homepage Welcome to WebmasterWorld Guest from 23.20.220.79
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Become a Pro Member
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

    
Who/what is ns4006554.ip-198-27-80.net?
iomfan




msg:4608849
 12:58 am on Sep 11, 2013 (gmt 0)

ns4006554.ip-198-27-80.net has been visiting all sites of mine, including very recently established ones, so its visits appear to be not accidental but deliberate. Only the mainpages is accessed in each case.

This is a host, not a dynamic address, there is never a referer and only a generic browser description in the UA. This host appears to be located in Quebec, Canada (their homepage only shows the generic "Apache installed" information.

If anybody has more information I'd be interested in it. TIA :-)

 

keyplyr




msg:4608855
 1:29 am on Sep 11, 2013 (gmt 0)

Looks like OVH, a server farm based in Montreal, Canada (as well as France.) It's likely your intruder is one of their customers who is a bot runner.

jmccormac




msg:4608858
 2:03 am on Sep 11, 2013 (gmt 0)

Yep. Keyplyr beat me to it. It is an OVH range. There are at least six OVH ranges in North America.

Regards...jmcc

keyplyr




msg:4608866
 3:33 am on Sep 11, 2013 (gmt 0)


My OVH ban list:
5.39.0.0/17 #OVH 5.39.0.0 - 5.39.127.255
5.135.0.0/16 #OVH 5.135.0.0 - 5.135.255.255
8.7.244.0/24 #OVH 8.7.244.0 - 8.7.244.255
8.18.128.0/24 #OVH 8.18.128.0 - 8.18.128.255
8.18.136.0/21 #OVH 8.18.136.0 - 8.18.143.255
8.18.172.0/24 #OVH 8.18.172.0 - 8.18.172.255
8.20.110.0/24 #OVH 8.20.110.0 - 8.20.110.255
8.21.41.0/24 #OVH 8.21.41.0 - 8.21.41.255
8.24.8.0/21 #OVH 8.24.8.0 - 8.24.15.255
8.26.94.0/24 #OVH 8.26.94.0 - 8.26.94.255
8.29.224.0/24 #OVH 8.29.224.0 - 8.29.224.255
8.30.208.0/21 #OVH 8.30.208.0 - 8.30.215.255
8.33.96.0/21 #OVH 8.33.96.0 - 8.33.103.255
8.33.128.0/21 #OVH 8.33.128.0 - 8.33.135.255
8.33.136.0/24 #OVH 8.33.136.0 - 8.33.136.255
8.33.137.0/24 #OVH 8.33.137.0 - 8.33.137.255
37.59.0.0/16 #OVH 37.59.0.0 - 37.59.255.255
46.105.0.0/16 #OVH 46.105.0.0 - 46.105.255.255
77.111.192.0/18 #OVH 77.111.192.0 - 77.111.255.255
87.98.128.0/17 #OVH 87.98.128.0 - 87.98.255.255
91.121.0.0/16 #OVH 91.121.0.0 - 91.121.255.255
94.23.0.0/16 #OVH 94.23.0.0 - 94.23.255.255
109.190.0.0/16 #OVH 109.190.0.0 - 109.190.255.255
109.190.0.0/16 #OVH 109.190.0.0 - 109.190.255.255
142.4.192.0/19 #OVH 142.4.192.0 - 142.4.223.255
176.31.0.0/16 #OVH 176.31.0.0 - 176.31.255.255
178.32.0.0/15 #OVH 178.32.0.0 - 178.33.255.255
178.236.224.0/20 #OVH 178.236.224.0 - 178.236.239.255
188.165.0.0/16 #OVH 188.165.0.0 - 188.165.255.255
192.95.0.0/18 #OVH 192.95.0.0 - 192.95.63.255
192.99.0.0/16 #OVH 192.99.0.0 - 192.99.255.255
193.104.19.0/24 #OVH 193.104.19.0 - 193.104.19.255
198.27.64.0/18 #OVH 198.27.64.0 - 198.27.127.255
198.50.128.0/17 #OVH 198.50.128.0 - 198.50.255.255
198.100.144.0/20 #OVH 198.100.144.0 - 198.100.159.255
198.245.48.0/20 #OVH 198.245.48.0 - 198.245.63.255
213.186.32.0/19 #OVH 213.186.32.0 - 213.186.63.255 <=== iomfan, this is the range of your intruder
213.251.128.0/18 #OVH 213.251.128.0 - 213.251.191.255

dstiles




msg:4609078
 6:59 pm on Sep 11, 2013 (gmt 0)

Thanks, Didn't have any of the level3 rubbish. :( Why do I not trust so many small ranges?

I also have...

37.60.48.0 - 37.60.63.255

emailing services maintained by ovh.

and you give twice...
109.190.0.0 - 109.190.255.255

keyplyr




msg:4609111
 9:33 pm on Sep 11, 2013 (gmt 0)


Thanks, Didn't have any of the level3 rubbish. :( Why do I not trust so many small ranges?

At one point I had the Level3 8.0.0.0/8 blocked but soon found I was blocking numerous legit users. I now just block *that* Level3 at 8.28.16.0/23 and get the other companies therein on a case by case basis, as with OVH, to which it appears they have gradually been piecemeal acquiring the smaller subs .

I also have...

37.60.48.0 - 37.60.63.255

emailing services maintained by ovh.

Thanks


and you give twice...
109.190.0.0 - 109.190.255.255

Cut'n paste awkwardness, which I can legitimately blame on a poorly functioning IR mouse :)

iomfan




msg:4618255
 2:01 am on Oct 22, 2013 (gmt 0)

Thanks for the info...! :)

Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved