homepage Welcome to WebmasterWorld Guest from 54.227.160.102
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor 2014
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
block whole countries
best tool to lookup IP ranges
smallcompany

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3872724 posted 9:31 pm on Mar 17, 2009 (gmt 0)

I see that the ranges 59.56.109.x and 59.56.110.x are hitting me with requesting other IP addresses and files like prxjdg.cgi (some proxy judge ?)

Since I have no customers that would belong to those specific ranges (China), I thought I could start blocking countries.

I wonder what would be the best online tool (site) for finding where a certain IP range belongs.

Thanks

 

phred

5+ Year Member



 
Msg#: 3872724 posted 10:24 am on Mar 18, 2009 (gmt 0)

. misunderstood the question.

wilderness

WebmasterWorld Senior Member wilderness us a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



 
Msg#: 3872724 posted 3:13 pm on Mar 18, 2009 (gmt 0)

In the event that your merely attempting to ID a single range?
Use an assortment of ARIN, RIPE and APNIC.
Check ARIN first and the result will provide if another registrar is necessary.

In the event that your looking to obtain ALL IP's for a specific country try a geo targeting database [ip2location.com] ?

edited by wilderness:

Some similar threads.

[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]

dstiles

WebmasterWorld Senior Member dstiles us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 3872724 posted 8:58 pm on Mar 18, 2009 (gmt 0)

I use Sam Spade - the download, not the web site - to determine IP ranges. Unfirtunately it falls down on getting details of sub-ranges of many of the Asian blocks, although it gives complete ranges.

I've been getting an increasing number of Chinese scrapes and bots during the past few weeks and I'm also looking into country-blocking on my server. In my case I have to worry about a few of my clients who actually trade in Asia, South Americe and Russia, so I'll have to offer blocking opt-out on a site basis.

Mokita

5+ Year Member



 
Msg#: 3872724 posted 10:04 pm on Mar 18, 2009 (gmt 0)

The very best way to get APNIC ranges is to go to APNIC itself. That way you know that they are 100% accurate and up-to-date.

Here is the link for China:

[apnic.net...]

To find ranges for other Asian countries just change the two letter country code on the end of the URL to tw, jp, th, in, or vn etc.

[edited by: Mokita at 10:39 pm (utc) on Mar. 18, 2009]

Lazlo

5+ Year Member



 
Msg#: 3872724 posted 11:37 pm on Mar 18, 2009 (gmt 0)


Thanks Mokita.

smallcompany

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3872724 posted 4:07 am on Mar 19, 2009 (gmt 0)

Thanks to everyone.

I assume that there are no cases where IP range would change from one to another country. Sounds totally impossible, but I could not resist asking.

dstiles

WebmasterWorld Senior Member dstiles us a WebmasterWorld Top Contributor of All Time 5+ Year Member



 
Msg#: 3872724 posted 4:28 am on Mar 19, 2009 (gmt 0)

There are some annoyances that work cross-country - eg netdirekt - and I've seen a few small blocks in the wrong country: US seems to do that quite a bit. Generally small stuff and I wouldn't expect the exploit countries to have anything serious. Watch for the big-3 SE bots coming in from china etc.

smallcompany

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3872724 posted 4:32 am on Mar 19, 2009 (gmt 0)

So, it would still be the best to block just the ranges found "guilty"?

I asked all the questions in this thread as I'm annoyed by mostly injection requests and attacks like onto PHPadmin where I see some IP ranges kind of repeating.

blend27

WebmasterWorld Senior Member 5+ Year Member



 
Msg#: 3872724 posted 12:22 pm on Mar 19, 2009 (gmt 0)


or simply compile 2 DBs (whitelisted and not) from

ftp://ftp.apnic.net/pub/stats/afrinic/delegated-afrinic-latest
ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest
ftp://ftp.lacnic.net/pub/stats/lacnic/delegated-lacnic-latest
ftp://ftp.arin.net/pub/stats/arin/delegated-arin-latest

every few weeks or so for the countries that we do bussness with.

--netdirekt--
not to hijack the thread but always ment to ask: are humans using that ISP at all?

thetrasher

5+ Year Member



 
Msg#: 3872724 posted 3:40 pm on Mar 19, 2009 (gmt 0)

Watch out, some RIR database entries are wrong. Example: 62.109/19 does not belong to a company from LU = Luxembourg as stated, no, it is RU = Russia! As what I see, there are more and more false/fake entries in RIR databases, especially at RIPE NCC.

Additionally, some US/European providers offer US/European IPs for Chinese companies. And if someone is using a satellite connection, you may only locate the provider, so that US and European IPs may be used by i.e. Nigerians.

I assume that there are no cases where IP range would change from one to another country.
Well, wrong ;)

  1. Any "owner" of an IP range can modify the database entry freely (see above).
  2. A company can buy a competitor from another country. As a result, RIR database entries may change.
  3. IP ranges can be reassigned to another country. Example: 213.6/15 was assigned to a German provider, but since 2006 213.6/16 belongs to a Palestinian company and 213.7/16 belongs to a company from Cyprus.
  4. Subsidiary companies may share an IP range. Example: 213.100/14 belongs to a Swedish company. Subranges go to subsidiaries (Russia, Estonia, Germany, Austria, Switzerland, Netherlands, Spain, Portugal, ...) and may change anytime.
  5. IP subranges and single IPs assigned to a customer from another country may be given in the databases - or not. Sometimes you can get additional informations about ARIN IPs through RWhois, sometimes not.

ftp://ftp.ripe.net/ripe/stats/delegated-ripencc-latest
I found some inconsistencies between "delegated" and RIR database data. I remember that some IP ranges were delegated to other countries than mentioned in the RIPE database, i.e. RU was delegated to DE.

Here is the link for China:

http://www.apnic.net/apnic-bin/ipv4-by-country.pl?country=cn

These are only official Chinese IP ranges in Asia (APNIC). China is in Europe, too. Example: 91.196.232/22 (see also spamhaus.org, ROK7829: Russian Business Network - The Russians go "Chinese")

--netdirekt--
not to hijack the thread but always ment to ask: are humans using that ISP at all?
German server farm. There are not many humans in a data center.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved