Welcome to WebmasterWorld Guest from 54.234.63.187

Forum Moderators: Ocean10000 & incrediBILL

Message Too Old, No Replies

Bot from IANA

     

nativenewyorker

6:36 pm on Sep 2, 2009 (gmt 0)

10+ Year Member



Visitor IP: 216.25.247.###

Referrer: htt#://172.22.0.###:8827/sps0/nov_dev_id###########################################/snapshot/#########/#

User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8) Gecko/20071121 Firefox/1.5

I saw this strange referrer in my raw logs. The reverse IP for 172.22.0.### shows it belongs to IANA (Internet Assigned Numbers Authority). Why would IANA be crawling my site to build what appears to be an archive? Government sponsored snooping?

dstiles

9:21 pm on Sep 2, 2009 (gmt 0)

WebmasterWorld Senior Member dstiles is a WebmasterWorld Top Contributor of All Time 5+ Year Member



It's not. That range of IPs (and others such as 10.x.x.x - check IANA for a full range) are for internal networks - ie intranets or office nets. Your own computer will use one of them; if you have several networked together they all will have a different one.

What you're probably seeing is some local application running on a desktop that is being used to trigger the browser (Firefox in this case). Could be something like Word, Acrobat, a mail client...

I get several hits daily from a file DesktopDefault.aspx; although this has a real domain name behind it it's essentially the same thing. Also several from desktop copies of Acrobat that pretend to come from the Acrobat reader download page - blatant advertising!

caribguy

9:37 pm on Sep 2, 2009 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



Do you have a lot of pictures on your site? A search on the port number and the base directory brings up many Awstat etc. logs for sites that look as if they could be adult themed. Did not click on any of the results...

Looks like an image downloader. The ip address you're seeing is probably that of an internal network.

nativenewyorker

6:24 am on Sep 3, 2009 (gmt 0)

10+ Year Member



It's definitely not related to a local application. I do not use WYSIWYG editors and do not have any applications that contain links to the site other than my FireFox 3.5 browser.

I'm also running an M$ box and not Linux. User-Agent strings with Linux suggest that the visitor is a bot.

No, the site doesn't contain lots of images. I ran the same search for port number and base directory. The search results contain lots of different types of sites including .gov and .edu, so it doesn't look like there is focus toward a particular type of site.

janharders

6:35 am on Sep 3, 2009 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



Since 172.* is, as stated, reserved for internal networks, and it's the referer, I'd say its a user (or bot that submit referers) that clicked on a link or viewed an image from a local service. IANA is not crawling your site, Trans World Internet eXchange, LLC. is, they are the ones the originating IP belongs to.

caribguy

5:12 pm on Sep 3, 2009 (gmt 0)

WebmasterWorld Senior Member 5+ Year Member



Should have clarified: local application as in local to the user/bot who is accessing your site. Google Desktop Search has a similar footprint.
 

Featured Threads

Hot Threads This Week

Hot Threads This Month