IP Address Inspector

I.Ellis commented...

See excerpt below from reports for 91.207.4.74
Also applies to 91.207.7.22

------------------------
I.Ellis commented...
Whatd'yaknow. Clued in by previous poster, I searched today's log for 91.207.*

Sure 'nuf...

91.207.7.222 - "GET / HTTP/1.0" 403 - "http://forum.mydomain.com... (twice, 1 sec apart)

and ditto yesterday from
91.207.5.206
May 09 2012 11:46 AM | Delete
I.Ellis commented...
Ditto.
Seen as
91.207.4.74 - - [09/May/2012:13:54:46 -0400] "HEAD /admin/spaw/spacer.gif

What is notable is that the request came direct, so it must have used my site's IP number. (DNS lookup site name requests come through Cloudflare proxy, which normally would have blocked it because it is identified bad in PH.)
May 09 2012 11:40 AM | Delete
H.User924 commented...
The range 91.207.4.0 - 91.207.9.255 must be controlled by a criminal gang since they are using these IP's ALL the time to probe many,many domains. I control thousands of domains and I see this range all the time. Below is one example of what they are seeking;
91.207.4.74 admin/spaw/spacer.gif Mozilla/5.0 (Windows; U; MSIE 9.0;
May 08 2012 01:53 PM
May 10 2012 04:37 AM