Comments on: What is this user agent? http://cleverhack.com/2006/03/26/what-is-this-user-agent/ Technology, Startups, Internet Marketing Thu, 17 May 2012 10:25:48 +0000 http://wordpress.org/?v=2.0.2 by: me http://cleverhack.com/2006/03/26/what-is-this-user-agent/#comment-13967 Sat, 01 Apr 2006 14:48:12 +0000 http://cleverhack.com/2006/03/26/what-is-this-user-agent/#comment-13967 <a href="http://www.senderbase.org/search?searchString=129.33.1.37" rel="nofollow">Yes</a>. Yes.

]]> by: Lou http://cleverhack.com/2006/03/26/what-is-this-user-agent/#comment-13965 Sat, 01 Apr 2006 08:50:03 +0000 http://cleverhack.com/2006/03/26/what-is-this-user-agent/#comment-13965 I was hit by this robot 191 times from March 13 until tonight. Here is what it requests each time: <code>129.33.1.37 - - [01/Apr/2006:02:34:52 -0600] "GET /forum/wp-rss2.php HTTP/1.1" 200 4590 "-" "Rome User Agent (http://rome)"</code> It seems to be attacted to RSS feeds on other sites too. The ip resolves to bi01pt1.ct.us.ibm.com. SORBS.net has blacklisted the ip address several times (as recently as today) and notes that it is "likely a trojaned machine, host running Korgo3 trojan". I'm blocking it in my growing httpd.conf file: <code>RewriteCond %{HTTP_USER_AGENT} ^Rome.?User.?Agent [NC,OR]</code> Lou I was hit by this robot 191 times from March 13 until tonight. Here is what it requests each time:

129.33.1.37 - - [01/Apr/2006:02:34:52 -0600] "GET /forum/wp-rss2.php HTTP/1.1" 200 4590 "-" "Rome User Agent (http://rome)"

It seems to be attacted to RSS feeds on other sites too.

The ip resolves to bi01pt1.ct.us.ibm.com. SORBS.net has blacklisted the ip address several times (as recently as today) and notes that it is “likely a trojaned machine, host running Korgo3 trojan”. I’m blocking it in my growing httpd.conf file:

RewriteCond %{HTTP_USER_AGENT} ^Rome.?User.?Agent [NC,OR]

Lou

]]>