I recently noticed a huge load on my main production server, after some log parsing i stumbled upon a large number of those user agents originate from about 20 different IPs:
184.108.40.206 - - [07/May/2013:16:26:17 +0200] "GET / HTTP/1.1" 302 490 "-" "Java/1.6.0_26" 220.127.116.11 - - [07/May/2013:16:26:18 +0200] "GET / HTTP/1.1" 200 17376 "-" "Java/1.6.0_26"
Guessing it was some kind of screen scraping tool, i managed to block those user agents with fail2ban.
Now i'm puzzled, once the ban time has expired, the requests from the IPs start over and over again. I'm currently blocking about 10 IPs by day.
What is it? The IPs originate from servers and from individuals users, it is a normal event (like those infected servers which constantly try to log with SSH) should i worry about my server security?