Is this INK???

Korean INK???

[Kamikaze]

IP: 211.169.241.21
User Agent: Slurp/si ([e-mail]; [inktomi.com...]

This came from Asia Pacific Network Information Center (of Korea). But it claims to be Ink spider!!!

[littleman]

Well,
It looks like a fake to me. Did it pull the robots.txt? I got this from whois.nic.or.kr:
1. ȸ¿ø ISP ±â°üÁ¤º¸
1a. ÇÑ±Û ±â°ü¸í : µ¥ÀÌÄÞ
1b. ¿µ¹® ±â°ü¸í : DACOM Corporation
1c. Çѱۼ­ºñ½º¸í : º¸¶ó³Ý
1d. ¿µ¹®¼­ºñ½º¸í : BORANET
1e. ±â°ü ÁÖ¼Ò : °­³²±¸ ¿ª»ïµ¿ 706-1 DACOMºôµù

2. ½Ç¹«Ã¥ÀÓÀÚ Àι°Á¤º¸
2a. ÇÑ±Û À̸§ : È«°ÉÇ¥
2b. ¿µ¹® À̸§ : Kulpyo Hong
2c. ÀüÈ­¹øÈ£ : 02-6220-7755
2d. Æѽº¹øÈ£ : 02-6220-0312
2e. ÀüÀÚ¿ìÆíÁÖ¼Ò : [e-mail]

3. IP´ã´çÀÚ Àι°Á¤º¸
3a. ÇÑ±Û À̸§ : ÇÏż±
3b. ¿µ¹® À̸§ : Taeseon Ha
3c. ÀüÈ­¹øÈ£ : 02-6220-7755
3d. Æѽº¹øÈ£ : 02-6220-0312
3e. ÀüÀÚ¿ìÆíÁÖ¼Ò : [e-mail]
check out [bora.net...]

[Kamikaze]

Yup, it pulled my robots.txt file. Hmmm....

[littleman]

I just was digging through my logs that IP has hit some of my sites. So odds are it is from inktomi! Sneaky bastards!

[fantomaster]

It's been on our sites and those of our clients, too. We have tentatively categorized it as an Ink spider based on its behavior and UA, thought IMO it still looks rather fishy.

[Brett_Tabke]

Well, they say ink is down there in Aus building it's directory of south east asian sites. Soule would be a natural place between Japan and China. But makes little sense that they would spider for ink to the US from soul e over international lines though - the lag would be killer at times.

[fantomaster]

Yes, we're aware of that, of course. But what we've seen up until this one came from Japan. Which begs the question why they would switch to Korea now, unless perhaps they're splitting operations up further?

[littleman]

I know it does smell a little. I tried the usual proxy ports (80, 8080, 3128, 1080), just to cover the obvious. It did only call my root domains. Still, I bet most of us have had the idea of building a spider to mimic Slurp and put it through an
obscure IP in a south asian country.

Still...
6/20/100 - 15:29:55, GET 211.169.241.21 Slurp/si ([e-mail]; [inktomi.com...]
6/20/100 - 15:30:09, GET 211.169.241.21 Slurp/si ([e-mail]; [inktomi.com...]

It made these requests for a domain I have all but given up on. This site was booted out of Ink months ago, but I still have this site auto-submit to watch for patters. If this spider is a fake it would have had to record data form ink listings six
months ago. At this point it is in my db.

[fantomaster]

Great, littleman, that's exactly the sort of corroboration required in such a case.
So we can take it then as a somewhat smelly but nevertheless established Ink spider to be monitored for further antics. :)

[Brett_Tabke]

Well, I've searched most of the places I can think of, and can't find any reference to a se in Korea using Ink. (not on the pr newswire anyway). I thought maybe Ink was custom building a db/directory for someone over there that would explain it.

Japan I can certainly see with the Ink/Goo relationship.

That just doesn't register with me, that Ink would do this to circumvent cloaking - that is getting serious. Why would they even bother to us Slurp for an agent name?

[fantomaster]

That's why it's most probably not cloaked - and why everyone seemed to think it's bogus in the first place.
You may be right - if they are db building for a special, new or yet undisclosed client, this is one way it could happen. Then again it might be something experimental. Now if only we had a second high caliber confirmation like littleman's from another source ...

[Brett_Tabke]

Gimmie a few hours. I'm at home with a dreadfully slow dsl tonight, and need to wait for those ahem napster files to finish)... (he says as he is in the middle of making a reply about copyrights in another forum - oh that hurts).

What's the supposid time frame on this? How far back do I need to go?

[fantomaster]

First notification from client was:
Tue, 20 Jun 2000 05:51:25 UTC -0700

Will see what we can come up with later from our
own logs, but I'll be going offline soon and won't be back before appr. 18 hours from now.

[Kamikaze]

Can anyone read Korean? Tee hee...
[inktomikorea.co.kr...]

I've already emailed a few people working there. No reply so far. Wish me luck...

[Brett_Tabke]

That is good enough for me. How'd you find that one?

[littleman]

Good find Kamikaze! I'm also curious to know how you came across it. Sorry about the long length of the lookup, but I think there is some interesting info here.

# ENGLISH

Domain Name : INKTOMIKOREA.CO.KR
Org/Person Name : BUM HO TRADING CO.
Org Address : 77-17 YOCKCHON-DONG, EUNPYUNG-GU, SEOUL, KOREA
Zip Code : 122-070
Point of Contact : SEONG BAE JIN
Telephone : [phone]
E-Mail : [e-mail]
Registed Date : 19990331
Updated Date : 20000512
Valid Date : 20001015

Primary Name Server
Host Name : ns.inktomikorea.co.kr
IP Address : 211.112.6.77

Secondary Name Server
Host Name : elim.net
IP Address :
Host Name : prmns.lg.co.kr
IP Address : 165.243.5.15

[Brett_Tabke]

Ink & Adero [inktomi.com]

Notice where Adero is at on the planet...

------------- import
About Adero

Founded in 1998, Adero provides a global turnkey service that enables companies to provide their online audiences a quick, consistent, and reliable experience anywhere in the world. Adero's network of intelligent nodes and patent-pending GeoTraffic Manager™ technology allows companies to overcome the complexities of building and managing infrastructure in foreign markets, as well as reap the benefits of improved Web site performance and custom-tailored content. Adero provides enhanced service directly to more than 97% of the world's Internet users and has nodes in 19 countries, including Argentina, Australia, Brazil, Canada, China, Columbia, France, Germany, Hong Kong, Italy, Japan, The Netherlands, Singapore, Spain, Sweden, South Korea, Taiwan, United Kingdom, and the United States. Adero, Inc., www.adero.com, is a venture-funded company headquartered in Cambridge, Massachusetts, USA.
--------

[fantomaster]

Here's further proof positive: one typical behavior of many Ink spiders is their duplicate page calls in rapid succession. This spider is doing the same.

Here's some log entries from various domains we are monitoring:

d#1:
211.169.241.21 - - [21/Jun/2000:20:17:07 -0700] "GET /robots.txt HTTP/1.0" 200 53
211.169.241.21 - - [21/Jun/2000:20:17:27 -0700] "GET / HTTP/1.0" 200 4698
211.169.241.21 - - [21/Jun/2000:20:17:47 -0700] "GET / HTTP/1.0" 200 4698

d#2:
211.169.241.21 - - [20/Jun/2000:14:45:17 -0700] "GET /robots.txt HTTP/1.0" 200 410
211.169.241.21 - - [20/Jun/2000:14:45:43 -0700] "GET / HTTP/1.0" 200 18346

d#3:
211.169.241.21 - - [21/Jun/2000:14:34:39 -0700] "GET /robots.txt HTTP/1.0" 200 657
211.169.241.21 - - [21/Jun/2000:14:34:56 -0700] "GET / HTTP/1.0" 200 25462
211.169.241.21 - - [21/Jun/2000:14:35:09 -0700] "GET / HTTP/1.0" 200 25462

d#4:
211.169.241.21 - - [21/Jun/2000:14:50:16 -0700] "GET /robots.txt HTTP/1.0" 200 185
211.169.241.21 - - [21/Jun/2000:14:50:31 -0700] "GET / HTTP/1.0" 200 20307
211.169.241.21 - - [21/Jun/2000:14:50:48 -0700] "GET / HTTP/1.0" 200 20307

d#5:
211.169.241.21 - - [21/Jun/2000:10:08:25 -0700] "GET /robots.txt HTTP/1.0" 200 148
211.169.241.21 - - [21/Jun/2000:10:08:51 -0700] "GET / HTTP/1.0" 200 51576

d#6:
211.169.241.21 - - [20/Jun/2000:16:13:06 -0700] "GET /robots.txt HTTP/1.0" 200 57
211.169.241.21 - - [20/Jun/2000:16:13:14 -0700] "GET / HTTP/1.0" 200 852
211.169.241.21 - - [20/Jun/2000:16:13:24 -0700] "GET / HTTP/1.0" 200 852

----------------

Some examples of duplicate calls:

d#1:
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3002.inktomi.com - - [17/Jun/2000:22:31:17 -0700] "GET / HTTP/1.0" 200 4698
si3002.inktomi.com - - [17/Jun/2000:22:31:18 -0700] "GET / HTTP/1.0" 200 4698

si3003.inktomi.com - - [18/Jun/2000:15:32:40 -0700] "GET /robots.txt HTTP/1.0" 200 53
si3003.inktomi.com - - [18/Jun/2000:15:32:41 -0700] "GET / HTTP/1.0" 200 4698
si3003.inktomi.com - - [18/Jun/2000:15:32:42 -0700] "GET / HTTP/1.0" 200 4698

[fantomaster]

I like that: "BUM HO TRADING CO." ... :)

[Kamikaze]

Awesome! Great work Fantomaster! Now this is the kind of numbers I like to see...

[Brett_Tabke]

And if you need further confirmation, try this:

Inktomi Launche Korea Search Services [biz.yahoo.com].

[NFFC]

Not Korean and you probably all know but:

Mozilla/4.72 [en] (X11; U; NetBSD 1.4.2 i386; Nav)

[Kamikaze]

NFFC, do you have the IP for that?

[littleman]

Name: j6000.inktomi.com - Address: 209.185.141.185

Its UA was Slurp/3.0-AU.

[NFFC]

Just to confirm the same IP as littleman.

Visited this am on another domain.

[Brett_Tabke]

Does anyone still get hits from the Korean Ink sites? I've not seen one that I remember in quite awhile.