Checking AES128-SHA usage records, we've detected several bots running within toolforge using "cryptic" User-Agents that doesn't help a lot on identifying the maintainers. Discussing the issue with @aborrero he mentioned that maybe they could be identified given toolforge IPs and timestamps of the requests.
List of unidentified UAs:
[] DotNetWikiBot/3.15 (Unix 3.13.0.139; Mono 3.2.8; .NET CLR 2.0.50727.1433). Activity detected: 10.68.18.205 (tools-exec-1426) - 2018-05-04T10:51:36.872Z
[] DotNetWikiBot/3.15 (Unix 3.13.0.139; Mono 3.2.8; .NET CLR 4.0.30319.17020). Activity detected: 10.68.17.209 (tools-exec-1411) - 2018-05-04T04:15:49.643Z
[] DotNetWikiBot/3.15 (Unix 3.13.0.139; Mono 4.8.0; .NET CLR 4.0.30319.42000). Activity detected: 10.68.23.14 (tools-exec-1416) - 2018-05-04T04:30:05.069Z
[] DotNetWikiBot/3.15 (Unix 3.13.0.141; Mono 3.2.8; .NET CLR 2.0.50727.1433). Activity detected: 10.68.23.103 (tools-exec-1413) - 2018-05-03T18:22:12.959Z
[] DotNetWikiBot/3.15 (Unix 3.13.0.141; Mono 4.8.0; .NET CLR 4.0.30319.42000). Activity detected: 10.68.16.126 (tools-exec-1441) - 2018-05-03T21:00:29.183Z