Old 6th September 2006, 11:46   #1
unknown-name
Member
 
Join Date: Jul 2004
Posts: 71
What is WinampCheck ?

I have no idea if this someone connecting or what, but I keep seeing this in the log:

<09/06/06@18:27:40> [dest: 217.xxx.xxx.xxx] starting stream (UID: 516)[L: 2]{A: WinampCheck/5.1}(P: 1)
<09/06/06@18:27:40> [dest: 217.xxx.xxx.xxx] connection closed (0 seconds) (UID: 516)[L: 1]{Bytes: 14298}(P: 1)



What is WinampCheck/5.1 ? Is it some new shoutcast thing or is someone maybe playing funny buggers (I've xxx'd the IP just in case)?
unknown-name is offline   Reply With Quote
Old 6th September 2006, 13:36   #2
fc*uk
Moderator
 
fc*uk's Avatar
 
Join Date: Dec 2005
Location: Atlantic Beach
Posts: 8,142
well, it could be someone running winamp under linux. I know that will cause winamp to connect funny sometimes.

However, like you, I would ban the IP. This smells odd.
fc*uk is offline   Reply With Quote
Old 6th September 2006, 14:49   #3
unknown-name
Member
 
Join Date: Jul 2004
Posts: 71
You'd ban my IP? wha?? I don't get it.

Meh,anyway, it's banned now, and it tries to connect exactly every 15 minutes, not a second before or after, so it's definitely something shifty going on.. I just don't understand what it's doing, or its purpose.

If anyone else has this in their logs I'd be interested to know. Cheers.

edit:
I checked the Host Name of the IP, and the last bit of it is mobilaria.com, which is some website from the Netherlands, to do with mobiles or something.
unknown-name is offline   Reply With Quote
Old 21st August 2007, 02:49   #4
Jody Thornton
Junior Member
 
Join Date: Apr 2006
Location: Hamilton, Ontario, Canada
Posts: 6
I Also Get WinAmp Check

<08/20/07@21:36:52> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:39:55> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:41:53> [dest: 87.249.112.131] IP in ban list, disconnecting
<08/20/07@21:42:59> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:46:02> [yp_tch] yp.shoutcast.com touched!

This guy keeps connecting once an hour, on the hour at :37 or :41 minutes. I also traced this IP to the Netherlands. What gives.

Cheers,
Jody Thornton
(Hamilton, Ontario)
Jody Thornton is offline   Reply With Quote
Old 21st August 2007, 04:49   #5
hackerdork
Forum King
 
hackerdork's Avatar
 
Join Date: Feb 2006
Location: Earth Circa sometime.
Posts: 3,297
with more than 30 billion internet users it can be anyone probing for media, from a hacker, a script, a downloaded or just some punk. I would take too much stock in most of the weird stuff in my shoutcast logs unless there is a problem, then I ban that IP on the firewall not on shoutcast and they never even see my SC traffic.

~ According to the ship's log we're down to our last 3000 vomit bags.It'll never be enough.
search the forums! don't PM me on how-to, or ask me to setup you system. you do it so you learn.
hackerdork is offline   Reply With Quote
Old 8th November 2007, 00:30   #6
fc*uk
Moderator
 
fc*uk's Avatar
 
Join Date: Dec 2005
Location: Atlantic Beach
Posts: 8,142
Anyone ever get this sorted?

I have a huge insurgency of this lately. Connects every hour for about 60-62 seconds (until I banned it).

As I recomended months ago, I banned it as of 6 am this morning (I go to work early).

Quote:
<11/07/07@06:52:12> [dest: 87.249.112.131] starting stream (UID: 3614)[L: 1]{A: WinampCheck/5.1}(P: 0)
IP traces to Amsterdam for what its worth.
fc*uk is offline   Reply With Quote
Old 17th November 2007, 11:18   #7
zollymonsta
Member
 
Join Date: Sep 2006
Location: Wellington, New Zealand
Posts: 53
I've traced this to virtu.nl

Sending them an email to investigate further. I'm getting this connection every 30 minutes. I notice they host media servers as well as webhosting.

Will post anything I find out
zollymonsta is offline   Reply With Quote
Old 19th November 2007, 11:43   #8
remco_k
Junior Member
 
Join Date: Nov 2007
Location: Netherlands
Posts: 2
Quote:
Originally posted by zollymonsta
I've traced this to virtu.nl

Sending them an email to investigate further. I'm getting this connection every 30 minutes. I notice they host media servers as well as webhosting.

Will post anything I find out
I did the same a few days earlier at 12-11-2007. Asking what they are doing, why and with what.
And I did get a response (13-11-2007) from virtu saying that they forwarded my question to their customer.
As of this post, no reply came from there.


It's obvious I have the same problems as described earlier, started on 31-08-2007:
Quote:
<08/31/07@15:04:37> [dest: 87.249.112.131] starting stream (UID: 33305)[L: 9]{A: WinampCheck/5.1}(P: 0)
<08/31/07@15:04:37> [dest: 87.249.112.131] connection closed (0 seconds) (UID: 33305)[L: 8]{Bytes: 8192}(P: 0)
Since then, exactly every half hour this happens. 24 hours a day, 7 days a week.
Since I did'nt get a response from virtu's customer, I recently banned this IP.
So this:
Quote:
<11/19/07@10:30:29> [dest: 87.249.112.131] starting stream (UID: 966717)[L: 13]{A: WinampCheck/5.1}(P: 1)
<11/19/07@10:30:29> [dest: 87.249.112.131] connection closed (0 seconds) (UID: 966717)[L: 12]{Bytes: 8192}(P: 1)
Was the last winampcheck that we allowed on the destination ip: 87.249.112.131

Whenever I do get a response from virtu's customer here in the Netherlands, I'll let you all know in this topic.
So, what is it what tey do? Thats the big question I guess.
It could be they are gathering some kind of data about different streams. Or probing for online/offline streams.
Maybe selling this data commercially to 3rd party companies, or publicate it on a website somewhere.
Or they are scanning for online streams, giving this info to companies like Buma/Stemra and Sena (For music rights here in NL). Now we have a legal stream, paying nicely for al the rights and goods, so we have noting to fear at this point.

Until then, not knowing what they are doing with this winampcheck, I recommend everyone to ban the destination IP 87.249.112.131
remco_k is offline   Reply With Quote
Old 19th November 2007, 16:30   #9
OCSDRadio
Junior Member
 
Join Date: Mar 2007
Posts: 26
That address: 87.249.112.131

Was doing the same shit to my stream for about a week before I banned it, I still see it once in a while try to connect again but he can't get in.
OCSDRadio is offline   Reply With Quote
Old 22nd January 2008, 17:48   #10
DJQUICK-E
Junior Member
 
Join Date: May 2006
Location: Orlando, Florida
Posts: 22
Has anyone gotten an answer to this yet?

"Life is too short, "Have some fun"
DJQUICK-E is offline   Reply With Quote
Old 22nd January 2008, 18:12   #11
zollymonsta
Member
 
Join Date: Sep 2006
Location: Wellington, New Zealand
Posts: 53
Nope... initial email answered 'we'll investigate'... followups emails un-answered (three so far).

Best you can do it pernamently block that ip address. Seems the ISP isn't interested.
zollymonsta is offline   Reply With Quote
Old 22nd January 2008, 19:38   #12
remco_k
Junior Member
 
Join Date: Nov 2007
Location: Netherlands
Posts: 2
So, after a few months I did'nt get a response either from Virtu's customer.
Just send them an e-mail as reminder. See what happens now.
remco_k is offline   Reply With Quote
Old 22nd January 2008, 20:28   #13
zollymonsta
Member
 
Join Date: Sep 2006
Location: Wellington, New Zealand
Posts: 53
Quote:
Originally posted by remco_k
So, after a few months I did'nt get a response either from Virtu's customer.
Just send them an e-mail as reminder. See what happens now.
I doubt you will hear anything from them.

I sent 3 to 4 reminders over a period of a few months ago and there has been no reply since my first enquiry..
zollymonsta is offline   Reply With Quote
Old 17th March 2008, 20:28   #14
aaronsnet
Member
 
aaronsnet's Avatar
 
Join Date: Mar 2004
Location: Notsville
Posts: 66
Send a message via AIM to aaronsnet
Quote:
My stream is scanned everyday with a programme called NSPlayer or Tunin.FM Check. Why?

NSPlayer and Tunin.FM Check simply checks if your server is still available.

NSPlayer Tunin.FM Check are checkscripts operated by a company called Mobilaria, based in the Netherlands.

Mobilaria is a Mobile Streaming Media company providing a Mobile Radio service called Tunin.FM.
Tunin.FM is a directory service providing access to internet radio streams for mobile phones. Your listeners are no longer limited to their PC at home but can select your stream from a list in their mobile phone.

The checkscripts NSPlayer and Tunin.FM Check checks periodically the availability of the radio streams listed in Tunin.FM as to avoid that listeners are confronted with unavailable streams.
What happens when my server is temporarily offline?

If for any reason the check script cannot connect to a streaming server, then the corresponding radio stream is deleted from the directory list.
This means that listeners worldwide can no longer listen to your stream on their mobile phone.
What happens when my server is online again?

The check script runs frequently, when the check script connects to the streaming server, the radio stream is published in the directory service Tunin.FM again.
How much load do the checkscripts generate on my server?

The load the checkscripts generates on your server should be neglectible. The script runs periodically but usually just once every 15 - 30 minutes and it only sends one request to the streaming server.
When the server answers, the script is satisfied and drops the connection. If the server does not answer, NSPlayer and Tunin.FM Check drops the connection after a few seconds and it tries again later.
Thanks for this information, but I still have some questions.

Sure, please contact Mobilaria directly via email. helpdesk@mobilaria.com
http://www.mobilaria.com/scan-faq-en
aaronsnet is offline   Reply With Quote
Old 21st March 2008, 00:21   #15
Thebig429
Senior Member
 
Thebig429's Avatar
 
Join Date: Apr 2006
Location: Right here!
Posts: 358
Yea now when winamp check connects it has a link with the info what it is
http://www.mobilaria.com/scan-faq-en

Cadillac Radio
Classic rock from the 60s to the 90s


listen here

Talk Webcasting .com - The Webcaster's Second Home
Thebig429 is offline   Reply With Quote
Old 21st March 2008, 00:26   #16
fc*uk
Moderator
 
fc*uk's Avatar
 
Join Date: Dec 2005
Location: Atlantic Beach
Posts: 8,142
My problem with these people is it appears as if they are providing a database of streams that can be accessed on mobile devices. Thats fine.

However, it appears as if they charge users to get this content. That is not so fine. Don't try to make money off us.

Everytime I see the agent, I ban the ip.
fc*uk is offline   Reply With Quote
Old 21st March 2008, 00:34   #17
Thebig429
Senior Member
 
Thebig429's Avatar
 
Join Date: Apr 2006
Location: Right here!
Posts: 358
I agree fc*uk
And it took them a long time to come out of the closet.

Cadillac Radio
Classic rock from the 60s to the 90s


listen here

Talk Webcasting .com - The Webcaster's Second Home
Thebig429 is offline   Reply With Quote
Old 21st March 2008, 02:20   #18
Greg_E
Major Dude
 
Join Date: Nov 2006
Location: USA
Posts: 1,687
You could try keeping track of the number of times it connects and then send the company a bill to cover your expenses. I think if people push them it will stop pretty soon. And I bet it has to do with being listed in the YP, which coiuld be a violation of the rules.

Maybe the Shoutcast people will make a mobile listing.

Your mileage may vary!
Greg_E is offline   Reply With Quote
Old 21st March 2008, 12:05   #19
fc*uk
Moderator
 
fc*uk's Avatar
 
Join Date: Dec 2005
Location: Atlantic Beach
Posts: 8,142
it is directly related to being connected to the yp. My unlisted servers never got this.

The connection attempts are generally under 60 seconds and come once every 16-24 hours or so. At least with me...
fc*uk is offline   Reply With Quote
Reply
Go Back   Winamp & Shoutcast Forums > Shoutcast > Shoutcast Technical Support

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump