Ask/Teoma or UUNET Spoofer?

How to find what NETRANGES a Co. Owns?

[Friday]

I hope someone can help clear this up for me; I've been searching fruitlessly for weeks.

As an independant SEO, a large part of my daily routine involves monitoring/validating IP Addresses of Search Engine spiders, then adding/deleting them to/from my database as warranted (I usse cloaking for about 25% of my clients).

A major problem, lately, is determing whether AskJeeves/Teoma spiders are valid or spoofed user_agants spying on my clients from UUNET and/or Quest IP addresses.

In a best-case scenario, a WHOIS for an ASK/Teoma IP turns up the following...

############################################
UUNET Technologies, Inc. UUNET65 (NET-65-192-0-0-1)
65.192.0.0 - 65.223.255.255
AskJeeves, Inc. UU-65-214-36 (NET-65-214-36-0-1)
65.214.36.0 - 65.214.39.255
###########################################

... giving me a handy list of NetRanges to reference.


More often than noit, however, all I get is...
####################################
OrgName: UUNET Technologies, Inc.
OrgID: UU
Address: 22001 Loudoun County Parkway
City: Ashburn
StateProv: VA
PostalCode: 20147
Country: US
######################################

.....etc.
Not very useful at all.
:-(
(Sometimes valid [and invalid] ASK/Teoma IPs are listed under "Quest" as well).

1) Is there a way to find out exactly what NetRange(s) a company owns (e.g.: AskJeeves, Teoma, Yahoo, etc.), without first having a valid IP from that range to do a WHOIS on?
For example, if I wanted to know what netrange was owned by XYZ company, is there a way to look that up? i.e.: is there a directory where I could enter "XYZ Corp," and get a list of NETRANGES they own?

2) Given the Ask/UUNet dilemna, how can I tell which UUNET IPs are indeed valid Ask/Teoma spiders?

TIA!
:-)

[wilderness]

NOT sure why you felt the need to start a new thread?
Why not just continue under the same subject thread you previously started?

is there a way to look that up? i.e.: is there a directory where I could enter "XYZ Corp," and get a list of NETRANGES they own?

ARIN, however your need to begin your search with thw exact name as privided by a previous inquiry.

EX:
InfoLink (as discussed in this thread
[webmasterworld.com...]

Go to ARIN and copy in InfoLink or whatever name you have previously obtianed.

BTW Jeeves is very low on providing traffic to my sites. IMO spending time determining their IP's is a waste of time.

[volatilegx]

NOT sure why you felt the need to start a new thread?
Why not just continue under the same subject thread you previously started?

Oops my fault. I moved this post here and forgot there was already a similar post. The threads are now combined (see below).

[edited by: volatilegx at 8:24 pm (utc) on June 27, 2005]

[Friday]

Whenever doing a (Arin.net) WHOIS on an AskJeeves user agent, it retunrs: "UUNET."

Sometimes it will actually say, in addition to UUNET, "AskJeeves.". Othertimes it does not.

I've accumulated some BAD IP Addresses in my database for Ask/Teoma this way and I've missed out on some good ones.

How can I tell which visitiors are really from Ask/Teoma and whioch are spoofing the user_agent from a UUNET IP?

PS: Sometimes I also get "Quest" as a result of a WHOIS, with the same dilemna as UUNET results: some are "real" ands some are not.

8-P

Any opinions/suggestions (or even facts) would be much appreciated.

[volatilegx]

Have you tried reverse DNS lookups? These can be done in large batches with a program like NS-Batch.

[wilderness]

Having has many of my pages spidered in the previous two hours last night from the normal Jeeves Bot (65.214.44.195)

The following visitor appeared with no robots and ALL page images.

65.214.32.173 - - [30/Jun/2005:04:05:55 -0700] "GET /myfolder/mypage.html HTTP/1.1" 200 46826 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)"

Is it spoofed or faked?
I have no idea, the IP does route to Jeeves under UU.

Hope this helps

Don

edit: correct IP typo.

[Dijkgraaf]

Using a reverse lookup site, yes the results indicated that the range is part of UUNet's network, and that that IP address is part of the range assigned to AskJeeves.

UUNET Technologies, Inc. UUNET65 (NET-65-192-0-0-1)
65.192.0.0 - 65.223.255.255
AskJeeves, Inc. UU-65-214-32-128 (NET-65-214-32-128-1)
65.214.32.128 - 65.214.32.255

So no it doesn't look like a spoof.

[volatilegx]

I just added a bunch of Ask Jeeves/Teoma IPs to my SE spider list, and although they are slightly outside the ranges being discussed here, this is what I added:

# Ask Jeeves/Teoma
65.214.45.10
65.214.45.11
65.214.45.12
65.214.45.13
65.214.45.14
65.214.45.15
65.214.45.16
65.214.45.17
65.214.45.18
65.214.45.19
65.214.45.2
65.214.45.20
65.214.45.21
65.214.45.22
65.214.45.23
65.214.45.24
65.214.45.25
65.214.45.26
65.214.45.27
65.214.45.28
65.214.45.29
65.214.45.3
65.214.45.30
65.214.45.31
65.214.45.32
65.214.45.33
65.214.45.34
65.214.45.35
65.214.45.36
65.214.45.37
65.214.45.38
65.214.45.39
65.214.45.4
65.214.45.40
65.214.45.41
65.214.45.42
65.214.45.43
65.214.45.44
65.214.45.45
65.214.45.46
65.214.45.47
65.214.45.48
65.214.45.49
65.214.45.5
65.214.45.50
65.214.45.51
65.214.45.6
65.214.45.7
65.214.45.8
65.214.45.9

[wilderness]

65.214.36.20 - - [03/Jul/2005:02:02:21 -0700] "GET /myfolder/mypage.htm HTTP/1.1" 403 - "-" "libwww-perl/5.803"

Guess it's possible. Not likely.

[Friday]

Thanks for all the replies.

BTW:
Here is what I have uncovered so far as BONIFIED, verifiable netranges for Jeeves/Teoma:

65.214.32.128 - 65.214.32.255
65.214.36.0 - 65.214.39.255
64.55.148.1 - 64.55.149.255
65.214.45.0 - 65.214.45.51
65.214.44.30 - 65.214.44.255

Friday