IBM Advanced Workstations Division

[wilderness]

The forum search offered no help.
Google wasn't much better:
Lots of references to the IP and/or domain via whois utils.
Did find one link that offered subnets (Class B's), however the site itself was resulted in a 502. The Cache page links to individual Class B's resulted in the same 502.
This page/site also presents them as a server in the following text:

102,357 websites

My visitor appeared to be genuine (even had a page request included from Bluecoat), albeit an outdated browser.

129.42.208.zzz - - [30/Mar/2016:15:17:26 -0600] "GET /MyFolder/MySubFolder/MyPage1928.html HTTP/1.1" 200 8333 "https: //www.google.com" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0"

Followed the second page request (via a short delay) with an image request.

[aristotle]

Could an employee who works there have been doing some personal browsing on company time?

The reason I ask is that occasionally I see what appear to be real human visitors coming from the IPs of government agencies and big corporations, with no apparent job-related reason for the visit.

[lucy24]

albeit an outdated browser

I've read elsewhere in these forums that outdated browsers are a hallmark of any major corporation or governmental agency. You can't just hit the Update button; you have to wait for some Authorized Person to do Authorized Installations, so things will always lag several versions behind. Until fairly recently, I poked comprehensive holes for certain governmental entities that would otherwise have fallen foul of "old browser" cutoffs.

Edit after MultiFile search of raw logs:
Haha, how funny. The IP didn't ring any bells; in fact my notes just label it generically "US" along with the rest of the neighborhood. But one of the few hits I found was a full human visit earlier this year with referer ... wait for it ... reddit. Couple other random images, and then one from years ago citing a particular message board as referer. (It's a board where you're allowed to post your own images, smileys and so on.) Somehow I don't think any of this falls under the head of official job duties.

Oddly, one of those "random images" was from the identical IP as the full human visit-- but different date and wholly unrelated file.

Further edit to clarify: I just searched for 129.42. But in fact all but one hit was 129.42.208.

[wilderness]

FWIW, it was a valid search and refer.
Hasn't returned, thus guess I filled their query.

Located a FB page for IBM Advanced Workstations Division that didn't provide any info.
It's just odd to me that there's not a valid info page for an IBM subsidy.

[keyplyr]

It's just odd to me that there's not a valid info page for an IBM subsidy.

IP address registered to IBM Research > research.ibm.com