What is WinampCheck ?

[unknown-name]

I have no idea if this someone connecting or what, but I keep seeing this in the log:

<09/06/06@18:27:40> [dest: 217.xxx.xxx.xxx] starting stream (UID: 516)[L: 2]{A: WinampCheck/5.1}(P: 1)
<09/06/06@18:27:40> [dest: 217.xxx.xxx.xxx] connection closed (0 seconds) (UID: 516)[L: 1]{Bytes: 14298}(P: 1)



What is WinampCheck/5.1 ? Is it some new shoutcast thing or is someone maybe playing funny buggers (I've xxx'd the IP just in case)?

[fc*uk]

well, it could be someone running winamp under linux. I know that will cause winamp to connect funny sometimes.

However, like you, I would ban the IP. This smells odd.

[unknown-name]

You'd ban my IP? wha?? I don't get it.

Meh,anyway, it's banned now, and it tries to connect exactly every 15 minutes, not a second before or after, so it's definitely something shifty going on.. I just don't understand what it's doing, or its purpose.

If anyone else has this in their logs I'd be interested to know. Cheers.

edit:
I checked the Host Name of the IP, and the last bit of it is mobilaria.com, which is some website from the Netherlands, to do with mobiles or something.

[Jody Thornton]

<08/20/07@21:36:52> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:39:55> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:41:53> [dest: 87.249.112.131] IP in ban list, disconnecting
<08/20/07@21:42:59> [yp_tch] yp.shoutcast.com touched!
<08/20/07@21:46:02> [yp_tch] yp.shoutcast.com touched!

This guy keeps connecting once an hour, on the hour at :37 or :41 minutes. I also traced this IP to the Netherlands. What gives.

Cheers,
Jody Thornton
(Hamilton, Ontario)

[hackerdork]

with more than 30 billion internet users it can be anyone probing for media, from a hacker, a script, a downloaded or just some punk. I would take too much stock in most of the weird stuff in my shoutcast logs unless there is a problem, then I ban that IP on the firewall not on shoutcast and they never even see my SC traffic.

[fc*uk]

Anyone ever get this sorted?

I have a huge insurgency of this lately. Connects every hour for about 60-62 seconds (until I banned it).

As I recomended months ago, I banned it as of 6 am this morning (I go to work early).

<11/07/07@06:52:12> [dest: 87.249.112.131] starting stream (UID: 3614)[L: 1]{A: WinampCheck/5.1}(P: 0)

IP traces to Amsterdam for what its worth.

[zollymonsta]

I've traced this to virtu.nl

Sending them an email to investigate further. I'm getting this connection every 30 minutes. I notice they host media servers as well as webhosting.

Will post anything I find out

[remco_k]

Originally posted by zollymonsta
I've traced this to virtu.nl

Sending them an email to investigate further. I'm getting this connection every 30 minutes. I notice they host media servers as well as webhosting.

Will post anything I find out

I did the same a few days earlier at 12-11-2007. Asking what they are doing, why and with what.
And I did get a response (13-11-2007) from virtu saying that they forwarded my question to their customer.
As of this post, no reply came from there.


It's obvious I have the same problems as described earlier, started on 31-08-2007:

<08/31/07@15:04:37> [dest: 87.249.112.131] starting stream (UID: 33305)[L: 9]{A: WinampCheck/5.1}(P: 0)
<08/31/07@15:04:37> [dest: 87.249.112.131] connection closed (0 seconds) (UID: 33305)[L: 8]{Bytes: 8192}(P: 0)

Since then, exactly every half hour this happens. 24 hours a day, 7 days a week.
Since I did'nt get a response from virtu's customer, I recently banned this IP.
So this:

<11/19/07@10:30:29> [dest: 87.249.112.131] starting stream (UID: 966717)[L: 13]{A: WinampCheck/5.1}(P: 1)
<11/19/07@10:30:29> [dest: 87.249.112.131] connection closed (0 seconds) (UID: 966717)[L: 12]{Bytes: 8192}(P: 1)

Was the last winampcheck that we allowed on the destination ip: 87.249.112.131

Whenever I do get a response from virtu's customer here in the Netherlands, I'll let you all know in this topic.
So, what is it what tey do? Thats the big question I guess.
It could be they are gathering some kind of data about different streams. Or probing for online/offline streams.
Maybe selling this data commercially to 3rd party companies, or publicate it on a website somewhere.
Or they are scanning for online streams, giving this info to companies like Buma/Stemra and Sena (For music rights here in NL). Now we have a legal stream, paying nicely for al the rights and goods, so we have noting to fear at this point.

Until then, not knowing what they are doing with this winampcheck, I recommend everyone to ban the destination IP 87.249.112.131

[OCSDRadio]

That address: 87.249.112.131

Was doing the same shit to my stream for about a week before I banned it, I still see it once in a while try to connect again but he can't get in.

[DJQUICK-E]

Has anyone gotten an answer to this yet?

[zollymonsta]

Nope... initial email answered 'we'll investigate'... followups emails un-answered (three so far).

Best you can do it pernamently block that ip address. Seems the ISP isn't interested.

[remco_k]

So, after a few months I did'nt get a response either from Virtu's customer.
Just send them an e-mail as reminder. See what happens now.

[zollymonsta]

Originally posted by remco_k
So, after a few months I did'nt get a response either from Virtu's customer.
Just send them an e-mail as reminder. See what happens now.

I doubt you will hear anything from them.

I sent 3 to 4 reminders over a period of a few months ago and there has been no reply since my first enquiry..

[aaronsnet]

My stream is scanned everyday with a programme called NSPlayer or Tunin.FM Check. Why?

NSPlayer and Tunin.FM Check simply checks if your server is still available.

NSPlayer Tunin.FM Check are checkscripts operated by a company called Mobilaria, based in the Netherlands.

Mobilaria is a Mobile Streaming Media company providing a Mobile Radio service called Tunin.FM.
Tunin.FM is a directory service providing access to internet radio streams for mobile phones. Your listeners are no longer limited to their PC at home but can select your stream from a list in their mobile phone.

The checkscripts NSPlayer and Tunin.FM Check checks periodically the availability of the radio streams listed in Tunin.FM as to avoid that listeners are confronted with unavailable streams.
What happens when my server is temporarily offline?

If for any reason the check script cannot connect to a streaming server, then the corresponding radio stream is deleted from the directory list.
This means that listeners worldwide can no longer listen to your stream on their mobile phone.
What happens when my server is online again?

The check script runs frequently, when the check script connects to the streaming server, the radio stream is published in the directory service Tunin.FM again.
How much load do the checkscripts generate on my server?

The load the checkscripts generates on your server should be neglectible. The script runs periodically but usually just once every 15 - 30 minutes and it only sends one request to the streaming server.
When the server answers, the script is satisfied and drops the connection. If the server does not answer, NSPlayer and Tunin.FM Check drops the connection after a few seconds and it tries again later.
Thanks for this information, but I still have some questions.

Sure, please contact Mobilaria directly via email. helpdesk@mobilaria.com

http://www.mobilaria.com/scan-faq-en

[Thebig429]

Yea now when winamp check connects it has a link with the info what it is
http://www.mobilaria.com/scan-faq-en

[fc*uk]

My problem with these people is it appears as if they are providing a database of streams that can be accessed on mobile devices. Thats fine.

However, it appears as if they charge users to get this content. That is not so fine. Don't try to make money off us.

Everytime I see the agent, I ban the ip.

[Thebig429]

I agree fc*uk
And it took them a long time to come out of the closet.

[Greg_E]

You could try keeping track of the number of times it connects and then send the company a bill to cover your expenses. I think if people push them it will stop pretty soon. And I bet it has to do with being listed in the YP, which coiuld be a violation of the rules.

Maybe the Shoutcast people will make a mobile listing.

[fc*uk]

it is directly related to being connected to the yp. My unlisted servers never got this.

The connection attempts are generally under 60 seconds and come once every 16-24 hours or so. At least with me...