Comments on: Kavam.net Traffic Mystery: Limelight Networks in Tempe Arizona? It might be from SearchMe’s Spider/Robot

By: LLSearcher

LLSearcher — Mon, 01 Mar 2010 06:55:04 +0000

I have a different but related problem.

I have a clean XP PC which I have loaded some proprietary software.
To use it on the customer’s network, they need to certify it.
They discovered that it is trying to contact the following IP addresses. Whois shows some as Limelight.
I do not know if it going to prevent me from completing the project, but I am curious to know what is doing it or how to find it and stop it.
117.121.253.10
117.121.253.11
117.121.253.12
117.121.253.14
117.121.253.15
117.121.253.16
117.121.253.31
117.121.253.32
117.121.253.33
117.121.253.37
117.121.253.39
117.121.253.51
117.121.253.53
117.121.253.56
117.121.253.58
204.2.164.241
204.2.164.57

I am aware that it could be in the proprietary software, but I would need to confirm this as it is from a Big International company.

Alan

By: Jill Olkoski

Jill Olkoski — Sat, 29 Aug 2009 22:03:52 +0000

Hi Skip,
No idea, but I’d probably spend some time Googling SVChost.exe and see what I could find and possibly even delete that .exe file or disable it somehow until you figure out what’s up. Very odd!

By: Skip

Skip — Sat, 29 Aug 2009 21:25:04 +0000

I am getting traffic not on my site by my workstation to and from IPs registered to Limelight Networks on startup. SVChost.exe atempts to connect to Limelight on boot. Any idea why that would be?

By: Kazturkey

Kazturkey — Sat, 25 Jul 2009 12:26:46 +0000

The same company is monitoring me, and I live in Ireland. I keep getting their name and IP logged in my peerguarding blocker.

By: Jill Olkoski

Jill Olkoski — Sat, 18 Jul 2009 16:24:54 +0000

Hi Milton,
I don’t know the answer to that question, but my guess is that it’s probably not the case. You could Google the IP numbers and see what information you come up with, but I haven’t heard of a search engine mascaraing behind a different IP address.

By: Milton Campos

Milton Campos — Sat, 18 Jul 2009 14:05:55 +0000

Hi Jill,

Thanks for the information. Very useful site. I have another issue though concerning this. In my case, the hits come from 204.62.53.# I use sitemeter and it indicated that the hits come from Towson State University (which has, as far as I could discover, a different IP: 204.62.37.#).

My question for you is thus the following: can the hits be from people coming from the TS University using the searchme engine or people using a hide IP software, instead of a spider?

Thanks for letting me Know!

Milton

By: aktenium

aktenium — Sat, 06 Jun 2009 10:40:25 +0000

what a world. many search engines claim that they will stop crawling your site by block their spider in the robots.txt file, but even after reading this file many times they keep crawling the blocked sites as if there was not robots.txt file.

By: Jill Olkoski

Jill Olkoski — Fri, 27 Mar 2009 18:20:21 +0000

Hi Kate,
I’m sorry, I don’t anything about Live Journal…maybe another reader can assist.

By: Kate

Kate — Fri, 27 Mar 2009 18:07:08 +0000

I can no longer get into Live Journal unless I allow HTTP for Limelight Networks Inc.

Any ideas why?

By: Ljudmila Korjukina

Ljudmila Korjukina — Thu, 22 Jan 2009 14:35:26 +0000

The Kavam bot strikes again: ~6000 hits within one hour, wow…

Thanks for all the info, Jill!

By: Kathy Mead

Kathy Mead — Sun, 24 Aug 2008 10:52:47 +0000

Hi, Jill
thanks for this article

By: Jill Olkoski

Jill Olkoski — Fri, 18 Jul 2008 16:47:00 +0000

I’ve started another post about this new bot here:
http://aldebaranwebdesign.com/blog/bad-bot-savvis-communications-cary-nc/

If you’re seeing traffic from this bot, please post a comment on the other article.

By: Jill Olkoski

Jill Olkoski — Fri, 18 Jul 2008 16:21:25 +0000

e has sent this information regarding IP addresses of the bot’s:

tempe: 208.111.154.# (Limelight Networks, LLC)
sanjose: 209.249.86.# (Kavam)
cary: 165.193.254.# (SAVVIS Communications Corporation)

Looks like there is a new bot in town?

By: Jill Olkoski

Jill Olkoski — Fri, 18 Jul 2008 16:07:20 +0000

e,
Can you send us the IP addresses of Savvis from Cary NC?
Thanks VERY MUCH for the post!
J

By: e

Fri, 18 Jul 2008 16:04:18 +0000

just checked mine: i’m still getting hit hundred of times from savvis/cary NC; kavam/ san jose CA; and the original limelight/tempe AZ

By: Jill Olkoski

Jill Olkoski — Fri, 18 Jul 2008 15:56:02 +0000

UKSBD,
I don’t know the answer to your question. I found an posting on WebmasterWorld.com about a bot called ZyBorg that is run by Savvis Communications Corporation: http://www.webmasterworld.com/forum11/2125.htm

But your report is the first I’ve heard of it. Please keep us posted.

By: UKSBD

UKSBD — Fri, 18 Jul 2008 07:50:49 +0000

Not sure if it is the same bot yet, but I’m now getting hit hard
from the same machine set up,
Mozilla 5.0
Linux
from the ip no. 165.193.254.13 which appears to be Savvis
Can anyone confirm whether SearchMe are now using Savvis?

By: UKSBD

UKSBD — Tue, 17 Jun 2008 21:48:58 +0000

I’ve been hit hard by this today from multiple IP numbers but they
all seem to be connected.
208.111.154.92
209.249.86.17
165.193.254.11

I’m in UK and thought searchme were only concentrating on US traffic, maybe they are going global.

By: Ishmael

Ishmael — Tue, 17 Jun 2008 07:50:14 +0000

This spider is very frustrating from a stats point of view, but I quite like the search engine itself – could be promising alternative to Google. I use Statcounter, which allows you to label IP addresses (or part of them) so at least it’s possible to identify crawlers, even if they still appear in average results.

By: Jill Olkoski

Jill Olkoski — Sat, 07 Jun 2008 04:33:27 +0000

Hi Ree,
You’re very welcome, glad this post helped solve your mystery – although it’s always sad when you think you have an admirer and it’s a bot!