Bot from IANA

[nativenewyorker]

Visitor IP: 216.25.247.###

Referrer: htt#://172.22.0.###:8827/sps0/nov_dev_id###########################################/snapshot/#########/#

User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20071121 Firefox/1.5

I saw this strange referrer in my raw logs. The reverse IP for 172.22.0.### shows it belongs to IANA (Internet Assigned Numbers Authority). Why would IANA be crawling my site to build what appears to be an archive? Government sponsored snooping?

[dstiles]

It's not. That range of IPs (and others such as 10.x.x.x - check IANA for a full range) are for internal networks - ie intranets or office nets. Your own computer will use one of them; if you have several networked together they all will have a different one.

What you're probably seeing is some local application running on a desktop that is being used to trigger the browser (Firefox in this case). Could be something like Word, Acrobat, a mail client...

I get several hits daily from a file DesktopDefault.aspx; although this has a real domain name behind it it's essentially the same thing. Also several from desktop copies of Acrobat that pretend to come from the Acrobat reader download page - blatant advertising!

[caribguy]

Do you have a lot of pictures on your site? A search on the port number and the base directory brings up many Awstat etc. logs for sites that look as if they could be adult themed. Did not click on any of the results...

Looks like an image downloader. The ip address you're seeing is probably that of an internal network.

[nativenewyorker]

It's definitely not related to a local application. I do not use WYSIWYG editors and do not have any applications that contain links to the site other than my FireFox 3.5 browser.

I'm also running an M$ box and not Linux. User-Agent strings with Linux suggest that the visitor is a bot.

No, the site doesn't contain lots of images. I ran the same search for port number and base directory. The search results contain lots of different types of sites including .gov and .edu, so it doesn't look like there is focus toward a particular type of site.

[janharders]

Since 172.* is, as stated, reserved for internal networks, and it's the referer, I'd say its a user (or bot that submit referers) that clicked on a link or viewed an image from a local service. IANA is not crawling your site, Trans World Internet eXchange, LLC. is, they are the ones the originating IP belongs to.

[caribguy]

Should have clarified: local application as in local to the user/bot who is accessing your site. Google Desktop Search has a similar footprint.