What is this user agent?

Posted by joy


129.33.1.37 - IP resolves back to ibm.com , however, interestingly enough there’s been sightings of the IP on Google and on the news.admin.net-abuse.sightings newsgroup.

/blog/blog.xml

Http Code: 302 Date: Mar 26 22:14:57 Http Version: HTTP/1.1
Size in Bytes: 299

Referer: -

Agent: Rome User Agent (http://rome)

Update 3/26/06: Bert wrote in with the following…

Rome? It’s obvious…the Pope reads your blog! After
all, didn’t he just get an iPod? Maybe he’s looking
for tips.

But actually, I found this page:
http://wiki.java.net/bin/view/Javawsxml/Rome
Maybe someone at IBM is using some new feed
fetcher…no idea really.

[tags] RSS, site statistics [/tags]


2 Responses to “What is this user agent?”

  1. Lou Says:

    I was hit by this robot 191 times from March 13 until tonight. Here is what it requests each time:

    129.33.1.37 - - [01/Apr/2006:02:34:52 -0600] "GET /forum/wp-rss2.php HTTP/1.1" 200 4590 "-" "Rome User Agent (http://rome)"

    It seems to be attacted to RSS feeds on other sites too.

    The ip resolves to bi01pt1.ct.us.ibm.com. SORBS.net has blacklisted the ip address several times (as recently as today) and notes that it is “likely a trojaned machine, host running Korgo3 trojan”. I’m blocking it in my growing httpd.conf file:

    RewriteCond %{HTTP_USER_AGENT} ^Rome.?User.?Agent [NC,OR]

    Lou

  2. me Says:

    Yes.