the three sites has a handful of elderly pages in CamelCase, which were correctly requested. So the mis-casing is limited to the Name Your Robot script, for which I devoutly hope they paid through the nose.

On the two smaller sites they got all pages; on my “real” site they apparently got tired after a few dozen--although they did come back the next day to request robots.txt twice.

Looking back over logs and headers, I find a scattered handful of lower-case requests, rarely more than one a day, all blocked due to a simple header deficit.

The latest addition to my shared htaccess is thus

BrowserMatch ^mozilla bad_agent=lowercase

So if they come back to my main site to try to steal the rest of the horses, they will be SOL. Good sturdy padlock.

Like I said: What will they think of next?