THE RUSSIAN/KAZAKH CASE --  SOLVED?
by
Ed Lake
www.anthraxinvestigation.com

A work in Progress
Page created: Jan. 5, 2012
Last update:  Feb. 22, 2012 - another change in IP addresses.
-------------------------

This is information about strange, unexplained "attacks" upon my web
site.  The IP addresses in the log entries indicate the hits come 
from several different countries (Russia, Ukraine, Belarus, 
Kazakhstan, Mexico), but most seem to have .ru referral web site 
addresses in the log entries.  A few have .ua suffixes, which is 
the Ukraine suffix. 

To illustrate the problem, here is a small section of my web site 
log for January 2, 2012, from 6:22 AM to 6:54 AM, showing what an 
"attack" looks like.  The "attack" entries are the groups of ten 
HEAD accesses that use IP address 94.190.9.193:

----------------------------------------------------

111.93.130.33 - - [02/Jan/2012:06:22:15 -0500] "GET /paper.gif HTTP/1.1" 200 1400 "http://www.anthraxinvestigation.com/hoaxes.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"
65.52.104.20 - - [02/Jan/2012:06:25:49 -0500] "GET /robots.txt HTTP/1.1" 200 383 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
65.52.104.20 - - [02/Jan/2012:06:26:27 -0500] "GET /Hatfill85-1.pdf HTTP/1.1" 403 615 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
94.190.9.193 - - [02/Jan/2012:06:30:24 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:25 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:26 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:30 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:33 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
184.22.197.48 - - [02/Jan/2012:06:32:17 -0500] "GET / HTTP/1.0" 200 235587 "http://www.anthraxinvestigation.com" "Opera/9.64(Windows NT 5.1; U; en) Presto/2.1.1"
66.249.71.181 - - [02/Jan/2012:06:33:34 -0500] "GET /GS-thoughts.html HTTP/1.1" 304 210 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
184.82.188.111 - - [02/Jan/2012:06:34:21 -0500] "GET / HTTP/1.0" 200 235587 "http://georgiaoes.org/distress/profile.php?mode=viewprofile&u=2955" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3"
199.87.250.225 - - [02/Jan/2012:06:35:51 -0500] "GET /robots.txt HTTP/1.1" 200 369 "-" "Mozilla/5.0 (compatible; ScoutJet; +http://www.scoutjet.com/)"
199.87.250.225 - - [02/Jan/2012:06:35:51 -0500] "GET / HTTP/1.1" 200 57835 "-" "Mozilla/5.0 (compatible; ScoutJet; +http://www.scoutjet.com/)"
46.73.43.186 - - [02/Jan/2012:06:36:35 -0500] "GET /Coded-Message.html HTTP/1.0" 200 36300 "http://yandex.ru/yandsearch?text=media-letter" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
220.181.108.141 - - [02/Jan/2012:06:36:39 -0500] "HEAD /B3DayEveHrsAug2001sml.jpg HTTP/1.1" 200 246 "-" "Baiduspider-image+(+http://www.baidu.com/search/spider.htm)"
213.186.127.3 - - [02/Jan/2012:06:39:48 -0500] "GET /writing1.html HTTP/1.1" 200 13890 "-" "Mozilla/5.0 (compatible; AhrefsBot/2.0; +http://ahrefs.com/robot/)"
208.115.113.85 - - [02/Jan/2012:06:39:50 -0500] "GET /misc/anthrax/0301101ivins1.html HTTP/1.1" 403 575 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot@gmail.com)"
208.115.113.85 - - [02/Jan/2012:06:40:23 -0500] "GET /wp-30613.html HTTP/1.1" 403 557 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot@gmail.com)"
208.115.113.85 - - [02/Jan/2012:06:42:23 -0500] "GET /misc16.html HTTP/1.1" 200 385922 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot@gmail.com)"
95.211.74.105 - - [02/Jan/2012:06:43:08 -0500] "GET /Chap-05.jpg HTTP/1.1" 200 366031 "-" "Mozilla/4.0 (compatible;  MSIE 7.0; Windows NT 5.2; .NET CLR 2.0;)"
208.115.111.69 - - [02/Jan/2012:06:48:23 -0500] "GET /wp-30914.html HTTP/1.1" 403 561 "-" "Mozilla/5.0 (compatible; Ezooms/1.0; ezooms.bot@gmail.com)"
220.181.94.233 - - [02/Jan/2012:06:48:37 -0500] "GET /nyt2.html HTTP/1.1" 304 174 "-" "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)"
94.190.9.193 - - [02/Jan/2012:06:50:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:00 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:03 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:04 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:07 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:51:09 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.105.253.231 - - [02/Jan/2012:06:52:48 -0500] "GET /misc2.html HTTP/1.1" 200 783912 "http://www.google.com/search?q=Published+News+Upcoming+News+Submit+a+New+Story+Groups+canadian+government+saskatchewan+small+business+grants&hl=en&prmd=imvns&ei=jJoBT9nHD9Gq-Aas35XoAQ&start=140&sa=N" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.5) Gecko/20091109 Ubuntu/9.10 (karmic) Firefox/3.5.5"
96.2.82.137 - - [02/Jan/2012:06:54:09 -0500] "GET /robots.txt HTTP/1.0" 200 346 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.1; http://www.majestic12.co.uk/bot.php?+)"
96.2.82.137 - - [02/Jan/2012:06:54:10 -0500] "GET / HTTP/1.1" 200 235568 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.1; http://www.majestic12.co.uk/bot.php?+)"
217.84.245.147 - - [02/Jan/2012:06:54:30 -0500] "GET /SporeInteraction.html HTTP/1.1" 200 14796 "http://www.google.de/imgres?imgurl=http://www.anthraxinvestigation.com/PS-image-18.gif&imgrefurl=http://www.anthraxinvestigation.com/SporeInteraction.html&usg=__oOTWs-r434qiM2GVJaetxFwYyE0=&h=703&w=400&sz=7&hl=de&start=27&zoom=1&tbnid=gku7rZ3p4gRHCM:&tbnh=173&tbnw=97&ei=PJoBT5jBM8LGtAbwipXRDA&prev=/search%3Fq%3Dtriboelectric%2Bseries%26um%3D1%26hl%3Dde%26sa%3DN%26biw%3D1314%26bih%3D884%26tbm%3Disch&um=1&itbs=1&iact=rc&dur=0&sig=103494703813485788534&page=2&ndsp=25&ved=1t:429,r:13,s:27&tx=54&ty=109" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; MS-RTC LM 8; InfoPath.1)"
217.84.245.147 - - [02/Jan/2012:06:54:31 -0500] "GET /PS-image-05a.gif HTTP/1.1" 200 6876 "http://www.anthraxinvestigation.com/SporeInteraction.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; MS-RTC LM 8; InfoPath.1)"
217.84.245.147 - - [02/Jan/2012:06:54:31 -0500] "GET /lactose1.gif HTTP/1.1" 200 25229 "http://www.anthraxinvestigation.com/SporeInteraction.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; MS-RTC LM 8; InfoPath.1)"
217.84.245.147 - - [02/Jan/2012:06:54:31 -0500] "GET /PS-image-11.gif HTTP/1.1" 200 5454 "http://www.anthraxinvestigation.com/SporeInteraction.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; MS-RTC LM 8; InfoPath.1)"
217.84.245.147 - - [02/Jan/2012:06:54:32 -0500] "GET /PS-image-17.gif HTTP/1.1" 200 1899 "http://www.anthraxinvestigation.com/SporeInteraction.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; MS-RTC LM 8; InfoPath.1)"

----------------------------------------------------

Note that included in this section of my web site log
there is a legitimate HEAD access from the Baiduspider
search engine at 06:36:39.  It's just one access.

HEAD accesses are generally used to test to see if changes have
been made since the last time the web site was visited.  The HEAD
access looks at the first 10 lines of code from the file being 
accessed, which is usually where the date information is located.

There doesn't appear to be any valid reason for anyone to 
perform 10 HEAD accesses on my site, about 1 second apart.
But, it's been going on for a long time - possibly years.
And, when he sees that it's okay to do it (when he gets the
200 return code) he starts doing it every 10, 20 or 30 minutes
all day long.  That uses a lot of bandwidth, it screws up my 
web site statistics, and there appears to be no legitimate 
reason for it.

On my web site, I first wrote about these "attacks" on November 
18, 2010, after a massive attack on November 17, 2010.  Below is 
a tiny section from my web site log for that day.  Note that
there was a single HEAD access from "Xenu Link Sleuth" just prior 
to the first group of 10 HEAD accessess from 95.189.6.161, and 
there was another single HEAD access from 92.126.17.46 about 1 
minute before another set of 10 HEAD accesses from 95.189.6.161.
Also note that this piece of my web site log represents just 23 
minutes:

----------------------------------------------------------------

75.220.88.191 - - [17/Nov/2010:01:51:42 -0500] "GET /favicon.ico HTTP/1.1" 200 1003 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 AskTbFW-ASK/3.9.1.14019 Firefox/3.6.12 ( .NET CLR 3.5.30729)"
75.220.88.191 - - [17/Nov/2010:01:51:41 -0500] "GET /IvinsOTs.jpg HTTP/1.1" 200 20440 "http://www.anthraxinvestigation.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 AskTbFW-ASK/3.9.1.14019 Firefox/3.6.12 ( .NET CLR 3.5.30729)"
75.220.88.191 - - [17/Nov/2010:01:51:45 -0500] "GET /favicon.ico HTTP/1.1" 200 1003 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 AskTbFW-ASK/3.9.1.14019 Firefox/3.6.12 ( .NET CLR 3.5.30729)"
24.68.248.254 - - [17/Nov/2010:01:54:28 -0500] "HEAD / HTTP/1.1" 200 262 "-" "Xenu Link Sleuth/1.3.9 beta"
95.189.6.161 - - [17/Nov/2010:01:54:47 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:48 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:49 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:50 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:51 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:52 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:53 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:54 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:55 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:56 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
207.46.204.192 - - [17/Nov/2010:01:55:17 -0500] "GET /WritingFacts.html HTTP/1.1" 200 9611 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
67.195.112.153 - - [17/Nov/2010:01:59:15 -0500] "GET /Hatfill141.pdf HTTP/1.0" 200 3742 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"
207.46.12.241 - - [17/Nov/2010:01:59:18 -0500] "GET /return.html HTTP/1.1" 304 210 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
66.249.71.149 - - [17/Nov/2010:01:59:43 -0500] "GET /HoltLetter2.pdf HTTP/1.1" 200 128431 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
208.115.111.246 - - [17/Nov/2010:02:00:31 -0500] "GET /Update-History2009-Pt-2.html HTTP/1.1" 200 115501 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:00:35 -0500] "GET /fas-01.html HTTP/1.1" 200 6962 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:00:40 -0500] "GET /wp011111.html HTTP/1.1" 403 557 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:00:46 -0500] "GET /wp021027.html HTTP/1.1" 403 557 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:00:51 -0500] "GET /Florida.html HTTP/1.1" 200 15519 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:00:56 -0500] "GET /USNews.html HTTP/1.1" 200 12984 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
208.115.111.246 - - [17/Nov/2010:02:01:01 -0500] "GET /timing/ HTTP/1.1" 403 555 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
220.181.108.104 - - [17/Nov/2010:02:01:01 -0500] "GET /index.html HTTP/1.1" 200 86625 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
208.115.111.246 - - [17/Nov/2010:02:01:06 -0500] "GET /wp011111.html HTTP/1.1" 403 561 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)"
220.181.108.121 - - [17/Nov/2010:02:01:06 -0500] "GET / HTTP/1.1" 200 56156 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
70.181.157.242 - - [17/Nov/2010:02:01:58 -0500] "GET /FrontCvr.jpg HTTP/1.1" 200 7662 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C)"
70.181.157.242 - - [17/Nov/2010:02:01:58 -0500] "GET / HTTP/1.1" 200 56193 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C)"
70.181.157.242 - - [17/Nov/2010:02:01:58 -0500] "GET /IvinsOTs.jpg HTTP/1.1" 200 30614 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C)"
70.181.157.242 - - [17/Nov/2010:02:01:59 -0500] "GET /favicon.ico HTTP/1.1" 200 1002 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB6; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C)"
70.181.157.242 - - [17/Nov/2010:02:02:00 -0500] "GET /favicon.ico HTTP/1.1" 200 1003 "-" "Mozilla/5.0 (compatible; Google Desktop/5.9.1005.12335; http://desktop.google.com/)"
92.126.17.46 - - [17/Nov/2010:02:02:21 -0500] "HEAD / HTTP/1.1" 206 382 "http://voprosit.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:16 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:17 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:18 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:19 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:21 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:22 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:23 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:24 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:25 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
67.195.112.153 - - [17/Nov/2010:02:03:35 -0500] "GET /nyt1a.html HTTP/1.0" 200 51775 "-" "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)"
220.181.108.112 - - [17/Nov/2010:02:04:46 -0500] "GET / HTTP/1.1" 304 174 "-" "Baiduspider+(+http://www.baidu.com/search/spider.htm)"
93.174.93.148 - - [17/Nov/2010:02:06:04 -0500] "GET /nypost.html HTTP/1.1" 200 111146 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
93.174.93.148 - - [17/Nov/2010:02:06:05 -0500] "GET /index.html HTTP/1.1" 200 306448 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
88.131.106.3 - - [17/Nov/2010:02:11:15 -0500] "GET /robots.txt HTTP/1.0" 200 369 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) Speedy Spider (http://www.entireweb.com/about/search_tech/speedy_spider/)"
88.131.106.5 - - [17/Nov/2010:02:11:18 -0500] "GET / HTTP/1.0" 200 56156 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) Speedy Spider (http://www.entireweb.com/about/search_tech/speedy_spider/)"
95.189.6.161 - - [17/Nov/2010:02:11:38 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:39 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:40 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:41 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:42 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:43 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:44 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:45 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:47 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:48 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
207.46.12.241 - - [17/Nov/2010:02:13:18 -0500] "GET /return.html HTTP/1.1" 304 210 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"
66.249.71.87 - - [17/Nov/2010:02:13:43 -0500] "GET /robots.txt HTTP/1.1" 200 406 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.71.87 - - [17/Nov/2010:02:13:43 -0500] "GET /nyt.html HTTP/1.1" 200 127708 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
212.117.180.221 - - [17/Nov/2010:02:14:02 -0500] "GET /Update-History2008.html HTTP/1.0" 200 853977 "http://www.anthraxinvestigation.com/Update-History2008.html" "Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.9.0.2) Gecko/2008092313 Ubuntu/9.25 (jaunty) Firefox/3.8"

---------------------------------------------------------------

I keep blocking the IP addresses.  But, when I do that, the 
person causing the problem then switches to a different IP 
address (which could be a very costly solution for him).  The 
section of the log above shows the 403 response code for each
attempt to access my site, which means I blocked the access 
attempt and all he saw was a message saying he is FORBIDDEN
from accessing my site.

When that happens, he generally stops for awhile.  Then, he 
switches to a different IP address and starts all over again.

I currently have 46 groups of IP addresses blocked.  There are
256x256 or 65,536 IP addresses per group.  So, I have a total 
of 3,014,656 blocked IP addresses.

I found that if I block just a single IP address, he'll use
another IP address in the same block.  So, when he used 
94.190.9.193, I blocked 94.190.000.000 through 94.190.256.256.

Below is a list of ALL the access attempts he made during the 
November 17, 2010 "attack."  The log entries with a 206 response
code were single line accesses.  Code 206 means "Partial Content"
Which presumably means the HEAD access looked at more of the web 
page than the entries with the 200 response code.  All entries 
with a 200 response code represent 10 HEAD reads in a row.

This list was created by deleting all log entries that weren't 
part of the "attacks."  I also deleted all but the first log 
entry in each series of ten HEAD accesses.  So, each line 
shown below represents 10 HEAD access attempts (except for 
the few with the 206 error code).  (There were also some single
line HEAD accesses which I omitted from this list.)

On this day, November 17, 2010, about 70 percent of the hits to
my web site were these unexplained HEAD accesses.  That's why I
decided I would have to put a stop to it.      

--------------------------------------------------------------

95.189.6.161 - - [17/Nov/2010:00:15:30 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:00:23:49 -0500] "HEAD / HTTP/1.1" 206 382 "http://zloy-tony.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:00:23:51 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:00:31:59 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:00:40:07 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:00:48:16 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:00:56:21 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:04:40 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:13:14 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:21:29 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:29:42 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:38:06 -0500] "HEAD / HTTP/1.1" 200 341 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:46:34 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:01:54:47 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:02:02:21 -0500] "HEAD / HTTP/1.1" 206 382 "http://voprosit.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:03:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:11:38 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:20:12 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:28:46 -0500] "HEAD / HTTP/1.1" 200 341 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:37:02 -0500] "HEAD / HTTP/1.1" 200 341 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:45:27 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:02:54:06 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:02:40 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:11:27 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:20:07 -0500] "HEAD / HTTP/1.1" 200 341 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:03:23:28 -0500] "HEAD / HTTP/1.1" 206 382 "http://ololo.ws/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:28:48 -0500] "HEAD / HTTP/1.1" 200 341 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:37:32 -0500] "HEAD / HTTP/1.1" 200 341 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:46:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:03:55:05 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:03:48 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:12:11 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:20:35 -0500] "HEAD / HTTP/1.1" 200 341 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:29:19 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:37:57 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:46:19 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:04:54:46 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:05:02:48 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.189.6.161 - - [17/Nov/2010:05:11:07 -0500] "HEAD / HTTP/1.1" 200 341 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:19:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:05:24:29 -0500] "HEAD / HTTP/1.1" 206 382 "http://voprosit.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:27:07 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:35:16 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:42:43 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:49:44 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:05:56:44 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:03:20 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:06:07:38 -0500] "HEAD / HTTP/1.1" 206 382 "http://statuso.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:10:09 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:06:13:12 -0500] "HEAD / HTTP/1.1" 206 382 "http://voprosit.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:16:24 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:22:37 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:28:56 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:35:11 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:41:29 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:47:43 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:06:54:03 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:00:09 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:06:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:12:17 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:18:27 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:24:46 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:31:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:37:23 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:07:43:28 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:08:00:58 -0500] "HEAD / HTTP/1.1" 206 382 "http://ololo.ws/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:08:16:19 -0500] "HEAD / HTTP/1.1" 206 382 "http://pronim.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:08:52:23 -0500] "HEAD / HTTP/1.1" 206 382 "http://antisalo.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:09:08:41 -0500] "HEAD / HTTP/1.1" 206 382 "http://voprosit.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:09:12:25 -0500] "HEAD / HTTP/1.1" 206 382 "http://seobg.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.126.17.46 - - [17/Nov/2010:09:19:01 -0500] "HEAD / HTTP/1.1" 206 382 "http://zloy-tony.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:25:20 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:31:19 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:37:24 -0500] "HEAD / HTTP/1.1" 200 341 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:43:40 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:49:57 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:10:56:15 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:02:54 -0500] "HEAD / HTTP/1.1" 200 341 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:09:25 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:15:52 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:22:06 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:28:22 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:34:36 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:40:50 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:47:18 -0500] "HEAD / HTTP/1.1" 200 341 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:53:32 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:11:59:45 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:06:14 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:12:43 -0500] "HEAD / HTTP/1.1" 200 341 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:19:13 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:25:31 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:31:52 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:38:26 -0500] "HEAD / HTTP/1.1" 200 341 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:45:04 -0500] "HEAD / HTTP/1.1" 200 341 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:12:51:38 -0500] "HEAD / HTTP/1.1" 200 341 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:04:41 -0500] "HEAD / HTTP/1.1" 200 341 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:11:16 -0500] "HEAD / HTTP/1.1" 200 341 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:17:43 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:23:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:30:34 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:36:48 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:43:13 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:49:06 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:13:55:02 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:00:51 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:06:40 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:12:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:18:12 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:23:56 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:29:39 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:35:26 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:41:17 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:46:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:52:32 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:14:58:13 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:04:00 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:09:42 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:15:26 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:21:06 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:26:56 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:32:34 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:38:16 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:44:03 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:49:39 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:15:55:24 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:01:02 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:06:41 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:12:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:18:09 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:23:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:29:43 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:35:32 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:41:21 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:47:01 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:52:41 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:16:58:20 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:04:03 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:09:52 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:15:41 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:21:21 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:27:16 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:33:19 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:39:07 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:45:01 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:50:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:17:56:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:02:56 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:09:03 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:15:17 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:21:45 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:28:00 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:34:01 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:39:56 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:45:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:51:54 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:18:57:47 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:03:48 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:09:43 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:15:35 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:21:24 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:27:11 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:32:58 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:38:41 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:44:27 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:50:08 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:19:55:48 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:02:10 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:09:06 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:16:40 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:22:34 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:28:20 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:34:08 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:39:48 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:45:28 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:51:07 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexetoya.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:20:56:49 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:02:35 -0500] "HEAD / HTTP/1.1" 200 318 "http://upload-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:08:19 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:14:03 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:19:48 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:25:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:31:01 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:36:47 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:42:27 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:48:10 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:53:57 -0500] "HEAD / HTTP/1.1" 200 318 "http://driveroid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:21:59:34 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:05:20 -0500] "HEAD / HTTP/1.1" 200 318 "http://arbuzoid.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:11:03 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:16:41 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmparad.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:22:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:28:07 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:33:46 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:39:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:45:02 -0500] "HEAD / HTTP/1.1" 200 318 "http://ya-soft.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:50:47 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:22:56:25 -0500] "HEAD / HTTP/1.1" 200 318 "http://smotrim-kino.com" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:02:02 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:07:30 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:13:04 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:18:36 -0500] "HEAD / HTTP/1.1" 200 318 "http://warenik.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:24:09 -0500] "HEAD / HTTP/1.1" 200 318 "http://filmogun.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:29:42 -0500] "HEAD / HTTP/1.1" 200 318 "http://blogoaut.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:35:17 -0500] "HEAD / HTTP/1.1" 200 318 "http://yamedikdoctor.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:40:44 -0500] "HEAD / HTTP/1.1" 200 318 "http://forexoider.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
92.124.35.43 - - [17/Nov/2010:23:46:09 -0500] "HEAD / HTTP/1.1" 200 318 "http://zapasnoe5koleso.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

--------------------------------------------------------------

And below is the same kind of information about an attack that
occurred on November 3, 2011.  In this case, however, I started
blocking the accesses at 09:24:36 AM, and that's why the 
response code changes from 200 to 403. 

--------------------------------------------------------------

94.190.65.55 - - [03/Nov/2011:00:10:20 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:02:31:57 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:02:41:53 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:02:51:41 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:01:27 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:11:09 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:20:46 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:30:34 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:40:31 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:50:13 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:03:59:55 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:04:10:12 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:04:20:41 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:04:31:20 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:04:41:58 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:04:52:34 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:03:02 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:13:20 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:23:48 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:34:07 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:44:29 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:05:54:41 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:05:11 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:15:35 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:26:11 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:36:35 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:47:07 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:06:57:59 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:07:08:23 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:07:18:58 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:07:29:19 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:07:39:41 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:07:50:30 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:00:48 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:11:23 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:11:26 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:21:40 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:32:19 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:42:37 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:08:52:56 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:03:30 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:13:54 -0400] "HEAD / HTTP/1.1" 200 318 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:24:36 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:35:03 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:45:19 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:09:55:36 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:10:06:31 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:10:18:05 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:10:30:42 -0400] "HEAD / HTTP/1.1" 403 157 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:10:44:02 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:10:58:45 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:11:13:29 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:11:27:42 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:11:41:32 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:11:55:36 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:12:09:43 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:12:23:42 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:12:38:00 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:12:52:28 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:13:08:14 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:13:23:36 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:13:38:38 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:13:54:03 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:14:09:04 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:14:24:06 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:14:39:14 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:14:54:28 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:15:09:34 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:15:24:34 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:15:39:57 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:15:55:40 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:16:11:39 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:16:26:45 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:16:42:17 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:16:57:29 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:17:13:07 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:17:27:57 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:17:42:54 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
78.26.133.3 - - [03/Nov/2011:17:46:57 -0400] "HEAD / HTTP/1.1" 200 318 "http://yourroof.com.ua/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:17:57:52 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:18:12:38 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:18:27:15 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:18:41:51 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:18:56:58 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:19:12:08 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:19:26:48 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:19:41:21 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:19:56:02 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:20:11:03 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:20:26:08 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:20:40:51 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:20:55:55 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:21:11:25 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:21:26:08 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:21:40:43 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:22:09:49 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:22:24:38 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:22:39:26 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:22:54:11 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:23:08:56 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:23:23:43 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
46.173.208.68 - - [03/Nov/2011:23:38:19 -0400] "HEAD / HTTP/1.1" 403 182 "http://mir02.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

-------------------------------------------------------------

Below are ALL the HEAD accesses between 26 November, 2011 and 
2 January, 2012, where 10 HEAD access reads in a row appeared
on my web site log.  Again, each line represents 10 HEAD accesses.
Again, when the reponse code becomes 403, that means I had put
in a block to prevent access by that IP address.

-------------------------------------------------------------

187.174.201.12 - - [26/Nov/2011:04:42:50 -0500] "HEAD / HTTP/1.0" 200 318 "http://yourroof.com.ua/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.123.18.201 - - [26/Dec/2011:01:09:58 -0500] "HEAD / HTTP/1.1" 200 341 "http://sdlwebsite.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

94.190.9.193 - - [30/Dec/2011:13:49:06 -0500] "HEAD / HTTP/1.1" 200 318 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

94.190.9.193 - - [31/Dec/2011:00:49:36 -0500] "HEAD / HTTP/1.1" 200 318 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [31/Dec/2011:01:19:44 -0500] "HEAD / HTTP/1.1" 200 318 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

94.190.9.193 - - [01/Jan/2012:04:38:28 -0500] "HEAD / HTTP/1.1" 200 318 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:05:04:16 -0500] "HEAD / HTTP/1.1" 200 318 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:05:32:36 -0500] "HEAD / HTTP/1.1" 200 318 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:06:02:24 -0500] "HEAD / HTTP/1.1" 200 318 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:06:35:26 -0500] "HEAD / HTTP/1.1" 200 318 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:07:09:50 -0500] "HEAD / HTTP/1.1" 200 318 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:07:42:23 -0500] "HEAD / HTTP/1.1" 200 318 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:08:14:40 -0500] "HEAD / HTTP/1.1" 200 318 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [01/Jan/2012:08:51:40 -0500] "HEAD / HTTP/1.1" 200 318 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

94.190.9.193 - - [02/Jan/2012:05:29:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:05:49:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:09:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:30:24 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:06:50:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:07:11:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:07:32:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:07:54:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:08:18:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:08:42:30 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:09:07:56 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:09:30:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:09:53:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:10:16:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:10:37:24 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:10:58:09 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:11:19:43 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:11:41:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:12:03:07 -0500] "HEAD / HTTP/1.1" 403 182 "http://tolkuchca.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:12:24:55 -0500] "HEAD / HTTP/1.1" 403 182 "http://familniki.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.190.9.193 - - [02/Jan/2012:12:48:04 -0500] "HEAD / HTTP/1.1" 403 182 "http://zonatop.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

------------------------------------------------------

On January 3, 2012, the person behind these "attacks"
suddenly changed something so that the HEAD reads were
no longer 10 in a group.  Starting on Jan. 3, there were 
only 5 HEAD accesses in a group.  So, each line below
represents 5 lines on my web site log.

Also, he started re-using IP addresses I had already
blocked.  So, he started getting FORBIDDEN as the response
immediately. 

-------------------------------------------------------

2.133.227.52 - - [03/Jan/2012:11:26:53 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:12:21:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:12:41:54 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:13:18:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:13:38:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:13:59:11 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:14:19:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:14:39:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:14:59:16 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:15:20:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:15:39:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:16:02:37 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:16:28:11 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:16:55:30 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:17:20:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:17:48:38 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:18:18:58 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:18:46:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:19:10:42 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:19:38:23 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:20:10:20 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:20:42:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:21:17:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:21:50:07 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:22:25:26 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:23:00:38 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [03/Jan/2012:23:40:23 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.227.52 - - [04/Jan/2012:00:16:53 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:00:56:23 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:01:34:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:02:11:53 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:02:51:03 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:03:35:43 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:04:16:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:04:57:33 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:05:33:55 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:06:18:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:06:53:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:07:25:49 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:07:48:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:08:14:42 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:08:40:37 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.227.52 - - [04/Jan/2012:09:06:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.248.237 - - [04/Jan/2012:11:43:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.248.237 - - [04/Jan/2012:12:02:15 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.248.237 - - [04/Jan/2012:12:22:24 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.248.237 - - [04/Jan/2012:12:45:45 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.28.1 - - [05/Jan/2012:09:47:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
178.91.28.1 - - [05/Jan/2012:10:11:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
178.91.28.1 - - [05/Jan/2012:10:37:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.206.153 - - [05/Jan/2012:14:57:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.210.144 - - [05/Jan/2012:15:22:29 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.210.144 - - [05/Jan/2012:15:48:09 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.60.55 - - [06/Jan/2012:08:31:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
178.91.19.80 - - [06/Jan/2012:08:46:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:09:02:54 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:09:18:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:09:34:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:09:50:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:10:05:48 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:10:21:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:10:37:18 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:10:53:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:11:08:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:11:24:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:11:39:43 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:11:55:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:12:10:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:12:26:20 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:12:41:44 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:12:56:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:13:12:19 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:13:26:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:13:41:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:13:57:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:14:12:03 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:14:27:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:14:44:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:15:04:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:15:23:49 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:15:47:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:16:16:12 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:16:50:48 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:17:36:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:18:13:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:18:47:12 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:19:21:15 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:19:54:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:20:32:19 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:21:03:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:21:28:50 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:21:54:14 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:22:18:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:22:40:58 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:23:02:42 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:23:24:19 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [06/Jan/2012:23:46:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.202.49 - - [07/Jan/2012:00:27:18 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:00:48:57 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:01:09:48 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:01:32:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:01:55:53 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:02:19:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:02:42:11 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:03:06:09 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:03:31:03 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:03:53:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:04:17:38 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:04:45:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:05:15:21 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:05:46:44 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:06:13:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:06:42:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:07:11:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:07:40:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:08:08:37 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.202.49 - - [07/Jan/2012:08:29:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:08:48:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:09:05:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:09:21:23 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:09:37:39 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:09:53:47 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:10:10:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:10:33:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:10:49:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:11:15:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:11:41:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:12:09:38 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:12:37:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:13:05:49 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:13:37:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:14:09:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:14:43:04 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:15:11:46 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:15:40:26 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:16:05:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:16:25:00 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.221.151 - - [07/Jan/2012:16:43:54 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.212.224 - - [08/Jan/2012:01:03:22 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:01:21:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:01:41:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:02:05:07 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:02:45:20 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:03:32:22 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:04:29:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:05:14:29 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:05:47:11 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:06:26:27 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:07:07:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:07:45:18 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:08:25:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
2.133.212.224 - - [08/Jan/2012:09:07:25 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

---------------------------------------------------------------

From this point on, unless something very unusual happens, 
I'm only going to show first log entry whenever he starts 
using a different IP address.  

---------------------------------------------------------------

95.59.61.137 - - [09/Jan/2012:00:10:18 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.196.237 - - [10/Jan/2012:01:11:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.195.178 - - [11/Jan/2012:04:07:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
95.59.57.42 - - [11/Jan/2012:12:01:31 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.4.70 - - [12/Jan/2012:12:42:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.58.64 - - [13/Jan/2012:12:12:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

---------------------------------------------------------------

Okay, this is somewhat unusual.  I got 4 GET accesses in row 
from a blocked address in the Ukraine.  And, it looks like it 
could be from a different computer.  It's also suspicious 
because the HEAD accesses seem to have stopped about 9 hours
earlier:  
-----------------------------
95.134.95.123 - - [13/Jan/2012:22:20:03 -0500] "GET / HTTP/1.0" 403 567 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; FDM)"
95.134.95.123 - - [13/Jan/2012:22:20:04 -0500] "GET / HTTP/1.0" 403 567 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; FDM)"
95.134.95.123 - - [13/Jan/2012:22:20:04 -0500] "GET / HTTP/1.0" 403 567 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; FDM)"
95.134.95.123 - - [13/Jan/2012:22:20:05 -0500] "GET / HTTP/1.0" 403 567 "http://www.anthraxinvestigation.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; FDM)"
-----------------------------

But then the HEAD accesses restarted again, still 5 in a group
and still using IP address groups I blocked long ago:

---------------------------------------------------------------

2.133.208.177 - - [15/Jan/2012:08:14:00 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.9.57 - - [16/Jan/2012:08:31:54 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.196.81 - - [17/Jan/2012:08:55:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.56.130 - - [17/Jan/2012:09:56:54 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.227.63 - - [17/Jan/2012:10:43:20 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.51.2 - - [18/Jan/2012:11:26:58 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.209.196 - - [19/Jan/2012:11:15:26 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.196.254 - - [20/Jan/2012:14:59:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.54.7 - - [21/Jan/2012:04:25:53 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.200.106 - - [22/Jan/2012:02:17:42 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.43.120 - - [22/Jan/2012:07:25:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.224.28 - - [23/Jan/2012:23:46:45 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.199.190 - - [24/Jan/2012:07:46:58 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.231.105 - - [26/Jan/2012:00:38:15 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.194.72 - - [26/Jan/2012:01:40:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.27.132 - - [27/Jan/2012:01:52:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.34.174 - - [28/Jan/2012:02:01:15 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.10.22 - - [29/Jan/2012:06:39:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.23.6 - - [29/Jan/2012:10:51:08 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.193.36 - - [31/Jan/2012:00:51:00 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.15.168 - - [31/Jan/2012:05:18:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.219.116 - - [31/Jan/2012:13:55:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.198.218 - - [31/Jan/2012:21:13:55 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.222.14 - - [01/Feb/2012:04:59:40 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.193.221 - - [02/Feb/2012:00:38:04 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

178.91.21.220 - - [02/Feb/2012:04:54:47 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.197.216 - - [02/Feb/2012:13:43:36 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.217.234 - - [02/Feb/2012:21:08:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.54.176 - - [03/Feb/2012:13:24:50 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.40.31 - - [04/Feb/2012:03:40:32 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.49.241 - - [04/Feb/2012:13:12:02 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.195.214 - - [04/Feb/2012:17:13:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.214.209 - - [04/Feb/2012:21:01:18 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.45.49 - - [05/Feb/2012:03:09:40 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.214.225 - - [05/Feb/2012:13:03:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.34.157 - - [05/Feb/2012:21:04:49 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.35.255 - - [06/Feb/2012:13:39:25 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.40.220 - - [06/Feb/2012:21:08:59 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.206.68 - - [07/Feb/2012:13:44:50 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.212.135 - - [07/Feb/2012:21:13:40 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.199.138 - - [08/Feb/2012:13:20:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.219.243 - - [08/Feb/2012:21:04:28 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.199.168 - - [09/Feb/2012:11:08:48 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.213.239 - - [10/Feb/2012:08:11:42 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.199.7 - - [10/Feb/2012:11:57:05 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.51.207 - - [10/Feb/2012:13:19:23 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.215.143 - - [11/Feb/2012:02:45:45 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.34.169 - - [11/Feb/2012:13:09:13 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.41.111 - - [14/Feb/2012:00:42:04 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.209.193 - - [14/Feb/2012:14:04:25 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.40.94 - - [14/Feb/2012:21:34:22 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.229.248 - - [15/Feb/2012:11:40:40 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.50.157 - - [15/Feb/2012:12:19:51 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.218.241 - - [15/Feb/2012:13:03:06 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.213.21 - - [16/Feb/2012:00:48:41 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.216.248 - - [16/Feb/2012:13:33:35 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.36.19 - - [16/Feb/2012:21:29:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.214.53 - - [18/Feb/2012:07:29:10 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.205.216 - - [18/Feb/2012:13:07:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.198.184 - - [18/Feb/2012:21:07:09 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.212.200 - - [19/Feb/2012:13:26:17 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.198.135 - - [19/Feb/2012:15:26:24 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.208.10 - - [19/Feb/2012:21:35:44 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.202.209 - - [20/Feb/2012:02:06:15 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.215.25 - - [20/Feb/2012:13:18:03 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

95.59.34.38 - - [20/Feb/2012:21:23:01 -0500] "HEAD / HTTP/1.1" 403 182 "http://kaz-ekzams.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.210.61 - - [21/Feb/2012:14:04:14 -0500] "HEAD / HTTP/1.1" 403 182 "http://progs-shool.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.212.73 - - [21/Feb/2012:21:06:52 -0500] "HEAD / HTTP/1.1" 403 182 "http://pro-psixology.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

2.133.223.136 - - [22/Feb/2012:02:16:14 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

92.46.198.198 - - [22/Feb/2012:13:39:34 -0500] "HEAD / HTTP/1.1" 403 182 "http://didaktica.ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"

---------------------------------------------------------------

Note that all the HEAD accesses have the same computer 
information at the end of the line.  That seems to mean that 
all these HEAD accesses come from the same computer - even 
though the IP addresses indicate different countries.

Here are the countries associated with each unique IP address
in the order they appear in the lists above:

95.189.6.161   = Russian Federation
92.126.17.46   = Russian Federation
92.124.35.43   = Russian Federation
94.190.65.55   = Russian Federation
46.173.208.68  = Russian Federation
78.26.133.3    = Ukraine
187.174.201.12 = Mexico
178.123.18.201 = Belarus
94.190.9.193   = Russian Federation
2.133.227.52   = Kazakhstan          10
2.133.248.237  = Kazakhstan
178.91.28.1    = Kazakhstan
2.133.206.153  = Kazakhstan
2.133.210.144  = Kazakhstan
95.59.60.55    = Kazakhstan
178.91.19.80   = Kazakhstan
2.133.202.49   = Kazakhstan
2.133.221.151  = Kazakhstan
2.133.212.224  = Kazakhstan
95.59.61.137   = Kazakhstan          20
2.133.196.237  = Kazakhstan
92.46.195.178  = Kazakhstan
95.59.57.42    = Kazakhstan
178.91.4.70    = Kazakhstan
95.59.58.64    = Kazakhstan
95.134.95.123  = Ukraine
2.133.208.177  = Kazakhstan
178.91.9.57    = Kazakhstan
2.133.196.81   = Kazakhstan
95.59.56.130   = Kazakhstan          30
2.133.227.63   = Kazakhstan
95.59.51.2     = Kazakhstan
2.133.209.196  = Kazakhstan
2.133.196.254  = Kazakhstan
95.59.54.7     = Kazakhstan
92.46.200.106  = Kazakhstan
95.59.43.120   = Kazakhstan
2.133.224.28   = Kazakhstan
92.46.199.190  = Kazakhstan 
2.133.231.105  = Kazakhstan          40
92.46.194.72   = Kazakhstan
178.91.27.132  = Kazakhstan
95.59.34.174   = Kazakhstan
178.91.10.22   = Kazakhstan
178.91.23.6    = Kazakhstan
92.46.193.36   = Kazakhstan
178.91.15.168  = Kazakhstan
2.133.219.116  = Kazakhstan
92.46.198.218  = Kazakhstan
2.133.222.14   = Kazakhstan          50
2.133.193.221  = Kazakhstan
178.91.21.220  = Kazakhstan
2.133.197.216  = Kazakhstan
2.133.217.234  = Kazakhstan
95.59.54.176   = Kazakhstan
95.59.40.31    = Kazakhstan
95.59.49.241   = Kazakhstan
92.46.195.214  = Kazakhstan
2.133.214.209  = Kazakhstan
95.59.45.49    = Kazakhstan          60
2.133.214.225  = Kazakhstan
95.59.34.157   = Kazakhstan
95.59.35.255   = Kazakhstan
95.59.40.220   = Kazakhstan
2.133.206.68   = Kazakhstan
2.133.212.135  = Kazakhstan
92.46.199.138  = Kazakhstan
2.133.219.243  = Kazakhstan
2.133.199.168  = Kazakhstan
2.133.213.239  = Kazakhstan          70
2.133.199.7    = Kazakhstan
95.59.51.207   = Kazakhstan
2.133.215.143  = Kazakhstan
95.59.34.169   = Kazakhstan
95.59.41.111   = Kazakhstan
2.133.209.193  = Kazakhstan
95.59.40.94    = Kazakhstan
2.133.229.248  = Kazakhstan
95.59.50.157   = Kazakhstan
2.133.218.241  = Kazakhstan          80
2.133.213.21   = Kazakhstan
2.133.216.248  = Kazakhstan
95.59.36.19    = Kazakhstan
2.133.214.53   = Kazakhstan
2.133.205.216  = Kazakhstan
92.46.198.184  = Kazakhstan
2.133.212.200  = Kazakhstan
92.46.198.135  = Kazakhstan
2.133.208.10   = Kazakhstan
2.133.202.209  = Kazakhstan          90
2.133.215.25   = Kazakhstan
95.59.34.38    = Kazakhstan
2.133.210.61   = Kazakhstan
2.133.212.73   = Kazakhstan
2.133.223.136  = Kazakhstan
92.46.198.198  = Kazakhstan

Here's the same information in order by IP address:

2.133.193.221  = Kazakhstan
2.133.196.81   = Kazakhstan
2.133.196.237  = Kazakhstan
2.133.196.254  = Kazakhstan
2.133.197.216  = Kazakhstan
2.133.199.7    = Kazakhstan
2.133.199.168  = Kazakhstan
2.133.212.200  = Kazakhstan
2.133.202.49   = Kazakhstan
2.133.202.209  = Kazakhstan
2.133.205.216  = Kazakhstan
2.133.206.68   = Kazakhstan
2.133.206.153  = Kazakhstan
2.133.208.10   = Kazakhstan
2.133.208.177  = Kazakhstan
2.133.209.193  = Kazakhstan
2.133.209.196  = Kazakhstan
2.133.210.61   = Kazakhstan
2.133.210.144  = Kazakhstan
2.133.212.73   = Kazakhstan
2.133.212.135  = Kazakhstan
2.133.212.224  = Kazakhstan
2.133.213.21   = Kazakhstan
2.133.213.239  = Kazakhstan
2.133.214.53   = Kazakhstan
2.133.214.209  = Kazakhstan
2.133.214.225  = Kazakhstan
2.133.215.25   = Kazakhstan
2.133.215.143  = Kazakhstan
2.133.216.248  = Kazakhstan
2.133.217.234  = Kazakhstan
2.133.218.241  = Kazakhstan
2.133.219.116  = Kazakhstan
2.133.219.243  = Kazakhstan
2.133.221.151  = Kazakhstan
2.133.222.14   = Kazakhstan
2.133.223.136  = Kazakhstan
2.133.224.28   = Kazakhstan
2.133.227.52   = Kazakhstan
2.133.227.63   = Kazakhstan
2.133.229.248  = Kazakhstan
2.133.231.105  = Kazakhstan
2.133.248.237  = Kazakhstan
46.173.208.68  = Russian Federation
78.26.133.3    = Ukraine
92.46.193.36   = Kazakhstan
92.46.194.72   = Kazakhstan
92.46.195.178  = Kazakhstan
92.46.195.214  = Kazakhstan
92.46.198.135  = Kazakhstan
92.46.198.184  = Kazakhstan
92.46.198.198  = Kazakhstan
92.46.198.218  = Kazakhstan
92.46.199.138  = Kazakhstan
92.46.199.190  = Kazakhstan 
92.46.200.106  = Kazakhstan
92.124.35.43   = Russian Federation
92.126.17.46   = Russian Federation
94.190.9.193   = Russian Federation
94.190.65.55   = Russian Federation
95.59.34.38    = Kazakhstan
95.59.34.157   = Kazakhstan
95.59.34.169   = Kazakhstan
95.59.34.174   = Kazakhstan
95.59.35.255   = Kazakhstan
95.59.36.19    = Kazakhstan
95.59.40.31    = Kazakhstan
95.59.40.94    = Kazakhstan
95.59.40.220   = Kazakhstan
95.59.41.111   = Kazakhstan
95.59.43.120   = Kazakhstan
95.59.45.49    = Kazakhstan
95.59.49.241   = Kazakhstan
95.59.50.157   = Kazakhstan
95.59.51.2     = Kazakhstan
95.59.51.207   = Kazakhstan
95.59.54.7     = Kazakhstan 
95.59.54.176   = Kazakhstan 
95.59.56.130   = Kazakhstan
95.59.57.42    = Kazakhstan
95.59.58.64    = Kazakhstan
95.59.60.55    = Kazakhstan
95.59.61.137   = Kazakhstan
95.134.95.123  = Ukraine
95.189.6.161   = Russian Federation
178.91.4.70    = Kazakhstan
178.91.9.57    = Kazakhstan
178.91.10.22   = Kazakhstan
178.91.15.168  = Kazakhstan
178.91.19.80   = Kazakhstan
178.91.21.220  = Kazakhstan
178.91.23.6    = Kazakhstan
178.91.27.132  = Kazakhstan
178.91.28.1    = Kazakhstan
178.123.18.201 = Belarus
187.174.201.12 = Mexico

And here is what a log entry looks like when I access my own
web site via my Firefox browser by clicking on a link on 
the FreeRepublic.com web site:

----------------------------------------

98.144.51.230 - - [05/Jan/2012:09:59:59 -0500] "GET / HTTP/1.1" 200 69890 "http://www.freerepublic.com/focus/f-news/2790930/posts" "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/20100101 Firefox/8.0"

----------------------------------------

And he is what a log entry looks like when I do the same thing
using Internet Explorer as my browser:

----------------------------------------

98.144.51.230 - - [06/Jan/2012:12:23:26 -0500] "GET / HTTP/1.1" 200 70308 "http://www.freerepublic.com/focus/f-news/2790930/posts" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 3.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

----------------------------------------

Note that the IP address is for MY location (Wisconsin, USA),
the computer information at the end of the entry is for MY 
computer, and the web site address in the middle of the entry
is for the FreeRepublic.com web site where I clicked on the link.

And, of course, my access used the GET command, as 99.9 percent
of all the log entries do.  The time used in ALL the log entries 
is the time at the location of my web site host: Atlanta, GA.

The HEAD accesses seem to indicate that they all come from the 
Russian web sites shown in the log entries.  But NONE of those 
web sites seem to include any links to my web site.

All the HEAD accesses appear to come from the same computer, yet
the IP addresses show that they come from different countries.

That's the mystery.

What is going on?  What is the person using the HEAD commands
trying to do?  Why does he continue doing it by changing IP 
addresses when I block the IP address he has been using?

THEORIES:

At first, since there were a lot of single line HEAD reads that
seemed to be associated with the groups of 10 but came from a
different web site, I thought it was some kind of method of 
passing information through my site.  But, I haven't been able
to figure out any way that is possible, since I don't think the
HEAD command can be used to write anything to my site.

Now, I don't think he realizes what he's doing.  I think he did
some kind of miscoding.  I think he may have thought he coded
the HEAD command to do a check on my site once every 20 days, 
and he coded it to check every 20 minutes.  He may have coded 
the HEAD command to get 10 lines of text from my site, but he's
getting 1 line ten times. And, it appears that by blocking
him I am causing him more problems that he's causing me.

But, that's they way it's going to be until I figure out what
he's doing and why he's doing it.

SOLUTION?

Theory added Jan. 7, 2012: This mystery APPEARS to have some
connection to the serial.jar Trojan horse some hacker put on my 
web site back in November of 2010.  It can't be just a coincidence 
that the Trojan horse "virus" appeared at about the same time I 
noticed the unusual HEAD reads.  The Trojan horse was removed from 
my site as soon as it was detected, but the person who is doing 
all the HEAD accesses to my site could still be infected, or, 
since he has so many resources, he could be the person behind the
Trojan horse attack.

Whatever is going on, I have no choice but to continue doing as
I've been doing.   


Ed Lake
www.anthraxinvestigation.com