18.104.22.168 is a.k.a. irongrove.net [robtex.com...]
"Goldfire Server" is not a completely uncommon UA (although I reckon it's wrongly configured when it's the UA). So why is shell.com spidering, I wonder? SERPs from 2000-2005 suggest it was an employee-accessed server, or some such. [g6ftpserver.com...] Now? Dunno. Anyone else seeing this?
Pretty much the same experience, however unsure about the range. I'd see Goldfire Server once every several weeks. Behaved and of no concern. Then last week it ignored robots.txt and crawled a few pages. Now blocked by UA.