This is 100% the expansion, look here.

https://www.robtex.com/dns-lookup/koboldsandcatacombs.com

Looking at it in more detail the domain points to 24.105.29.30

Which in turn points to:

We investigated 93 host names that point to 24.105.29.30 . Example: heroesofthestorm.com.br, beta-us.battle.net, blizzardallstars.de and thegrandtourney.com. We estimate that it is used as ip number by 158 host names.

A whois on that IP:

24.105.29.30 whois
BLIZZARD ENTERTAINMENT (BLIZZA-3) route
24.105.29.0/24 bgp AS57976 asname
BLIZZARD Blizzard Entertainment, Inc descr
Blizzard Entertainment location
Irvine, United States

From a network engineering standpoint, Iran is politically fucked.

This is the government owned ISP which controls (at OSI layers 1 and 2) the links to all neighboring countries and international IP transit:

http://bgp.he.net/AS12880#_asinfo

https://www.robtex.com/as/as12880.html

All "licensed" ISPs in Iran have to be downstream of it (or downstream of one of the adjacent Iranian ASNs you will see as its BGP neighbors, which are large ISPs). There is simply no legal way to buy a transport circuit or wavelength to Istanbul or elsewhere and do your own pipe.

This greatly facilitates the installation of deep packet inspection equipment and arbitrary traffic shaping/blocking.

You have at this moment 2 important Android wallets.

First one is Eclair, from ACINQ. You have standard bitcoin send and receive, and Lightning payment. No receive on Lightning. I have a channel open with ACINQ from begin april 2018, and all payments work fine.

Second is "Bitcoin Lightning Wallet" from Anton kumaigorodski, based on the code from Eclair. Here you can send and receive with Lightning.

Major Difference:

Eclair does the routing on the phone, and that's why you, till now, can not receive via Lightning. Of course you can receive standard bitcoin transactions.

Lightning Wallet outsource the routing to Olympus servers. That make it possible to accept LN payments.

For merchant side, you have several solutions for accept Lightning.

Specific the routing part, the routing works fine.

This website gives the list from LN Mainnet nodes.

https://www.robtex.com/lightning/node/

You have 2495 Nodes, 9060 open Channels. (Only full bi-directional working channels, the only-receive channels, example eclair wallet, are not in the list.)

For reach every other node, there is a Maximum from 6 hops.

Here and there you have a Lightning payment problem. But this is most of time with a new merchant, who do a personal node setup and his first node setup need some extra channel updates.

When you outsource the Lightning payment, all works fine,

If you need all the technical details, https://github.com/lightningnetwork/lnd/

also ignore the DNS records that show up.... concentrate on the IP only. Maybe the hosts file on your MAC points to this IP for this domain... to hide its tracks.

Pretty sure you have some malware on your machine.

If you want detailed info on domains, IPs, routing etc. use https://www.robtex.com/en/advisory/dns/gov/gpo/www/

Top left -> enter something -> all the info you ever need

https://www.robtex.com/dns-lookup/[domain.tld]

For example: https://www.robtex.com/dns-lookup/reddit.com

Or https://dnsdumpster.com

You can also look at their certificate transparency report (if they have https enabled)

MX record shows office.com with google backup.

dig mx hrcoffice.com +short 20 alt1.aspmx.l.google.com. 20 alt2.aspmx.l.google.com. 10 aspmx.l.google.com. 30 aspmx2.googlemail.com. 30 aspmx3.googlemail.com. 0 hrcoffice-com.mail.protection.outlook.com.

https://www.robtex.com/en/advisory/ip/216/32/180/10/

One thing about lightning is that the nodes don't have to see *all* transactions, as on blockchain. The nodes only see the ones that passes thru them, but encrypted. Also they can not see the ultimate source or destination, just the nearest node it came from and to what node it should route it.

Even for instance when you pay invoice to moneni, we can't see the source, even though we are the destination. We only know which invoice has been paid.

The network has about 8000 public channels and nobody knows how many private channels. https://www.robtex.com/lightning/node/

The bigger the network gets, the more decentralized it will be, and the less you can figure out. Not even the big nodes can guess where packets are going.

Several more people have opened channels with it. https://www.robtex.com/lightning/node/024655b768ef40951b20053a5c4b951606d4d86085d51238f2c67c7dec29c792ca

>Full name Address Social Media Phone number (likely home phone if you have one) Marriage status Name of Spouse AND children

Lol, no. You can only retrieve a user's:

• Approximate location
  • City
  • State
  • Country
• Internet service provider
• Domains that resolve to this IP (if indexed)

So please, quit your bullshit and stop talking about stuff you don't know about.

Here's a good example using my IP address. Nowhere will you see my marriage status, phone number, or even name. ISPs keep that stuff private according to their privacy policies. (Unless, of course, the government has a warrant.)

^^(just ^^because ^^it's ^^on ^^the ^^internet ^^doesn't ^^mean ^^it's ^^true)

> Each hop must have 1BTC capacity between me and a friend, but the last hop(my node) does not? Is this correct?

It is partially correct. At the moment, yes you would need a chain of capacity. There is one part of LN not yet active, called Atomic Multi-path Payments (AMP). You can see a simulation of how it may work here. AMP can use channels multiple times to execute a payment greater than the internal network capacity to move funds.

The early technical discussion is here

> In theory shouldnt the friend just direct connect to me and therefore doesn't need to worry about remote capacity?

That would be the easiest for sure. And if sending a large amount like 1BTC, it would be the best way to do it too. If the friend is spending that 1 BTC over LN, that channel can stay open and be used in the future to make purchases for goods and services over LN. This would save the cost of additional transaction fees to spend that 1 BTC, and would provide privacy in how those funds were spent.

​

1) Eclair for android uses electrum servers randomly like a electrum light wallet uses . you can specify your own electrum server or EPS if your prefer in the settings

2) No, not with eclair for android. you would need to run your own lightning full node and provide liquidity for this. Lightning is so inexpensive to use the fees you would collect aren't really a consideration FYI if you are trying to make profit unless you provide a lot of liquidity

3) Please clarify what version of eclair you are referring to ... the android right , or are you discussing running a full node - https://github.com/ACINQ/eclair

4) Closing a channel and a full node going offline and being unresponsive are 2 different matters. If node A closes their channel with 1 BTC it doesn't effect the channel Node B opened with node A back ... one can close and the other stay open

5) What you are referring to here is AMP or Atomic Multipath Payments in lightning that allow you to spend from multiple of your channels

https://bitcoinops.org/en/topics/multipath-payments/

eclair 0.3.3 and beyond support multipath payments

here is a simulator-https://www.robtex.com/lnemulator.html

First IP doesn't resolve. More than likely something spooled up in a VM.

The second is a site hosted through GoDaddy, an Akami name server.

https://www.robtex.com/ip-lookup/182.50.136.237

Those may be legitimate, but you'll have to drill down your apps using a firewall to see which ones tried to communicate with those IPs to know more.

Nice work! Did you filter out the nodes that can't even afford a coffee at all even if it was directly connected to the coffee shop?

According to my database, there are 1876 nodes with any balance at all, and only 1513 nodes that have at least 0.0004 BTC.

(fetched those numbers from my database behind https://www.robtex.com/lightning/node/ )

So if you use the number of nodes from gaben.win you have to take into account that 33% of them have too small wallets to be able to buy (or sell) a coffee at all, so of course no matter how hard they try, they still can't afford the coffee.

Also it would be interesting if you made an analysis including AMP payments to show how much it would help.

Thanks

> I cannot route from Alice to Carol if Bob doesn't have at least that amount.

Yes, that is correct depending on the network topology. The demonstration network topology is unrealistic, as it ignores the rest of the network, which in reality is much more complex.

I like this example to illustrate things which happen when the network is more complex:

https://www.robtex.com/lnemulator.html?conf=A10B,A5C,B10C,B5D,C10D&send=A15D

Here, the channel between Bob and Carol is used twice (once each way) in a single payment. It's an interesting emergent effect to be able to do non-intuitive things like this in a complex network.

I still stand by my statement on 0-conf. I'm not saying it's wrong to use 0-conf, I'm saying that it is not cryptographically secure, which is true.

I personally think a larger block size is a good idea for immediate scaling. However, I also think that other solutions (like Layer 2, and different signing/block schemes) should be explored to improve utility even more over the long term.

To reply to your question:

> And why would you go through all the hassle of setting up the channels and the LN node? There is no reason for people to do that when they can immediately ping any address with a blockchain network.

LN (layer 2) is for long-term capability. You can have millions of transactions, instantly cryptographically secured, for the cost of 2 on-chain transactions. That is amazing scaling. Does it come with a cost? sure. But if a Layer 2 network can be set up for use-cases where it makes sense, then it would relieve lots of pressure on the blockchain, allowing your "ping anybody on the blockchain" to work well into the future, and better. Plus, running a LN node allows you to earn fees for facilitating transactions. This again democratizes the cryptocurrency so that it's not only miners who are incentivized to "contribute" to the functioning of the network.

I fed the URL to URLQuery, which showed no alerts for the site. However, as I noted in my edited post description (above), robtex.com tracks this website to... https://www.robtex.com/dns-lookup/brutegenie.com#analysis

:-)

Robtex is very good, you can do free search for a company name but the results are rarely good for that. If you get an AS number or know a single IP address it is easy to lookup the blocks.

I found the edit that referenced "Inside Narcotics" on the Methaqualone page and all it shows is an IP address for some place in Wisconsin? No username.

Here's a link to that user's page: https://en.wikipedia.org/wiki/Special:Contributions/69.95.162.124

And here's where I found the location info: https://www.robtex.com/ip/69.95.162.124.html

This seems to be a legit email from LinkedIn. Here's why:

The reply-to email shows: e.linkedin.com. That's a sub-domain of linkedin.com. The sub-domain resolves to 162.223.232.72. Which is an IP that belongs to Responsys Inc.

This is also evident if you type: "e.linkedin.com" to your browser. That will take you to a "Responsys® Permission Marketing Policy."

Looks like this company, Responsys, is a marketing company owned by Oracle.

It's not uncommon for large businesses to outsource marketing, surveys, etc.

quick and dirty.

$InvokeWHOISinfo = Invoke-WebRequest -Uri 'https://www.robtex.com/ip-lookup/8.8.8.8' -UseBasicParsing

$fasterHTML = New-Object -Com "HTMLFile"

$fasterHTML.IHTMLDocument2_write($InvokeWHOISinfo.RawContent)

$section = $fasterHTML.getElementById('rtfrage_dnst')

$table = $section.getElementsByTagName('table')

@($table)[5].innerText

I don't know about the Milan Summit, but the maximum channel size is definitely 0.16777216 on the live network currently. You can see this node for instance has opened many .16777216 capacity channels: https://www.robtex.com/lightning/node/03cb7983dc247f9f81a0fa2dfa3ce1c255365f7279c8dd143e086ca333df10e278

Here is the network information from ACINQ, the developers of Eclair.

https://www.robtex.com/lightning/node/03864ef025fde8fb587d989186ce6a4a186895ee44a926bfc370e2c366597a3f8f

You can see that at the moment for ACINQ:

• connected channels: 75

• connected nodes: 59

• The Eclair wallets, who have a channel to ACINQ are not in this list.

You can see it graphical:

https://lnmainnet.gaben.win/#

In the search box, upper left corner, you can type ACINQ, and than you see the connection to the other nodes, but not to the Eclair wallets.

https://www.robtex.com/lightning/node/

This site gives a nice update from lightning Network.

Number of open Mainnet Nodes: 2411. Total of open Channels: 8912. Total channel Capacity : BTC 21.78848171.

In my Opinion, the total number of open Mainnet Nodes is not so important, you need nodes with open channels. .

You have 609 nodes with 0 channels. That makes than 2411 - 609= 1 802 Nodes.

The 8912 Channels are all channels what you can use for routing. For example, an Eclair channel from the app to a Node is not in this list.

Second important part, is the routing. In how many hops can you reach the complete network. At this time, for some nodes, you need Maximum 6 Hops for reach all the nodes. But most of the nodes do it in 4 hops, where 5 and 6 are an exception.

You are discussing a different issue with your 1 BTC point. The question was about participating as a routing node. If Bob is the routing node, with AMP, Bob does not need 1 BTC capacity. Just any capacity. The total capacity between Alice and Carol has to be 1BTC, but that could include 10s or more of routes. See also my discussion here

There is a cool simulator for AMP here: https://www.robtex.com/lnemulator.html

I also think that 1 cent fee is too high, and it is not instant on-chain (not cryptographically secure until mined into a block - just in a volatile distributed mempool until then). LN transactions are still instant, and they are cryptographically secure.

As for fees, LN routing fees creates a "race to the bottom" for fees. I'm seeing fees of no more than 3 Satoshi at this time, and it's only going to get cheaper. The LN protocol supports down to 0.001 Satoshi fees, which will then be rounded on channel close.

I'm not saying there are no weaknesses in LN. There are. Having an always-on hot wallet is one (security challenge).

Play with it yourself in LN emulator: https://www.robtex.com/lnemulator.html?conf=A20B,A7C,B3D,C20D,D8E,E20F,B3G,G3H,H3I,I3J,J1K,J2L,L1K,K3F&send=A10F

This shows both today state and when AMP will be deployed

Try to scan this QR code to open a direct channel with me https://www.robtex.com/lightning/node/039195c0969d69f9a25839cb44bd5e858bd9e3971638959f0e657bffa6692b43f1 I believe that migh solve the isssue of Ecliair liquidity.

Hey - I'd check their DNS records, see who is hosting their website and email. See if they host it or if some other company hosts it. See who the domain is registered to is it a third party?

I've had great success with: https://www.robtex.com/

So, why the above? I like to know if i'm going to be maintaining exchange, if I'll be dealing with users complaining about spam, how many vendors are involved, sometimes you can even figure out what core system the bank is using depending on who hosts the website / dns. Is it Fiserv/FIS/Jack Henry etc. VERY IMPORTANT TO KNOW. I'd straight up be like, who is your core, is it in-house or outsourced. CRITICAL. Banks with inhouse core is just a mess, a mess. You have to deal with 100 moving parts under time crunch with dubious instructions, typically there is one lady who knows how the core works and its a huge hassle.

So other questions - I'd want to know how many servers I'm getting into, are they virtual? What kind of Active directory (Domain trusts, etc), do they have a web filter? How are the branches connected!!!! OH SON, how are the branches connected? VPN's? MPLS? FRAME FRIGGIN RELAY? I'd ask that. You could be getting into a juniper or some kinda thing.

Might also see if the AVP handles the IT audits, that is a huge pain man.

Also atms, are they on the network, managed by the vendor? etc etc.

to be honest, if you went with them I'd have a backup plan. Banks are outsourcing their IT departments and merging at a rapid clip. I'd keep an eye on that.. If your bank sells out you'll be looking for a job.

I've tried compiling a list of domains and IPs for splitting network traffic to Netflix from your VPN.

The domain that will cause the most hassles is s.thebrighttag.com. You have to find every single IP associated with that domain to whitelist, otherwise Netflix will say that you're behind a proxy.

Here's the list of domains and IPs that I have found:

• netflix.com
• www.netflix.com
• codex.nflxext.com
• assets.nflxext.com
• push.prod.netflix.com
• anycast.ftl.netflix.com
• oca-api.netflix.com
• customerevents.netflix.com
• api-global.netflix.com
• tp-s.nflximg.net
• art-s.nflximg.net
• s.btstatic.com
• adtech.nflximg.net
• cdn0.nflximg.net
• secure.netflix.com
• s.thebrighttag.com
• td.thebrighttag.com
• 54.228.243.156
• 79.125.117.125
• 46.137.81.30
• 52.30.5.88
• 54.228.243.159
• 54.195.251.142
• 46.137.100.137
• 52.208.178.181
• 54.228.218.9
• 46.137.100.162
• 46.137.81.30

You may also have to use the network section of the web inspector for your browser to find the domain names of the servers that your ISP uses to stream Netflix to your house. You have to use the web inspector off a VPN for this to work. The domains that ISPs use will look like the one below and there are usually several of them.

ipv4_1-lagg0-c001.1.region.isp.nflxvideo.net

A browser's web inspector will help you discover any domains that I have missed. As I said before s.thebrighttag.com is the biggest pain in this process. If you every find that Netflix is blocking you after successfully getting it to work previously, you should do a DNS lookup of s.thebrighttag.com from your computer and see if there are any new IPs to add to the list.

I hope this helps.

EDIT: There appears to be a subdomain of r.nflxso.net that gets used but it's different for every connection.

EDIT: I used Robtex DNS Lookup to find a whole bunch of those nflxso.net domains: https://pastebin.com/RJtnTZtM

I would immediately open a ticket with Paypal though. It is a pre-emptive measure to note the date/time of the incident and create a record in the event Usenet.nl uses strong arm tactics and attempt to bill you through Paypal or send you to collections.

Right now your only official record is correspondence via email with Usenet.nl.

Edit

In your Paypal ticket you might also want to include r/usenet links to topics about Usenext.de shakedowns.

Even though each website and domain registry records show different contact info, there is evidence to point to that Usenet.nl is owned by Aviteo Limited, the company that owns Usenext.de

https://www.robtex.com/advisory/dns/de/usenext/
https://www.robtex.com/advisory/dns/nl/usenet/

Usenet.nl is configured to point to similar IP ranges as Usenext.de. mail1.usenet.nl (212.72.38.199) is within Level3 IP block 212.72.32.0/19 assigned to Aviteo Limited (owner of Usenext.de)

Those coming from Netherlands most probably aren't.

Considering this http://en.wikipedia.org/wiki/List_of_international_submarine_communications_cables and some info/experience from this: https://www.robtex.com those hits from NL were from a TOR exit node or a proxy from a dynamic IP block of some mobile ISP or a hosting company that served as a relay for someone.

You can see the provider listed in the exchange in here:

https://www.robtex.com/as/as7717.html

Singtel is not there... but there are "singtel reseller" there who use underwater cable from sg-jkt.... its a quiz... try to figure it out... lol

PM me again if you want to know the answer quickly :P (again... I won't named any provider)

> What links that to your ISP though?

https://i.imgur.com/MjOJcH5.png

And who they were

https://www.robtex.com/dns-lookup/tandc-browsermessaging.charter.net

They have since been renamed Spectrum

If there's an interest...

1337x.to SEO data Ranked as #235 according to Alexa Ranked as #46103 according to Cisco Umbrella Ranked as #89440 according to Majestic

https://www.robtex.com/dns-lookup/1337x.to

https://www.robtex.com/dns-lookup/pornhub.com

Your looking for the results for the window titled Threatminer. Any entries should be a concern (and avoided) - this isn't a good way to find trust in a website, but I use it.

Appears to be Google.

May 11, 2019 — "Images found on https://encrypted-tbn0 x gstatic x com/ are the cached version of the image stored on Google's servers to speed up the delivery

Threatminer has entries https://www.robtex.com/dns-lookup/encrypted-tbn0.gstatic.com And appears to also be an image.

Many sites will redirect you rather than edit everything to the new IP address

Use Robtex.com to view your questionable link, the one before redirection.

This site redirects: Systernals.com -and has since they purchased website years ago

I would be more concerned of facebook if I were you.

https://www.robtex.com/dns-lookup/facebook.com check the THREATMINER

[root@vpn ~]# cat /etc/openvpn/server/server.conf port 1194 proto udp dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/VPNServer.crt key /etc/openvpn/server/VPNServer.key dh /etc/openvpn/server/dh.pem server 10.0.0.0 255.255.255.0

ifconfig-pool-persist /etc/openvpn/server/ipp.txt 0

duplicate-cn cipher AES-256-CBC tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256 auth SHA512 auth-nocache keepalive 20 60 persist-key persist-tun compress lz4 remote-cert-tls client daemon user nobody group nobody status /var/log/openvpn-status.log 60 status-version 2 log-append /var/log/openvpn.log

ccd-exclusive

client-config-dir /etc/openvpn/ccd verb 3 management localhost 7000

plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so login

Push routes for clients. Use https://www.robtex.com/ to find IPs for domain

push "redirect-gateway def1"

push "route-gateway 1XX.1X5.XX.XX"

push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4"

push "route 0.0.0.0 255.255.255.255"

>why would this show up on Edge but not on Brave?

edge is a bastardization of Chrome, expect anything.

And the site shows no problems https://www.robtex.com/dns-lookup/kungsangen.com#threatminer

That link to Robtex.com was because they used to be the best now they are changing things and much has been removed. I hate to say this but Robtex is or was a Google site. Robtex gives the same result as testmy.net https://www.robtex.com/dns-lookup/robtex.com

Yea, but they kinda hide the fact. If you follow the TOS it branches and then your reading the familiar Google TOS, that was was 5 years ago. https://www.robtex.com/dns-lookup/testmy.net

​

Edit: I should mention new owners had popped into the message base, saying how nice Google has been to them at which point I posted it being a Google site which they agreeded to.

I've stumbled over the same URL. I guess it's screenshots of your current screen that are being sent to Samsung? The fun part is that this is a CNAME for Cloudfront. In other words if it IS screenshots, those are also hosted on AWS.

Looks to just be some spam to me:

https://www.robtex.com/ip-lookup/104.31.84.90

​

That's the IP given to that website, checked a DNS blacklist and it seems safe. Probably just an ad you accidentally clicked on or a website redirected you to it. Nothing to worry about! It's rare nowadays since windows 10 that you get anything but adware from just browsing the internet, just don't download and run anything stupid!

howdy ImprovingPiano,

using Invoke-WebRequest takes freaking forever for me, so i gave up and used Invoke-RestMethod instead. [grin]

$Url = 'https://www.robtex.com/ip-lookup/8.8.8.8' $RobTex_Lookup = Invoke-RestMethod -Uri $Url

$Null = $RobTex_Lookup -match 'It is (?<HostedBy>hosted by.+). We'

$Matches.HostedBy

output = hosted by SP_BEEKSFX

hope that helps,
lee

Most bots are going to be in a range and that range is typically in a know data center allotment. I block large swaths of these junk IP ranges, especially anything from China or russia

123.123.123.0/24

123.123.0.0/16

and anything in between. https://www.robtex.com/ is great for finding an assigned range around a particular IP.

So I did a little research the IP address might be : 52.177.198.147 from https://www.robtex.com/dns-lookup/client.arenagame-b.east.magic-the-gathering-arena.com since it's same dns.

I try to [code]ping 52.177.198.147 ping 52.179.210.66 [/code]

Atomic Multi-path Payments. You can use multiple paths/channels to make the payment.

Technical details: https://lists.linuxfoundation.org/pipermail/lightning-dev/2018-February/000993.html

Technical simulation of how it will work:

https://www.robtex.com/lnemulator.html

Someone gave me the link to this simulator that helped me a lot to understand how it will works with AMP implemantation :

https://www.robtex.com/lnemulator.html?conf=A20B,A7C,B3D,C20D,D8E,E20F,B3G,G3H,H3I,I3J,J1K,J2L,L1K,K3F&amp;send=A10F

The reputation of that IP isn't good either - plenty of spam has been seen from it - https://www.robtex.com/ip-lookup/103.215.99.64#dnsbl .

• Block that IP on your firewall
• Claim your server and sign in to Plex
• Require secure connections

If there's any external devices that don't currently support secure connections, it's time for a cheap upgrade!

Hello. Robert from robtex.com here. Sorry to hear you feel it looks sketchy. We need some way of monetising the site, thus we have ads. We have recently slowly started also implementing a paid version where you will get more data and less ads. Work in progress. If there is anything else you feel is sketchy, please let me know. Our twitter @robtexdotcom is open for DM. Also please do check out the JSON API endpoints, those are guaranteed to not contain any ads. https://www.robtex.com/api/

well, yes they are sinkhole name servers...

> no, because ns1.csof.net and ns4.csof.net are answering DNS queries for the domains and the IP they resolve those domains to is actively hosting malware.

You cite a secondary source (Malwareurl.com) stating that csof.net pointed to something maliciously directly. I will ignore this claim until you provide a PCAP where csof.net actually resolved to something bad. With all weird stuff happening on DNS level during domain transfers I would be careful with such assumptions.

> Interestingly, there are a raft of other domains that are hosting DNS with csof.net that have been BGP blackholed (i.e. null routed.)

Exactly. That's one way to deal with domains you no longer expect value of when running a large-scale sinkhole.

You will further note that the vast majority of domains is pointing to 195.22.28.0/24 which belongs to CLARANET. Thinking of large sinkhole operators in Portugal... Well there is anubisnetworks after all, who are at least surprisingly hosting their stuff on CLARANET as well. You can always just ask them to confirm. ;)

I couldn't find anyone in the comments that posted this but Valve has the subdomain "xbox.steampowered.com". I'm guessing it is so that you can link your Microsoft and Steam accounts and have crossbuy between them. This is maybe to appease third-party publishers that don't want to make a separate Windows Store version of the game; So instead of getting a W10 version you get a Steam version.

Link: https://www.robtex.com/?dns=xbox.steampowered.com

This seems to be a legit email from LinkedIn. Here's why:

The reply-to email shows: e.linkedin.com. That's a sub-domain of linkedin.com. The sub-domain resolves to 162.223.232.72. Which is an IP that belongs to Responsys Inc.

This is also evident if you type: "e.linkedin.com" to your browser. That will take you to a "Responsys® Permission Marketing Policy."

Looks like this company, Responsys, is a marketing company owned by Oracle.

It's not uncommon for large businesses to outsource marketing, surveys, etc.

https://www.robtex.com/as/as49544.html#peers

I still stand correct i3d peers with xsnews either via hibernia or atrato. Though I was incorrect in saying that it doesn't peer with anybody else they indeed peer with Giganews and yeah you are correct they don't have any peering with Searchtech.

1. Do a google search, see if they have a physical address on google street view.
2. Check the domain records using robtex - eg, https://www.robtex.com/dns/amazon.com.html#result
3. Using the DNS records, check if the server is in the country you expect it to be(note: doesn't always work for larger companies that use cloud services)
4. Using the DNS records/WHOIS information, contact the registrar and ask for information about the business, eg a contact number or email address.
5. If the country enforces it (eg, Australia for .com.au addresses), verify via the DNS/WHOIS record that it is owned by the company that it is.
6. Do a search for the company using the government business registration pages, eg, the SEC^american if it's listed. In Australia it would be their ABN^Australian. Check if their records look dodgy. You may have to check with the local state registers as well.
7. Make sure they have a phone number, google it and check it is used on that website
8. Look for delivery or pickup information, check that it matches what you expect and matches with the google streetview.
9. If the company is part of a "group" or has a "parent" company, call that company and ask if the site is legitimate.

If you still feel it's dodgy, get something like a Visa Debit Card, put on it exactly the amount you want to use so that they can't take more than you allow.

If you look at the IP, it did belong to GE Bank, and it does say the SPF matches:

https://www.robtex.com/en/advisory/ip/12/130/137/23/

Plus the actual domain for the bank redirects there:

http://synchronybank.com

Edit: to clarify, http://synchronybank.com redirects to the myoptomizerplus site, not the other way around.

Thanks for the link. I had used RobTex before for getting lists of sites that were on an IP.

Their reports are a bit of a mess, but seemed to have good info about things.

According to EURid the domains are registered to different parties at different addresses. They also connect to different AS', Cheapnews to A2B IP BV and Bulknews to XL Internet Services BV. Not definitive but I would say no, they are not related.

Это кому как повезёт. Раньше у Севстара был прямой основной линк от Datagroup. Сейчас канал идёт на некую «Miranda Media». А уже у Миранды есть пиринг с Datagroup и Ростелеком.
Если вкратце, то сеть 109.110.72.0–109.110.79.255 пока имеет доступ к ex.

They are supposedly based in Switzerland. Check commercial register: http://www.zefix.ch/ Try to search for "btc" or "arbs" => fail

They are supposedly using cloudflare. How exactly?

Also check whois records. Registrant Name: WHOISGUARD PROTECTED https://www.robtex.com/dns/btc-arbs.com.html

When was last time you saw a legit company that is actually hiding its "identity", yet advertising that you may visit its office (see FAQ)?

Up to you... "misplaced hope" vs "justified doubts"