XoviBot (XOVI) — the verified crawler ranges, smoking-gun PTR and the mixed-pool trick
by shop owners for shop owners.
The IP ranges of XoviBot (XOVI SEO suite, Cologne) to block or allowlist — plus why XOVI publishes no official IP list and how we proved the main pool 78.138.117.0/24 via subnet scan, ASN aggregation and a smoking-gun reverse DNS.
XoviBot is the crawler of the Cologne-based XOVI SEO platform (backlink index, keyword tracking, rank monitoring). XOVI publishes no official IP list. We proved the active ranges across three sources — tracker databases, ASN aggregation and a full subnet scan with one unambiguous reverse-DNS hit. Part of our PARC Security feed.
xovibot.json — view feed XoviBot info →
The ranges
1 CIDR + 8 individual IPs = 9 entries, all at German Tier-2 hosters:
78.138.117.0/24 Main pool — PlusServer (AS61157), whole /24
85.114.158.169/32 MyLoc / WIIT (AS24961) — 6 PTR-free slots
85.114.158.174/32
85.114.158.179/32
85.114.158.206/32
85.114.158.209/32
85.114.158.210/32
212.224.119.138/32 firstcolo (AS44066)
212.224.119.141/32
As a Cologne company, XOVI logically sits with German hosters that classically house SEO/marketing tools.
No official list
The crawler info page xovibot.net only contains an FAQ, the user-agent and a robots.txt guide — no IP list. There is also no external spam-database validation: XOVI behaves like Seobility, i.e. it is not classified as a spam bot. So the evidence has to come from reverse DNS, ASN plausibility and third-party consensus.
Three sources, one consensus
| Source | Finding |
|---|---|
| 1 · Tracker databases (udger.com as the main source, 8-language marathon) | 21 plausible IPs across 4 hoster clusters. Hardly any international hits — XOVI is mainly visible in DE/AT/CH. |
| 2 · ASN aggregation | Concentration on four German Tier-2 ASNs: PlusServer, MyLoc/WIIT, firstcolo, TOPSNET. |
| 3 · Subnet scan (ICMP + dual-resolver DNS) | 78.138.117.0/24: 256/256 alive, 0 customer hostnames, a single PTR — and that one is the smoking gun. |
The smoking-gun PTR
When scanning the main pool, all 256 IPs answered but carried no customer hostname — except one:
78.138.117.118 → webmail.xovi.net
XOVI’s own service hostname right inside the crawler /24. That’s the unambiguous ownership proof: PlusServer rents the whole /24 to XOVI, the crawler rotates PTR-free (recon minimisation), but XOVI’s mail service gives the pool away. A classic pattern — identical to Moz/DotBot at Wowrack. This makes the /24 aggregation safe and proven.
Why 85.114.158.x only as /32 — not as /24
The secondary pool at MyLoc/WIIT is a mixed pool: 13 of the 256 IPs carry customer hostnames — WIIT backbone routers plus real third-party customers (maxicomputer.de, schelter.org, dss-hamm.net and others). A /24 block would take those down too — not acceptable. So only the 6 PTR-free individual /32 (the likely XOVI slots) are in the feed, not the whole subnet. Exactly this distinction — a full /24 only for a clean pool, otherwise /32 — is the core of our methodology.
Honest: a quiet crawler
Unlike Moz/DotBot (10,495 hits in 60 h from a single /24), XOVI crawls quietly — our own SafeLine telemetry shows very low frequency so far. The feed therefore works precautionarily, not reactively. If telemetry over the coming days shows more IPs actively crawling (e.g. more from the 85.114.158 range or a new PlusServer /24), we add them; firstcolo/TOPSNET addresses that never show up get dropped at the next consolidation.
User-agent
Mozilla/5.0 (compatible; XoviBot/2.0; +https://www.xovibot.net/)
Robots token: XoviBot (respects robots.txt). As a second layer to the IP block, a user-agent block on XoviBot/ is possible (e.g. in SafeLine).