|
|||||||
|
can someone tell me more about this ip address?
ok i am trying to figure out if this ip-address: 202.79.31.202 is a vpn used by people to hide their location or not. when i search on dnstools.com, it says it's from a cambodia isp, but my logs show there's like 30 or so users with this ip-address. this is what the whois shows: http://whois.domaintools.com/202.79.31.202 thanks |
| 08-16-2012, 05:00 AM | |
|
|
|
Did you try googling the IP address?
http://bit.ly/Q3cnm4 |
|
Sure, no prob. I use a bunch of different tools, but here's what I did for this one in particular.
I first went to http://www.mxtoolbox.com/SuperTool.aspx - this can be used to find spam servers in particular & also a few other useful tidbits. If you do a lookup, you get a response from wicam.com (which is the ISP that owns this address, and they're in Cambodia), but no other useful info. So next, I went to the blacklist tool to do a check. It DOES show up on a number of blacklists - this can mean that it's a zombie machine or an infected website, but by far the most common reason for this is that spam comes/has come from this address. So next to a port scan, which can show if a particular service is running. There's no response from SMTP, which means (at least currently), the machine is NOT a mail server. However, scanning through http://www.projecthoneypot.org/ip_202.79.31.202 we clearly see spam being sent, but at a VERY low frequency (only about 1300 messages over 2 years). This points to a strong possibility that this machine is just being used as a relay or a proxy. If it were a relay, however, the number of messages would be much higher. Spam blasts typically number in the 6 or 7 figures, and not nearly that many messages have been detected from this address, so my guess would be a proxy. Further, http://www.proxybridge.com/proxy/id758732 has listed proxy servers from WiCAM in the past - not this IP in particular, but there could be ranges that change on a periodic basis. So nothing that's 100% concrete, but based on what I saw (and the location of the address) I'd be pretty confident in guessing that this is being used / has been used as a proxy server. |
| Thread Tools | Search this Thread |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Rca rs22162 desktop stereo | SOMTHIN4NOTHIN | Tech Support | 2 | 08-06-2012 09:38 PM |
| Question about 2 32" LG Tvs? Can't tell. | ohmyyikes | Tech Support | 5 | 05-28-2012 09:05 PM |
| RESOLVED: Car starter problem. | thatbb6 | Tech Support | 8 | 02-19-2012 06:02 PM |
| Need Battery for Net10 LG500g phone | brandysue44 | Tech Support | 3 | 11-14-2011 06:31 AM |
| Can anyone give me a good NAS recommendation ? | OP | Tech Support | 4 | 05-16-2011 08:14 AM |