IP started from 66 is a google bot, what IP you mean? 121 or 66?
I never see before that this IP connect to my server and I can't see at headers right now, so I don't know who is that
orginaly i was talking about the 66.x.x.x address, i had to go through google support, it turnd out to be a rouge bot on there end... google bulshit...
https://support.google.com/webmasters/answer/182072?hl=enhttps://support.google.com/websearch/answer/106318?hl=en(i remember back in 2010, of banning a large section from 66.x.x.x in hfs and iptabled them to drop in a ddwrt router.)
after about a month of them unable to gain access, it stooped coming around.
--* yes, it a range ip, blocking the one ip wil only send the next address down one ip up or one ip down.
The bots job is to collect all data on the site it finds. google is suppose to be using that via dns names, but they have a few searching IP, thus it is a rouge bot on there end.
as for the 121. form what i saw in the log, i thought that was a normal some one visited.
if it is a hacker, its probably searching machine code to get in, or the fixed/patch alt number key 255 ( blank character that is not a space but is displayed as a space.) find alot of search scripts broken because they don't have a filter...
just because you have a file for the bot/spider to read, doesn't mean the spider, bot is using them...
there are hacker out there that run code to search for site on there ISP and you ip might have come up in there search.
*one of the way to do the search is a bot scan, if the bot finds a http site, or a ISP that is sending something open, the bot then runs code in java script etc.. etc.. usually in HFS, it is seen as a random ip visiting the webpage.
Alot of factors, unanswered questions. I could dig deeper, but you scratching out the ip for me to dig down in the Internets records to get where its realy coming form.
My understanding of this post, was that there might have been a bug, or vulnerability. I'm not see it, if there is one, rejeto, mars, or other experienced user might have jumped in by now.
all i can do, is recommend you start banning there ip, or doing more network based security to block them.