Has anyone ever found "http://192.168.3.4:15871/cgi-bin/blockOptions.cgi" in their awstats logs under "Links from an external page (other web sites except search engines)"?

I googled that URL and only found 1 page( http://www.google.com/search?client=opera&q=http://192.168.3.4:15871/cgi-bin/blockOptions.cgi&sourceid=opera&ie=utf-8&oe=utf-8 ) so this seems to be a very unique occurrence.

That IP address appears? to belong to ICANN/IANA/Internet Assigned Numbers Authority so the first thing I was concerned about was ICANN doing something, like blocking world wide web users from getting to my website, to one of my domains or some entity trying to steal one of my domains. I have about 25 domains pointed to the "website" where I found that URL in the awstats logs so I checked all of those domains to make sure they are still pointing to my "website".

Ultimately, I called the hosting company I use for that website and the support rep. seemed to think it means someone accessed my website through a proxy. She does not seem to think it indicates someone(s) trying to steal my domain names or something.

Whatever the case, as soon as I saw that URL in my logs saying "blockOptions" with an IP that appears to belong to ICANN my heart started beating like it was when I finished running that 4:48 mile the other day.

I would appreciate whatever information you guys give me.

The website is NOT an adult website or otherwise controversial in that manner.

Is this just a "referral" or origin point in awstats, if so there is nothing to worry about. Or is that script in your server somewhere.

192.168.???.??? is the default "internal" IP address. It's not owned by ICANN.

Originally Posted by webcs

Is this just a "referral" or origin point in awstats...".

It is located in the section labeled:

Connect to site from
Origin

Originally Posted by Learning Newbie

192.168.???.??? is the default "internal" IP address. It's not owned by ICANN.

When I go to http://ws.arin.net/whois and enter 192.168.3.4:15871 I get the following:

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

NetRange: 192.168.0.0 - 192.168.255.255
CIDR: 192.168.0.0/16
NetName: IANA-CBLK1
NetHandle: NET-192-168-0-0-1
Parent: NET-192-0-0-0-0
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment: arin.net/reference/rfc/rfc1918.txt
RegDate: 1994-03-15
Updated: 2007-11-27

OrgAbuseHandle: IANA-IP-ARIN
OrgAbuseName: Internet Corporation for Assigned Names and Number
OrgAbusePhone: +1-310-301-5820
OrgAbuseEmail: abuseATiana.org

OrgTechHandle: IANA-IP-ARIN
OrgTechName: Internet Corporation for Assigned Names and Number
OrgTechPhone: +1-310-301-5820
OrgTechEmail: abuseATiana.org

# ARIN WHOIS database, last updated 2008-09-17 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

I can not see any other conclusion, but that the IP is ICANN/IANA owned.

I want to know what that activity is all about because I have never once seen that before and that is a section that I always look at in awstats logs because it tells me what kind of attention/links I am getting from the search engines and other websites.

What seems to confirm my conclusion that ICANN owns the IP is the fact that arin.net/reference/rfc/rfc1918.txt leads to the following information indicating that the IP address is for special purposes. To me that just "screams" ICANN, but, again, I just would like to know what it is all about and if I should be concerned:

Network Working Group Y. Rekhter
Request for Comments: 1918 Cisco Systems
Obsoletes: 1627, 1597 B. Moskowitz
BCP: 5 Chrysler Corp.
Category: Best Current Practice D. Karrenberg
RIPE NCC
G. J. de Groot
RIPE NCC
E. Lear
Silicon Graphics, Inc.
February 1996


Address Allocation for Private Internets

Status of this Memo

This document specifies an Internet Best Current Practices for the
Internet Community, and requests discussion and suggestions for
improvements. Distribution of this memo is unlimited.

1. Introduction

For the purposes of this document, an enterprise is an entity
autonomously operating a network using TCP/IP and in particular
determining the addressing plan and address assignments within that
network.

This document describes address allocation for private internets. The
allocation permits full network layer connectivity among all hosts
inside an enterprise as well as among all public hosts of different
enterprises. The cost of using private internet address space is the
potentially costly effort to renumber hosts and networks between
public and private.

2. Motivation

With the proliferation of TCP/IP technology worldwide, including
outside the Internet itself, an increasing number of non-connected
enterprises use this technology and its addressing capabilities for
sole intra-enterprise communications, without any intention to ever
directly connect to other enterprises or the Internet itself.

The Internet has grown beyond anyone's expectations. Sustained
exponential growth continues to introduce new challenges. One
challenge is a concern within the community that globally unique
address space will be exhausted. A separate and far more pressing
concern is that the amount of routing overhead will grow beyond the



Rekhter, et al Best Current Practice [Page 1]

RFC 1918 Address Allocation for Private Internets February 1996


capabilities of Internet Service Providers. Efforts are in progress
within the community to find long term solutions to both of these
problems. Meanwhile it is necessary to revisit address allocation
procedures, and their impact on the Internet routing system.

To contain growth of routing overhead, an Internet Provider obtains a
block of address space from an address registry, and then assigns to
its customers addresses from within that block based on each customer
requirement. The result of this process is that routes to many
customers will be aggregated together, and will appear to other
providers as a single route [RFC1518], [RFC1519]. In order for route
aggregation to be effective, Internet providers encourage customers
joining their network to use the provider's block, and thus renumber
their computers. Such encouragement may become a requirement in the
future.

With the current size of the Internet and its growth rate it is no
longer realistic to assume that by virtue of acquiring globally
unique IP addresses out of an Internet registry an organization that
acquires such addresses would have Internet-wide IP connectivity once
the organization gets connected to the Internet. To the contrary, it
is quite likely that when the organization would connect to the
Internet to achieve Internet-wide IP connectivity the organization
would need to change IP addresses (renumber) all of its public hosts
(hosts that require Internet-wide IP connectivity), regardless of
whether the addresses used by the organization initially were
globally unique or not.

It has been typical to assign globally unique addresses to all hosts
that use TCP/IP. In order to extend the life of the IPv4 address
space, address registries are requiring more justification than ever
before, making it harder for organizations to acquire additional
address space [RFC1466].

Hosts within enterprises that use IP can be partitioned into three
categories:

Category 1: hosts that do not require access to hosts in other
enterprises or the Internet at large; hosts within
this category may use IP addresses that are
unambiguous within an enterprise, but may be
ambiguous between enterprises.

Category 2: hosts that need access to a limited set of outside
services (e.g., E-mail, FTP, netnews, remote login)
which can be handled by mediating gateways (e.g.,
application layer gateways). For many hosts in this
category an unrestricted..

What all that means is that when you create a private network, the computers on it that talk in TCPIP all need IP addresses, but don't need (semi expensive) public addresses. Because these are private islands, they can all use the "same" IP address (range) because, so long as it's not exposed, there can't be a conflict. 192.168.???.??? is used for this, by convention. A single "block" of private addresses is "reserved" for consistancy's sake.

My IP address right now is 192.168.18.1, and I have nothing to do with ICANN.

Thanks to everyone for replying.

Originally Posted by Learning Newbie

What all that means is that when you create a private network, the computers on it that talk in TCPIP...

My IP address right now is 192.168.18.1, and I have nothing to do with ICANN.

Okay, so someone who is on a private network(intranet?, LAN?), whether commercial or residential, visited my website?

Is that it?

Again, first time this has occurred this way, to my recollection, on any site I manage; so, I try to keep looking or asking questions until the answer is given.

Incidentally, I do know what my IP address is now as I use the Internet to make this post. However, I will probably be adding a router, probably this( cradlepoint.com/mbr1000/mbr1000.php ) one.

Will my IP address end up being 192.168... by default after I put the router in place and use the Internet through it? Just curious.

Update: I consider my question about 192.168.3.4:15871 completely answered. I happened to find mention of 192.168.18.1 in the pdf user guide for the aforementioned router and, in combination with, especially, Newbie's explanation I have come to understand that, as Webcs stated, it "...is nothing to worry about..."

I am sure that there are other site issues that I should worry about so I will go and try to find those issues.

Thanks webcs and newbie.