homepage Welcome to WebmasterWorld Guest from 54.196.225.45
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member

Visit PubCon.com
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
Bot from IANA
nativenewyorker




msg:3982854
 6:36 pm on Sep 2, 2009 (gmt 0)

Visitor IP: 216.25.247.###

Referrer: htt#://172.22.0.###:8827/sps0/nov_dev_id###########################################/snapshot/#########/#

User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20071121 Firefox/1.5

I saw this strange referrer in my raw logs. The reverse IP for 172.22.0.### shows it belongs to IANA (Internet Assigned Numbers Authority). Why would IANA be crawling my site to build what appears to be an archive? Government sponsored snooping?

 

dstiles




msg:3983024
 9:21 pm on Sep 2, 2009 (gmt 0)

It's not. That range of IPs (and others such as 10.x.x.x - check IANA for a full range) are for internal networks - ie intranets or office nets. Your own computer will use one of them; if you have several networked together they all will have a different one.

What you're probably seeing is some local application running on a desktop that is being used to trigger the browser (Firefox in this case). Could be something like Word, Acrobat, a mail client...

I get several hits daily from a file DesktopDefault.aspx; although this has a real domain name behind it it's essentially the same thing. Also several from desktop copies of Acrobat that pretend to come from the Acrobat reader download page - blatant advertising!

caribguy




msg:3983030
 9:37 pm on Sep 2, 2009 (gmt 0)

Do you have a lot of pictures on your site? A search on the port number and the base directory brings up many Awstat etc. logs for sites that look as if they could be adult themed. Did not click on any of the results...

Looks like an image downloader. The ip address you're seeing is probably that of an internal network.

nativenewyorker




msg:3983206
 6:24 am on Sep 3, 2009 (gmt 0)

It's definitely not related to a local application. I do not use WYSIWYG editors and do not have any applications that contain links to the site other than my FireFox 3.5 browser.

I'm also running an M$ box and not Linux. User-Agent strings with Linux suggest that the visitor is a bot.

No, the site doesn't contain lots of images. I ran the same search for port number and base directory. The search results contain lots of different types of sites including .gov and .edu, so it doesn't look like there is focus toward a particular type of site.

janharders




msg:3983207
 6:35 am on Sep 3, 2009 (gmt 0)

Since 172.* is, as stated, reserved for internal networks, and it's the referer, I'd say its a user (or bot that submit referers) that clicked on a link or viewed an image from a local service. IANA is not crawling your site, Trans World Internet eXchange, LLC. is, they are the ones the originating IP belongs to.

caribguy




msg:3983462
 5:12 pm on Sep 3, 2009 (gmt 0)

Should have clarified: local application as in local to the user/bot who is accessing your site. Google Desktop Search has a similar footprint.

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved