```json
{
    "title": "Apache and mod_rewrite: More Zombified Idiots Dispatched",
    "url": "https://performancezen.com/2005/05/02/apache-and-mod_rewrite-more-zombified-idiots-dispatched/",
    "datePublished": "2005-05-02",
    "dateModified": "2005-05-02",
    "language": "en-US",
    "description": "I have been seeing a large number of hits with the following User-Agent string in my logs lately: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 Firebird/0.7 Firebird hasn't…",
    "author": "spierzchala",
    "publisher": "Performance Zen"
}
```

# Apache and mod_rewrite: More Zombified Idiots Dispatched

I have been seeing a large number of hits with the following User-Agent string in my logs lately:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5) Gecko/20031007 Firebird/0.7

1. **Firebird** hasn't existed as a browser for a very long time
2. A build date of October 7, 2003???
3. From 3 separate IP Addresses

This Apache

**REWRITE**

rule took care of this issue.

> RewriteCond %{HTTP_USER_AGENT} .*Gecko\/20031007.*
> RewriteRule ^.*$ http://www.pierzchala.com:9080/ [R,L,NS]

Try the URL...it points to this

**iptables**

rule.

> /sbin/iptables -A INPUT -p tcp -i eth0 -s 0/0 --dport 9080 -j DROP

I love Linux!