Forum Moderators: open

Message Too Old, No Replies

Dataline

dtln.ru cloud servers

         

keyplyr

3:19 am on Jan 27, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month





92.242.35.54 - - [25/Jan/2015:04:04:40 -0800] "GET /robots.txt HTTP/1.1" 200 1444 "-" "WebIndex"

dtln.ru cloud servers
92.242.35.0/24
92.242.35.0 - 92.242.35.255

dstiles

8:45 pm on Jan 27, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



For RIPE, always scroll to the bottom of the entry AND check the /24 either side of the original. This one is actually...

92.242.32.0 - 92.242.47.255

lucy24

8:50 pm on Jan 27, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



92.242.32.0 - 92.242.47.255

But not 0-31 and 48-95 (OK, probably 48-63), which are also Russia?

keyplyr

9:11 pm on Jan 27, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



For RIPE, always scroll to the bottom of the entry AND check the /24 either side of the original. This one is actually...

Thanks and I agree, however I'm not using the RIPE database at the moment. When I get back to my office and my own computer, I do all that (but use Domain Dossier Pro which is more complete.) Right now I'm on the road with the band :)

trintragula

8:30 am on Jan 28, 2015 (gmt 0)

10+ Year Member Top Contributors Of The Month



I've been using ipinfo dot com.
It provides a quick and easy way to get a list of CIDRs from an appropriate ASN surrounding an IP lookup.
I think it also has country lookups for geolocation.
Do people have opinions about that site?

keyplyr

10:11 am on Jan 28, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month




Do people have opinions about that [ipinfo.com] site?

They ask for your email address and to become a member? Do they send you emails?

trintragula

10:33 am on Jan 28, 2015 (gmt 0)

10+ Year Member Top Contributors Of The Month



I think you get 1000 lookups per day before you have to sign up, so I've not gone that far. I've just been using it for colo research.

keyplyr

11:52 am on Jan 28, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Not according to their top page I'm looking at. In fact, I can't get beyond that page without "signing up." And nowhere do I see 1000 free look-ups offered. That would actually be a great deal.

Regardless, I have a WhoIs API installed that I use for look-ups; a simple, cross-platform way of getting records in XML format displayed on my local machine. I should also stick it on my tablet for use while traveling, but I keep telling myself I won't do web work when I'm out of the office... I guess you can see how well that's working :)

trintragula

12:36 pm on Jan 28, 2015 (gmt 0)

10+ Year Member Top Contributors Of The Month



Sorry, I got the link wrong: it should be ipinfo dot io. Not dot com. That seems to be an unrelated site.

Unfortunately I can't go back and fix it now because it's been too long. But the site I'm talking about does have a convenient and pretty generous access.

This site will produce machine-readable JSON replies if requested. It does seem to have been built for developers.

Apologies for the link confusion.

dstiles

8:50 pm on Jan 28, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Lucy - 92.242.0.0/etc - I'm not sure those are servers.

lucy24

9:48 pm on Jan 28, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Cursory skimming of free lookup says 0-31 is MiraLogic telecom, while 48-63 looks like assorted humans. So no /18 today :(

The nice thing about RIPE-- as opposed to ARIN-- is that it's made up of so ### many countries, you can generally assume that if a block belongs to some given country, it's all the same entity. But not always, darn it.

lucy24

9:46 pm on Mar 15, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



:: bump ::

Does anyone know what WebIndex actually is? I've been seeing them sporadically since September 2014, always well-behaved, and it's past the point where I ought to either ignore 'em or block 'em. This UA always uses the identical IP, and vice versa, as quoted in the OP. But the exact requests-- assorted inner pages, no pattern-- suggest that they are familiar with my site by other means; they're not starting with the front page and continuing outward. Maybe pages linked from other people's sites?

keyplyr

4:00 pm on Mar 17, 2015 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month




assorted inner pages, no pattern

IMO suggests data mining which makes sense since this agent comes from A Russian Server Farm with the name "Dataline" and uses a covert UA with no info page or descriptive name.

The website dtln.ru just lists cloud servers and data centers so the bot is either their agent or belongs to one of their long time tenants:
Provider of comprehensive solutions based on Tier 3 data centers in Moscow for your IT infrastructure


Just a FYI - I don't consider any agent "well behaved" if covert with no descriptive UA. Oh, and did I mention they ignored the disallow in robots.txt?