Dataline

dtln.ru cloud servers

[keyplyr]

92.242.35.54 - - [25/Jan/2015:04:04:40 -0800] "GET /robots.txt HTTP/1.1" 200 1444 "-" "WebIndex"

dtln.ru cloud servers
92.242.35.0/24
92.242.35.0 - 92.242.35.255

[dstiles]

For RIPE, always scroll to the bottom of the entry AND check the /24 either side of the original. This one is actually...

92.242.32.0 - 92.242.47.255

[lucy24]

92.242.32.0 - 92.242.47.255

But not 0-31 and 48-95 (OK, probably 48-63), which are also Russia?

[keyplyr]

For RIPE, always scroll to the bottom of the entry AND check the /24 either side of the original. This one is actually...

Thanks and I agree, however I'm not using the RIPE database at the moment. When I get back to my office and my own computer, I do all that (but use Domain Dossier Pro which is more complete.) Right now I'm on the road with the band :)

[trintragula]

I've been using ipinfo dot com.
It provides a quick and easy way to get a list of CIDRs from an appropriate ASN surrounding an IP lookup.
I think it also has country lookups for geolocation.
Do people have opinions about that site?

[keyplyr]

Do people have opinions about that [ipinfo.com] site?

They ask for your email address and to become a member? Do they send you emails?

[trintragula]

I think you get 1000 lookups per day before you have to sign up, so I've not gone that far. I've just been using it for colo research.

[keyplyr]

Not according to their top page I'm looking at. In fact, I can't get beyond that page without "signing up." And nowhere do I see 1000 free look-ups offered. That would actually be a great deal.

Regardless, I have a WhoIs API installed that I use for look-ups; a simple, cross-platform way of getting records in XML format displayed on my local machine. I should also stick it on my tablet for use while traveling, but I keep telling myself I won't do web work when I'm out of the office... I guess you can see how well that's working :)

[trintragula]

Sorry, I got the link wrong: it should be ipinfo dot io. Not dot com. That seems to be an unrelated site.

Unfortunately I can't go back and fix it now because it's been too long. But the site I'm talking about does have a convenient and pretty generous access.

This site will produce machine-readable JSON replies if requested. It does seem to have been built for developers.

Apologies for the link confusion.

[dstiles]

Lucy - 92.242.0.0/etc - I'm not sure those are servers.

[lucy24]

Cursory skimming of free lookup says 0-31 is MiraLogic telecom, while 48-63 looks like assorted humans. So no /18 today :(

The nice thing about RIPE-- as opposed to ARIN-- is that it's made up of so ### many countries, you can generally assume that if a block belongs to some given country, it's all the same entity. But not always, darn it.

[lucy24]

:: bump ::

Does anyone know what WebIndex actually is? I've been seeing them sporadically since September 2014, always well-behaved, and it's past the point where I ought to either ignore 'em or block 'em. This UA always uses the identical IP, and vice versa, as quoted in the OP. But the exact requests-- assorted inner pages, no pattern-- suggest that they are familiar with my site by other means; they're not starting with the front page and continuing outward. Maybe pages linked from other people's sites?

[keyplyr]

assorted inner pages, no pattern

IMO suggests data mining which makes sense since this agent comes from A Russian Server Farm with the name "Dataline" and uses a covert UA with no info page or descriptive name.

The website dtln.ru just lists cloud servers and data centers so the bot is either their agent or belongs to one of their long time tenants:

Provider of comprehensive solutions based on Tier 3 data centers in Moscow for your IT infrastructure

Just a FYI - I don't consider any agent "well behaved" if covert with no descriptive UA. Oh, and did I mention they ignored the disallow in robots.txt?