LinkedInBlackBerry

[keyplyr]

UA: LinkedInBlackBerry/10.1.31 (322) Passport SQW100-1/10.3.2.2639 (Research In Motion;RIM BlackBerry Device;Passport;SQW100-1;1)
Protocol: HTTP/1.1
Robots.txt: No
Host: Orange UK ISP
213.205.224.0 - 213.205.255.255
213.205.224.0/19

Besides the obvious conclusion, I have no further info on the actor.

It requested an image file remotely (it wasn't on my site.) It was blocked due to the UA attribute "research."

[dstiles]

Research In Motion is blackberry - a long-established mobile phone. Not so many blackberries around since govs hounded it for being too secure and (tried to?) made them put a back-door in. Now, devices are trying to be more secure than each other, so go figure.

I had customers who used blackberries way back, so I've always allowed them. No worse than iphone.

[keyplyr]

Well I knew it was Blackberry :)

Question is... why is it after my images? No requests for other files, just images. However it does not include a referrer so it may be crawling Google Image Search (or similar.)

[dstiles]

> Well I knew it was Blackberry :)

Sorry. Forgot who I was talking to. :)

Orange is a valid UK broadband provider so I assume it wasn't google. Could be somone playing - it's easy anough to change the UA in many browsers and other tools such as curl. You don't give the actual IP but you could try it in (eg) Umit to see if there are open ports; if there are, someone is probably being naughty.

[keyplyr]

Orange is a valid UK broadband provider so I assume it wasn't google.

I was suggesting the agent was *crawling Google Image Search* and getting the image links there, because it wasn't on my site... didn't intend to imply the agent *was Google* or the agent was spoofing the Google UA.