This User-Agent hit my server about 500 hundred in 8 minutes in one of those php admin/manager/etc attacks - what can we break now kind of thing. Hit most of the sites on the server as far as I can tell: they usually do.
Full UA: Made by ZmEu @ WhiteHat Team - www(.)whitehat(.)ro
(parentheses added around dots to discourage the sods)
IP: 18.104.22.168 - UK2 hosting - same as mine :(
Action: completely non-white-hat.
Common enough recently but the UA is (in my experieice) unusual.