KKman2.0 With Strange Characters in Logs

[OnThePike]

Would someone kindly interpret what exactly this KKman thing is and what it seems to be requesting/injecting/whatever?

212.117.177.213 - - [02/Feb/2011:10:57:21 -0700] "GET /newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP HTTP/1.0" 403 1792 "http://(MY SITE).net/newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:22 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/newreply.php?do=newreply&noquote=1&p=18882++++++++++++++Result:+%F4%EE%F0%F3%EC+%ED%E5+%ED%E0%E9%E4%E5%ED+/+%ED%E5+%F3%E4%E0%EB%EE%F1%FC+%EE%EF%F0%E5%E4%E5%EB%E8%F2%FC+IP" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:22 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"
212.117.177.213 - - [02/Feb/2011:10:57:23 -0700] "GET / HTTP/1.0" 403 1614 "http://(MY SITE).net/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"

"(My Site)" was replaced by me.

Also note the 403; I had pre-banned this IP at some earlier date for some other reason.

[incrediBILL]

Looks like a comment spammer to me.

Also see: [webmasterworld.com...]

[wilderness]

Sister site:

94.102.63.zz - - [22/Feb/2010:06:14:08 +0000] "GET /MyFolder/MyPage.html HTTP/1.0" 410 1228 "http: //theinvestblog.com/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"


My site (note requested page same as referring page:

218.6.15.zz - - [20/Feb/2010:13:10:31 +0000] "GET /DifferentFolder/DifferentPage.html HTTP/1.0" 410 1245 "http://www.example.com/DifferentFolder/DifferentPage.html" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; KKman2.0)"

[OnThePike]

Thanks. I was aware it was a comment spammer by checking the Project Honey Pot and Stop Forum Spam databases. I meant to ask what correlation there is between the KKman2.0 UA and that string of characters -- what that seemingly obfuscated message was meant to represent and how a forum would render it in a language.

Sorry for not being clear.

Also I did check that other thread, but posting there has been disabled due to thread age.

I tried using urldecode, rawurldecode, base64_decode, and parse_url but none of these returned a readable message.

Any ideas?

[incrediBILL]

perhaps it's in unicode

[OnThePike]

Thanks. I tried these:

[code.cside.com...]
[people.w3.org...]
[macchiato.com...]

But none returned a readable message.

I guess it's not important, more a case of curiosity on my part.