homepage Welcome to WebmasterWorld Guest from 54.224.179.98
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
Is this INK???
Korean INK???
Kamikaze




msg:403134
 3:39 pm on Jun 22, 2000 (gmt 0)

IP: 211.169.241.21
User Agent: Slurp/si (slurp@inktomi.com; [inktomi.com...]

This came from Asia Pacific Network Information Center (of Korea). But it claims to be Ink spider!!!

 

littleman




msg:403135
 4:02 pm on Jun 22, 2000 (gmt 0)

Well,
It looks like a fake to me. Did it pull the robots.txt? I got this from whois.nic.or.kr:
1. 회원 ISP 기관정보
1a. 한글 기관명 : 데이콤
1b. 영문 기관명 : DACOM Corporation
1c. 한글서비스명 : 보라넷
1d. 영문서비스명 : BORANET
1e. 기관 주소 : 강남구 역삼동 706-1 DACOM빌딩

2. 실무책임자 인물정보
2a. 한글 이름 : 홍걸표
2b. 영문 이름 : Kulpyo Hong
2c. 전화번호 : 02-6220-7755
2d. 팩스번호 : 02-6220-0312
2e. 전자우편주소 : ipadm@bora.net

3. IP담당자 인물정보
3a. 한글 이름 : 하태선
3b. 영문 이름 : Taeseon Ha
3c. 전화번호 : 02-6220-7755
3d. 팩스번호 : 02-6220-0312
3e. 전자우편주소 : ipadm@bora.net
check out [bora.net...]

Kamikaze




msg:403136
 4:46 pm on Jun 22, 2000 (gmt 0)

Yup, it pulled my robots.txt file. Hmmm....

littleman




msg:403137
 8:52 pm on Jun 22, 2000 (gmt 0)

I just was digging through my logs that IP has hit some of my sites. So odds are it is from inktomi! Sneaky bastards!

fantomaster




msg:403138
 2:41 am on Jun 23, 2000 (gmt 0)

It's been on our sites and those of our clients, too. We have tentatively categorized it as an Ink spider based on its behavior and UA, thought IMO it still looks rather fishy.

Brett_Tabke




msg:403139
 2:43 am on Jun 23, 2000 (gmt 0)

Well, they say ink is down there in Aus building it's directory of south east asian sites. Soule would be a natural place between Japan and China. But makes little sense that they would spider for ink to the US from soul e over international lines though - the lag would be killer at times.

fantomaster




msg:403140
 2:46 am on Jun 23, 2000 (gmt 0)

Yes, we're aware of that, of course. But what we've seen up until this one came from Japan. Which begs the question why they would switch to Korea now, unless perhaps they're splitting operations up further?

littleman




msg:403141
 3:31 am on Jun 23, 2000 (gmt 0)

I know it does smell a little. I tried the usual proxy ports (80, 8080, 3128, 1080), just to cover the obvious. It did only call my root domains. Still, I bet most of us have had the idea of building a spider to mimic Slurp and put it through an
obscure IP in a south asian country.

Still...
6/20/100 - 15:29:55, GET 211.169.241.21 Slurp/si (slurp@inktomi.com; [inktomi.com...]
6/20/100 - 15:30:09, GET 211.169.241.21 Slurp/si (slurp@inktomi.com; [inktomi.com...]

It made these requests for a domain I have all but given up on. This site was booted out of Ink months ago, but I still have this site auto-submit to watch for patters. If this spider is a fake it would have had to record data form ink listings six
months ago. At this point it is in my db.


fantomaster




msg:403142
 3:35 am on Jun 23, 2000 (gmt 0)

Great, littleman, that's exactly the sort of corroboration required in such a case.
So we can take it then as a somewhat smelly but nevertheless established Ink spider to be monitored for further antics. :)

Brett_Tabke




msg:403143
 4:08 am on Jun 23, 2000 (gmt 0)

Well, I've searched most of the places I can think of, and can't find any reference to a se in Korea using Ink. (not on the pr newswire anyway). I thought maybe Ink was custom building a db/directory for someone over there that would explain it.

Japan I can certainly see with the Ink/Goo relationship.

That just doesn't register with me, that Ink would do this to circumvent cloaking - that is getting serious. Why would they even bother to us Slurp for an agent name?

fantomaster




msg:403144
 4:25 am on Jun 23, 2000 (gmt 0)

That's why it's most probably not cloaked - and why everyone seemed to think it's bogus in the first place.
You may be right - if they are db building for a special, new or yet undisclosed client, this is one way it could happen. Then again it might be something experimental. Now if only we had a second high caliber confirmation like littleman's from another source ...


Brett_Tabke




msg:403145
 4:32 am on Jun 23, 2000 (gmt 0)

Gimmie a few hours. I'm at home with a dreadfully slow dsl tonight, and need to wait for those ahem napster files to finish)... (he says as he is in the middle of making a reply about copyrights in another forum - oh that hurts).

What's the supposid time frame on this? How far back do I need to go?

fantomaster




msg:403146
 4:41 am on Jun 23, 2000 (gmt 0)

First notification from client was:
Tue, 20 Jun 2000 05:51:25 UTC -0700

Will see what we can come up with later from our
own logs, but I'll be going offline soon and won't be back before appr. 18 hours from now.

Kamikaze




msg:403147
 5:14 am on Jun 23, 2000 (gmt 0)

Can anyone read Korean? Tee hee...
[inktomikorea.co.kr...]

I've already emailed a few people working there. No reply so far. Wish me luck...

Brett_Tabke




msg:403148
 7:36 am on Jun 23, 2000 (gmt 0)

That is good enough for me. How'd you find that one?

littleman




msg:403149
 8:03 am on Jun 23, 2000 (gmt 0)

Good find Kamikaze! I'm also curious to know how you came across it. Sorry about the long length of the lookup, but I think there is some interesting info here.


# ENGLISH

Domain Name : INKTOMIKOREA.CO.KR
Org/Person Name : BUM HO TRADING CO.
Org Address : 77-17 YOCKCHON-DONG, EUNPYUNG-GU, SEOUL, KOREA
Zip Code : 122-070
Point of Contact : SEONG BAE JIN
Telephone : 02-562-8666
E-Mail : JKLEE@INKTOMI.COM
Registed Date : 19990331
Updated Date : 20000512
Valid Date : 20001015

Primary Name Server
Host Name : ns.inktomikorea.co.kr
IP Address : 211.112.6.77

Secondary Name Server
Host Name : elim.net
IP Address :
Host Name : prmns.lg.co.kr
IP Address : 165.243.5.15

Brett_Tabke




msg:403150
 8:19 am on Jun 23, 2000 (gmt 0)

Ink & Adero [inktomi.com]

Notice where Adero is at on the planet...

------------- import
About Adero

Founded in 1998, Adero provides a global turnkey service that enables companies to provide their online audiences a quick, consistent, and reliable experience anywhere in the world. Adero's network of intelligent nodes and patent-pending GeoTraffic Manager technology allows companies to overcome the complexities of building and managing infrastructure in foreign markets, as well as reap the benefits of improved Web site performance and custom-tailored content. Adero provides enhanced service directly to more than 97% of the world's Internet users and has nodes in 19 countries, including Argentina, Australia, Brazil, Canada, China, Columbia, France, Germany, Hong Kong, Italy, Japan, The Netherlands, Singapore, Spain, Sweden, South Korea, Taiwan, United Kingdom, and the United States. Adero, Inc., www.adero.com, is a venture-funded company headquartered in Cambridge, Massachusetts, USA.
--------

fantomaster




msg:403151
 12:56 pm on Jun 23, 2000 (gmt 0)

Here's further proof positive: one typical behavior of many Ink spiders is their duplicate page calls in rapid succession. This spider is doing the same.

Here's some log entries from various domains we are monitoring:

d#1:
211.169.241.21 - - [21/Jun/2000:20:17:07 -0700] "GET /robots.txt HTTP/1.0" 200 53
211.169.241.21 - - [21/Jun/2000:20:17:27 -0700] "GET / HTTP/1.0" 200 4698
211.169.241.21 - - [21/Jun/2000:20:17:47 -0700] "GET / HTTP/1.0" 200 4698

d#2:
211.169.241.21 - - [20/Jun/2000:14:45:17 -0700] "GET /robots.txt HTTP/1.0" 200 410
211.169.241.21 - - [20/Jun/2000:14:45:43 -0700] "GET / HTTP/1.0" 200 18346

d#3:
211.169.241.21 - - [21/Jun/2000:14:34:39 -0700] "GET /robots.txt HTTP/1.0" 200 657
211.169.241.21 - - [21/Jun/2000:14:34:56 -0700] "GET / HTTP/1.0" 200 25462
211.169.241.21 - - [21/Jun/2000:14:35:09 -0700] "GET / HTTP/1.0" 200 25462

d#4:
211.169.241.21 - - [21/Jun/2000:14:50:16 -0700] "GET /robots.txt HTTP/1.0" 200 185
211.169.241.21 - - [21/Jun/2000:14:50:31 -0700] "GET / HTTP/1.0" 200 20307
211.169.241.21 - - [21/Jun/2000:14:50:48 -0700] "GET / HTTP/1.0" 200 20307

d#5:
211.169.241.21 - - [21/Jun/2000:10:08:25 -0700] "GET /robots.txt HTTP/1.0" 200 148
211.169.241.21 - - [21/Jun/2000:10:08:51 -0700] "GET / HTTP/1.0" 200 51576

d#6:
211.169.241.21 - - [20/Jun/2000:16:13:06 -0700] "GET /robots.txt HTTP/1.0" 200 57
211.169.241.21 - - [20/Jun/2000:16:13:14 -0700] "GET / HTTP/1.0" 200 852
211.169.241.21 - - [20/Jun/2000:16:13:24 -0700] "GET / HTTP/1.0" 200 852

----------------

Some examples of duplicate calls:

d#1:
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET / HTTP/1.0" 200 4698
si3002.inktomi.com - - [17/Jun/2000:22:31:18 -0700] "GET / HTTP/1.0" 200 4698

si3003.inktomi.com - - [18/Jun/2000:15:32:40 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3003.inktomi.com - - [18/Jun/2000:15:32:41 -0700] "GET / HTTP/1.0" 200 4698
si3003.inktomi.com - - [18/Jun/2000:15:32:42 -0700] "GET / HTTP/1.0" 200 4698


fantomaster




msg:403152
 12:57 pm on Jun 23, 2000 (gmt 0)

I like that: "BUM HO TRADING CO." ... :)

Kamikaze




msg:403153
 3:38 pm on Jun 23, 2000 (gmt 0)

Awesome! Great work Fantomaster! Now this is the kind of numbers I like to see...

Brett_Tabke




msg:403154
 7:48 pm on Jun 23, 2000 (gmt 0)

And if you need further confirmation, try this:

Inktomi Launche Korea Search Services [biz.yahoo.com].

NFFC




msg:403155
 10:29 pm on Jun 23, 2000 (gmt 0)

Not Korean and you probably all know but:

Mozilla/4.72 [en] (X11; U; NetBSD 1.4.2 i386; Nav)


Kamikaze




msg:403156
 9:11 pm on Jun 24, 2000 (gmt 0)

NFFC, do you have the IP for that?

littleman




msg:403157
 10:23 pm on Jun 24, 2000 (gmt 0)

Name: j6000.inktomi.com - Address: 209.185.141.185

Its UA was Slurp/3.0-AU.

NFFC




msg:403158
 12:40 pm on Jun 25, 2000 (gmt 0)

Just to confirm the same IP as littleman.

Visited this am on another domain.

Brett_Tabke




msg:403159
 3:37 am on May 15, 2001 (gmt 0)

Does anyone still get hits from the Korean Ink sites? I've not seen one that I remember in quite awhile.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved