Novel User Agent

Made by ZmEu @ WhiteHat Team - www.whitehat.ro

[dstiles]

This User-Agent hit my server about 500 hundred in 8 minutes in one of those php admin/manager/etc attacks - what can we break now kind of thing. Hit most of the sites on the server as far as I can tell: they usually do.

Full UA: Made by ZmEu @ WhiteHat Team - www(.)whitehat(.)ro
(parentheses added around dots to discourage the sods)

IP: 83.170.113.208 - UK2 hosting - same as mine :(

Action: completely non-white-hat.

Common enough recently but the UA is (in my experieice) unusual.

[Pfui]

It's old, and bad. [webmasterworld.com...]

Its names range from the short -- ZmEu -- to the long version you saw, and in-between. I see it maybe three, four times a month across as many sites, literally from all over (.com, .ro, .ru, .jp, etc).

Basically it's just another exploit that aims to get its hooks into any machine anywhere and wreak havoc everywhere.

[dstiles]

Thanks. Hadn't conciously noticed it before. Perhaps it only popped up here two or three times before instead of hundreds.