The part that matched was "IBM EVV", which has been documented as being part of a bot used for attacks in the past.
The problem is that IBM EVV is actually perfectly innocent, it's just that the bot in the attacks was lying about what it was, saying it was something else.
When I looked through my logs I couldn't find a good browser claiming to be that... so I blocked it.
But actually, I just didn't look at enough of my logs. Opera is less than 1% of usage, so if I'd looked at several days worth of logs I would've seen it.
It was at my end.
The part that matched was "IBM EVV", which has been documented as being part of a bot used for attacks in the past.
The problem is that IBM EVV is actually perfectly innocent, it's just that the bot in the attacks was lying about what it was, saying it was something else.
When I looked through my logs I couldn't find a good browser claiming to be that... so I blocked it.
But actually, I just didn't look at enough of my logs. Opera is less than 1% of usage, so if I'd looked at several days worth of logs I would've seen it.
My bad, you should be good now.