yandex.ru

Another boring Sitemeter post. I'm so sorry.

Several interesting visitors recently, though I haven't kept notes and have forgotten the names of several. Someone in France came here and spent something like an hour viewing several dozen pages, I don't know why - they came in through the MS-WBT server page, though.

Someone came here through my link in Facebook, which never happens, and he looked at a few pages. I know who it was, but I won't embarrass him.

Anyway, page views are up for some reason - every day or two, someone flips through several pages, I don't know why that's happening now but not before - the MS-WBT page isn't changed, nothing is. Random winter boredom maybe?

Today there was a visitor about whom Sitemeter seemed to know nothing at all. I was curious, so tracerouted the entire IP block, and it led back to a cluster of sites named yandex.ru. This, apparently, is the Russian Google, a search engine suite. I don't know what hit the site, exactly, but maybe it was a yandexbot - the Googlebot comes every few days or weeks, maybe the yandexbot will start dropping by.

Anyways, that's pretty boring. Sorry.

WebSense

This is kind of interesting.

Being on the private network and all, I can't see the main stream of internet traffic - or, I don't know how to watch it from an external host, same thing. Anyways, I am reduced to watching Sitemeter to see if anything interesting pops up there. So we get the Italia thing from last time.

Sitemeter tells me the referring URL for most visitors to this site. 98% of them are referred from Google, because they've searched for MS-WBT-SERVER and that April page is the top return for that search. The ones that aren't from there are the interesting ones. Today I get the following referral:

http://10.237.125.90:15871/cgi-bin/blockOptions.cgi?ws-session=1817507749

An IP address starting with 10.* is a private network address - so at first I thought this was a referral from some site on my own network, which doesn't make any sense at all. Then, slightly more sensibly, I thought it must be a reference from within the Blogspot network. Then I gave up guessing, and Googled it.

A number of forum questions suggest that someone on a private network tried to see this site, but it (i.e. blogger.com) was blocked by WebSense software. So WebSense poked the site, found it was on its block list, and probably gave that person a notification that it was blocked - 15871 is the port used by the WebSense monitor or something, so this actually reveals (I think) the user's own IP address. The request came from an address in Tamil Nadu, India.

So, strangely enough, this is a way of getting information about a user from within a private network - get your site blocked by them, then you can see their external, public address when they attempt to connect, and their private address when WebSense bounces them off. Neat!

***

The public address sitemeter gave me was 203.99.193.* - this is registered to Cognizant Technology Solutions - long story short, Cognizant is (among other things) an outsourcing company. No way of knowing exactly what they're doing there, some sort of white collar stuff, call centers, that sort of thing.

Italia

Oh, also I am always watching Sitemeter, keeping track of how many people are coming to check out my invaluable MS WBT tips. Somebody on an Italian network actually seems to have searched this site out by name, strangely enough: they Googled the terms "internet what i am going to learn today", which is pretty weird. May have just been a coincidence, but I think they were looking for me.

Sitemeter doesn't give the whole IP address of the visitor, just the prefixes, and in this case it couldn't be certain where the visitor was coming from. I tracerouted the whole block, though, and they all belong to the Telecom Italia backbone, called "Seabone".

So today I learned that Telecom Italia's international backbone is called Seabone.