Infoseek?

Haven't seen them for a while...

[Kamikaze]

Hey, I just got pounded by this spider:

IP: 64.44.231.180
Referrer: none
User Agent: InfoSeek Sidewinder

But when you do a trace, it comes from darwin.net.
Checkdomain: Interquest Communications

Certainly doesn't look like Infoseek. But it literally POUNDED me overnight.

[littleman]

I'm a bit suspicious. The two bots I've seen lately are:
cca2607c.infoseek.com
204.162.96.124
InfoSeek Sidewinder/0.9

cca26224.infoseek.com
204.162.98.36
InfoSeek Sidewinder/0.9

NSlookup gives ya 180.X.X.X.user.darwin.net that looks like it could be a DSL connection.

[Froggyman]

I too have been hit with a similar spider.

A visitor from 180.x.x.x.user.darwin.net (64.44.231.180) arrived without a refering URL, and at 3:37:00 PM on Saturday, January 27, 2001. This visitor used InfoSeek Sidewinder.

[BoneHeadicus]

That user is bogus...it's sitting on a fat pipe.

Deep as I can get:

Recursive queries supported by this server
Query for 180.231.44.64.in-addr.arpa type=255 class=1
180.231.44.64.in-addr.arpa PTR (Pointer) 180.X.X.X.user.darwin.net
231.44.64.in-addr.arpa NS (Nameserver) dns1.sdf.vprlnk.net
231.44.64.in-addr.arpa NS (Nameserver) dns2.sdf.vprlnk.net
dns1.sdf.vprlnk.net A (Address) 209.119.92.10
dns2.sdf.vprlnk.net A (Address) 208.141.8.10

I have no idea what this means....

[Froggyman]

Agreed, the UA is false. 180.x.x.x.user.darwin.net shows up around November 2000 without the Infoseek Sidewinder UA. What's interesting is that out of the billions of pages on the web, our sites were hit by the same user.

[Fusioneer]

Hmm, see my post on Sidewinder here:
[webmasterworld.com...]

However my little friend did grab robots.txt and a single page (index.html) and came quite clearly out of infoseek.com.

Haven't seen him since.

[BoneHeadicus]

>>>180.231.44.64.in-addr.arpa PTR (Pointer) 180.X.X.X.user.darwin.net
231.44.64.in-addr.arpa NS (Nameserver) dns1.sdf.vprlnk.net
231.44.64.in-addr.arpa NS (Nameserver) dns2.sdf.vprlnk.net
Hey Fuse can you read this stuff..I dont know what I'm lookin at here...would love to know.

[Fusioneer]

Boneheadicus maximus -

Results below...

OK we are dealing with two separate visits here, Kamikaze's and littleman's.
For the record littleman's matches the spider I recorded across our sites.

Kamikaze spider
64.44.231.180
Resolves to 180.x.x.x.darwin.net through att.net
This looks VERY much like a broadband DSL user.
dns1.sdf.vprlnk.net & dns2.sdf.vprlnk.net are the nameservers for this domain,
vprlnk.net belonging to Vipernet which is now owned by Darwin.
This spider is NOT from Infoseek.

Littleman spiders [and mine]
204.162.96.124
Resolves to cca260c3.infoseek.com [mine]
Resolves to cca2607c.infoseek.com [littleman]
204.162.98.36
Resolves to cca26224.infoseek.com [littleman]
Interesting thing about this spider is that it comes from 2 nodes deeper tha usual
into Infoseek's network. They are perhaps testing a new variant.
These spiders ARE from Infoseek.

I haven't checked logs across all our sites but I am guessing Sidewinder will show
up elsewhere as well ;)

Infoseek own the following C class IP blocks:
BBN BARRNET, Inc. (NETBLK-NETBLK-BARRNET4) NETBLK-BARRNET4
204.160.0.0 - 204.163.255.255
Infoseek, Inc. (NETBLK-NETBLK-INFOSEEK2) NETBLK-INFOSEEK2
204.162.96.0 - 204.162.99.255

As you can see Kamikaze's spider doesn't fall anywhere in there as is obvious
and looks like a broadband user perhaps masquerading as a spider, draw your
own conclusions. ;)

[BoneHeadicus]

Fuse,
How did you get my last name? That must be quite some whois you use. ;)

Does the carrier help in determing what an Ip might be?

I see ALTER.net a lot, SPRINTLINK, etc. Some way of figuring what the user is based on this info?

[Kamikaze]

Thanks for the info guys. Yeah, I was pretty doubtful about that spider. Normally when Sidewinder comes by, they come by 3's or more. But this one was on it's own. I was just making sure since it literally squeezed the juice out of my server over night.