Welcome to WebmasterWorld Guest from 174.129.96.175

Forum Moderators: Ocean10000 & incrediBILL

Is this INK???

Korean INK???

   
3:39 pm on Jun 22, 2000 (gmt 0)

10+ Year Member



IP: 211.169.241.21
User Agent: Slurp/si (slurp@inktomi.com; [inktomi.com...]

This came from Asia Pacific Network Information Center (of Korea). But it claims to be Ink spider!!!

4:02 pm on Jun 22, 2000 (gmt 0)

WebmasterWorld Senior Member littleman is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Well,
It looks like a fake to me. Did it pull the robots.txt? I got this from whois.nic.or.kr:
1. 회원 ISP 기관정보
1a. 한글 기관명 : 데이콤
1b. 영문 기관명 : DACOM Corporation
1c. 한글서비스명 : 보라넷
1d. 영문서비스명 : BORANET
1e. 기관 주소 : 강남구 역삼동 706-1 DACOM빌딩

2. 실무책임자 인물정보
2a. 한글 이름 : 홍걸표
2b. 영문 이름 : Kulpyo Hong
2c. 전화번호 : 02-6220-7755
2d. 팩스번호 : 02-6220-0312
2e. 전자우편주소 : ipadm@bora.net

3. IP담당자 인물정보
3a. 한글 이름 : 하태선
3b. 영문 이름 : Taeseon Ha
3c. 전화번호 : 02-6220-7755
3d. 팩스번호 : 02-6220-0312
3e. 전자우편주소 : ipadm@bora.net
check out [bora.net...]

4:46 pm on Jun 22, 2000 (gmt 0)

10+ Year Member



Yup, it pulled my robots.txt file. Hmmm....
8:52 pm on Jun 22, 2000 (gmt 0)

WebmasterWorld Senior Member littleman is a WebmasterWorld Top Contributor of All Time 10+ Year Member



I just was digging through my logs that IP has hit some of my sites. So odds are it is from inktomi! Sneaky bastards!
2:41 am on Jun 23, 2000 (gmt 0)

10+ Year Member



It's been on our sites and those of our clients, too. We have tentatively categorized it as an Ink spider based on its behavior and UA, thought IMO it still looks rather fishy.
2:43 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Well, they say ink is down there in Aus building it's directory of south east asian sites. Soule would be a natural place between Japan and China. But makes little sense that they would spider for ink to the US from soul e over international lines though - the lag would be killer at times.
2:46 am on Jun 23, 2000 (gmt 0)

10+ Year Member



Yes, we're aware of that, of course. But what we've seen up until this one came from Japan. Which begs the question why they would switch to Korea now, unless perhaps they're splitting operations up further?
3:31 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Senior Member littleman is a WebmasterWorld Top Contributor of All Time 10+ Year Member



I know it does smell a little. I tried the usual proxy ports (80, 8080, 3128, 1080), just to cover the obvious. It did only call my root domains. Still, I bet most of us have had the idea of building a spider to mimic Slurp and put it through an
obscure IP in a south asian country.

Still...
6/20/100 - 15:29:55, GET 211.169.241.21 Slurp/si (slurp@inktomi.com; [inktomi.com...]
6/20/100 - 15:30:09, GET 211.169.241.21 Slurp/si (slurp@inktomi.com; [inktomi.com...]

It made these requests for a domain I have all but given up on. This site was booted out of Ink months ago, but I still have this site auto-submit to watch for patters. If this spider is a fake it would have had to record data form ink listings six
months ago. At this point it is in my db.

3:35 am on Jun 23, 2000 (gmt 0)

10+ Year Member



Great, littleman, that's exactly the sort of corroboration required in such a case.
So we can take it then as a somewhat smelly but nevertheless established Ink spider to be monitored for further antics. :)
4:08 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Well, I've searched most of the places I can think of, and can't find any reference to a se in Korea using Ink. (not on the pr newswire anyway). I thought maybe Ink was custom building a db/directory for someone over there that would explain it.

Japan I can certainly see with the Ink/Goo relationship.

That just doesn't register with me, that Ink would do this to circumvent cloaking - that is getting serious. Why would they even bother to us Slurp for an agent name?

4:25 am on Jun 23, 2000 (gmt 0)

10+ Year Member



That's why it's most probably not cloaked - and why everyone seemed to think it's bogus in the first place.
You may be right - if they are db building for a special, new or yet undisclosed client, this is one way it could happen. Then again it might be something experimental. Now if only we had a second high caliber confirmation like littleman's from another source ...

4:32 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Gimmie a few hours. I'm at home with a dreadfully slow dsl tonight, and need to wait for those ahem napster files to finish)... (he says as he is in the middle of making a reply about copyrights in another forum - oh that hurts).

What's the supposid time frame on this? How far back do I need to go?

4:41 am on Jun 23, 2000 (gmt 0)

10+ Year Member



First notification from client was:
Tue, 20 Jun 2000 05:51:25 UTC -0700

Will see what we can come up with later from our
own logs, but I'll be going offline soon and won't be back before appr. 18 hours from now.

5:14 am on Jun 23, 2000 (gmt 0)

10+ Year Member



Can anyone read Korean? Tee hee...
[inktomikorea.co.kr...]

I've already emailed a few people working there. No reply so far. Wish me luck...

7:36 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



That is good enough for me. How'd you find that one?
8:03 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Senior Member littleman is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Good find Kamikaze! I'm also curious to know how you came across it. Sorry about the long length of the lookup, but I think there is some interesting info here.


# ENGLISH

Domain Name : INKTOMIKOREA.CO.KR
Org/Person Name : BUM HO TRADING CO.
Org Address : 77-17 YOCKCHON-DONG, EUNPYUNG-GU, SEOUL, KOREA
Zip Code : 122-070
Point of Contact : SEONG BAE JIN
Telephone : 02-562-8666
E-Mail : JKLEE@INKTOMI.COM
Registed Date : 19990331
Updated Date : 20000512
Valid Date : 20001015

Primary Name Server
Host Name : ns.inktomikorea.co.kr
IP Address : 211.112.6.77

Secondary Name Server
Host Name : elim.net
IP Address :
Host Name : prmns.lg.co.kr
IP Address : 165.243.5.15

8:19 am on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Ink & Adero [inktomi.com]

Notice where Adero is at on the planet...

------------- import
About Adero

Founded in 1998, Adero provides a global turnkey service that enables companies to provide their online audiences a quick, consistent, and reliable experience anywhere in the world. Adero's network of intelligent nodes and patent-pending GeoTraffic Manager technology allows companies to overcome the complexities of building and managing infrastructure in foreign markets, as well as reap the benefits of improved Web site performance and custom-tailored content. Adero provides enhanced service directly to more than 97% of the world's Internet users and has nodes in 19 countries, including Argentina, Australia, Brazil, Canada, China, Columbia, France, Germany, Hong Kong, Italy, Japan, The Netherlands, Singapore, Spain, Sweden, South Korea, Taiwan, United Kingdom, and the United States. Adero, Inc., www.adero.com, is a venture-funded company headquartered in Cambridge, Massachusetts, USA.
--------

12:56 pm on Jun 23, 2000 (gmt 0)

10+ Year Member



Here's further proof positive: one typical behavior of many Ink spiders is their duplicate page calls in rapid succession. This spider is doing the same.

Here's some log entries from various domains we are monitoring:

d#1:
211.169.241.21 - - [21/Jun/2000:20:17:07 -0700] "GET /robots.txt HTTP/1.0" 200 53
211.169.241.21 - - [21/Jun/2000:20:17:27 -0700] "GET / HTTP/1.0" 200 4698
211.169.241.21 - - [21/Jun/2000:20:17:47 -0700] "GET / HTTP/1.0" 200 4698

d#2:
211.169.241.21 - - [20/Jun/2000:14:45:17 -0700] "GET /robots.txt HTTP/1.0" 200 410
211.169.241.21 - - [20/Jun/2000:14:45:43 -0700] "GET / HTTP/1.0" 200 18346

d#3:
211.169.241.21 - - [21/Jun/2000:14:34:39 -0700] "GET /robots.txt HTTP/1.0" 200 657
211.169.241.21 - - [21/Jun/2000:14:34:56 -0700] "GET / HTTP/1.0" 200 25462
211.169.241.21 - - [21/Jun/2000:14:35:09 -0700] "GET / HTTP/1.0" 200 25462

d#4:
211.169.241.21 - - [21/Jun/2000:14:50:16 -0700] "GET /robots.txt HTTP/1.0" 200 185
211.169.241.21 - - [21/Jun/2000:14:50:31 -0700] "GET / HTTP/1.0" 200 20307
211.169.241.21 - - [21/Jun/2000:14:50:48 -0700] "GET / HTTP/1.0" 200 20307

d#5:
211.169.241.21 - - [21/Jun/2000:10:08:25 -0700] "GET /robots.txt HTTP/1.0" 200 148
211.169.241.21 - - [21/Jun/2000:10:08:51 -0700] "GET / HTTP/1.0" 200 51576

d#6:
211.169.241.21 - - [20/Jun/2000:16:13:06 -0700] "GET /robots.txt HTTP/1.0" 200 57
211.169.241.21 - - [20/Jun/2000:16:13:14 -0700] "GET / HTTP/1.0" 200 852
211.169.241.21 - - [20/Jun/2000:16:13:24 -0700] "GET / HTTP/1.0" 200 852

----------------

Some examples of duplicate calls:

d#1:
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET / HTTP/1.0" 200 4698
si3002.inktomi.com - - [17/Jun/2000:22:31:18 -0700] "GET / HTTP/1.0" 200 4698

si3003.inktomi.com - - [18/Jun/2000:15:32:40 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3003.inktomi.com - - [18/Jun/2000:15:32:41 -0700] "GET / HTTP/1.0" 200 4698
si3003.inktomi.com - - [18/Jun/2000:15:32:42 -0700] "GET / HTTP/1.0" 200 4698

12:57 pm on Jun 23, 2000 (gmt 0)

10+ Year Member



I like that: "BUM HO TRADING CO." ... :)
3:38 pm on Jun 23, 2000 (gmt 0)

10+ Year Member



Awesome! Great work Fantomaster! Now this is the kind of numbers I like to see...
7:48 pm on Jun 23, 2000 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



And if you need further confirmation, try this:

Inktomi Launche Korea Search Services [biz.yahoo.com].

10:29 pm on Jun 23, 2000 (gmt 0)

WebmasterWorld Senior Member nffc is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Not Korean and you probably all know but:

Mozilla/4.72 [en] (X11; U; NetBSD 1.4.2 i386; Nav)

9:11 pm on Jun 24, 2000 (gmt 0)

10+ Year Member



NFFC, do you have the IP for that?
10:23 pm on Jun 24, 2000 (gmt 0)

WebmasterWorld Senior Member littleman is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Name: j6000.inktomi.com - Address: 209.185.141.185

Its UA was Slurp/3.0-AU.

12:40 pm on Jun 25, 2000 (gmt 0)

WebmasterWorld Senior Member nffc is a WebmasterWorld Top Contributor of All Time 10+ Year Member



Just to confirm the same IP as littleman.

Visited this am on another domain.

3:37 am on May 15, 2001 (gmt 0)

WebmasterWorld Administrator brett_tabke is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Does anyone still get hits from the Korean Ink sites? I've not seen one that I remember in quite awhile.
 

Featured Threads

My Threads

Hot Threads This Week

Hot Threads This Month