CocCocBot (Cốc Cốc) — the verified crawler block and how we proved it via FCrDNS
by shop owners for shop owners.
How the PARC feed for CocCocBot was built: Cốc Cốc publishes no official IP list and runs no ASN of its own — we verified the crawler block 103.131.71.0/24 fully and bidirectionally via FCrDNS against *.coccoc.com.
CocCocBot is the crawler of Cốc Cốc, Vietnam's second-largest search engine (~574 million queries/month) and its own browser. Cốc Cốc publishes no official IP list and runs no ASN of its own. We therefore verified the active crawler block fully via bidirectional FCrDNS against *.coccoc.com. Part of our PARC Security feed.
coccoc.json — view feed Cốc Cốc — robots.txt docs →
The block
A single entry — 103.131.71.0/24 (256 addresses):
103.131.71.0/24
Bot trackers (udger.com) show 286 distinct active crawler IPs (coccocbot-web + coccocbot-image, last active on the day of research) — all within this /24.
No official list, no ASN of its own
Cốc Cốc publishes no crawler IP list. An ASN search for “CocCoc” comes up empty — the company has no autonomous system of its own. The block 103.131.71.0/24 is not announced standalone in the global routing table; it sits inside 103.131.68.0/22, visible via AS45899 (VNPT — Vietnam Posts & Telecommunications) (RIR: APNIC). Cốc Cốc runs the crawler from a VNPT sub-allocation. Verification therefore has to come from DNS.
FCrDNS proof — both directions, across the block
The .coccoc.com nameservers (ns1.coccoc.io, ns2.coccoc.vn, ns3.coccoc.io) belong to Cốc Cốc itself — so the company controls the block’s reverse DNS. Samples across the whole /24:
Reverse:
103.131.71.1 → bot-103-131-71-1.coccoc.com
103.131.71.50 → bot-103-131-71-50.coccoc.com
103.131.71.100 → bot-103-131-71-100.coccoc.com
103.131.71.150 → bot-103-131-71-150.coccoc.com
103.131.71.200 → bot-103-131-71-200.coccoc.com
103.131.71.250 → bot-103-131-71-250.coccoc.com
Forward confirm:
bot-103-131-71-1.coccoc.com → 103.131.71.1
bot-103-131-71-100.coccoc.com → 103.131.71.100
bot-103-131-71-200.coccoc.com → 103.131.71.200
Every tested host IP in the block carries a bot-{ip}.coccoc.com PTR and resolves forward back to the exact same address. Because this holds across the entire /24 — not just for individual IPs — the /24 aggregation is proven and free of collateral.
Current vs. historical
The user-agents active today (coccocbot-web/1.0, coccocbot-image/1.0) run exclusively from 103.131.71.x. Older Cốc Cốc user-agents (coccoc/1.0, imagecoccoc/1.0) ran until around 2016 from 123.30.175.x (leased VNPT/VDC legacy space) — those addresses have been inactive for years and are deliberately not in the feed.
User-agents
Mozilla/5.0 (compatible; coccocbot-web/1.0; +http://help.coccoc.com/searchengine)
Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)
Robots tokens: coccocbot-web / coccocbot-image.