I'm seeing a lot of hits on my website with the following user agent:
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
I'm trying to verify whether it really is from Facebook or a spoofing bot.
Using these these Facebook directions, I ran the following to get the real IPs:
whois -h whois.radb.net -- '-i origin AS32934' | grep ^route
That got me more than 800 IPs. They look a lot like the IPs I'm seeing, but not exactly.
For example, my website hits include:
2a03:2880:12ff:2::face:b00c
2a03:2880:13ff:f::face:b00c
2a03:2880:22ff:4::face:b00c
The whois list includes a lot that start the same, but no exact matches, for example:
2a03:2880:f310::/48
2a03:2880:f132::/48
Is that... close enough? Is there another way to check?
