homepage Welcome to WebmasterWorld Guest from 54.205.236.46
register, free tools, login, search, subscribe, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor
Visit PubCon.com
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

This 92 message thread spans 4 pages: < < 92 ( 1 [2] 3 4 > >     
Server Farms - March 2013
Ongoing WMW server farm report
wilderness




msg:4552057
 10:45 am on Mar 7, 2013 (gmt 0)

Continued from previous thread: [webmasterworld.com...]


The old thread has become too large, and there is no longer any method of linking to individual submissions within threads at Webmaster World, thus making the previous thread useless as a reference (they do come up in the search results).

Joe's Datacenter
JOESDC-02 204.27.56.0 - 204.27.63.255 204.27.56.0/21
JOESDC-01 208.94.240.0 - 208.94.247.255 208.94.240.0/21
JOESDC-01 69.195.128.0 - 69.195.159.255 69.195.128.0/19
JOESDC-01 96.43.128.0 - 96.43.143.255 96.43.128.0/20
JOESDC-01 2604:5800:: - 2604:5800:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[edited by: incrediBILL at 12:59 am (utc) on Mar 8, 2013]
[edit reason] Added link to previous thread [/edit]

 

wilderness




msg:4562411
 6:28 pm on Apr 7, 2013 (gmt 0)

88.115.2.170 - - [07/Apr/2013:09:40:42 -0600] "GET /MyFolder/SubFolder/MYpage.html HTTP/1.1" 403 644 "http://www.google.fi/oBSCURED" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0"
69.194.230.43 - - [07/Apr/2013:09:41:32 -0600] "GET /SameFolder/SameSub/SamePage.html HTTP/1.1" 200 20343 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0"

wilderness




msg:4562413
 6:29 pm on Apr 7, 2013 (gmt 0)

88.112.0.0/14
Elisa Oyj


If you'd look further down the RIPE page, you'd get:

role: Elisa Hostmaster

dstiles




msg:4562441
 8:20 pm on Apr 7, 2013 (gmt 0)

The word Hostmaster is not a guarantee. A lot of foreign-language - and even some English - DNS entries use the word to describe broadband-hosting as well as server-hosting.

A brief test on the Elisa range shows no actual open-port IPs and very few stealth-port (this was only a small IP sample!). Most return fully closed - ie normal broadband.

Apart from large companies such as G, MS and amazon very few /14 IP ranges resolve to monolithic server farms, especially outside the rather prolific USA.

I have only 15 IPs blocked (total about 30 hits) for all the Elisa ranges I have in my database, going back to 2010. This is a VERY low number for any given ISP range.

You may well be correct, but my own analysis satisfies me for now. :)

keyplyr




msg:4562445
 8:23 pm on Apr 7, 2013 (gmt 0)

Thanks for the ranges.

I concur. The term "hostmaster" really does not specify the role as web server hosting. IMO it really means the person/company responsible for hosting the range, like a webmaster is for a web site.

BTW Don, you're reported some of those Colo4 ranges before, just with different names (Colocrossing, Colo4Dallas, etc)

wilderness




msg:4562467
 8:51 pm on Apr 7, 2013 (gmt 0)

BTW Don, you're reported some of those Colo4 ranges before, just


keyplr,
I was almost sure, however was unable to locate any cross-references in my data.

lucy24




msg:4562547
 11:14 pm on Apr 7, 2013 (gmt 0)

am I missing something or is there a degree of tautology in your numbers?

Yes, you are missing something, and I bet you figured it out five minutes after the Edit deadline passed. I was pointing out glitches in the list directly above my post :)

keyplyr




msg:4562558
 11:43 pm on Apr 7, 2013 (gmt 0)


Just FYI to all (especially to cut'n pasters): It is wise to check & recheck all ranges in block or allow lists periodically and conflate where needed. Often times there are overlaps. I know I've found a few.

dstiles




msg:4562843
 8:38 pm on Apr 8, 2013 (gmt 0)

Lucy - sorry, completely missed that! :(

I must pay attention
I must pay attention
I must pay attention
I must pay attention
...

keyplyr




msg:4563004
 6:28 am on Apr 9, 2013 (gmt 0)



Scalematrix.com cloud hosting (San Diego)
199.187.240.0 - 199.187.247.255
199.187.240.0/21

wilderness




msg:4563028
 8:12 am on Apr 9, 2013 (gmt 0)

Scalematrix
SM-SANDIEGO-3 192.175.52.0 - 192.175.55.255 192.175.52.0/22
SM-SANDIEGO-2 199.73.48.0 - 199.73.55.255 199.73.48.0/21
SM-SANDIEGO-1 199.187.240.0 - 199.187.247.255 199.187.240.0/21
LVLT-SCALE-3-8-34-120 8.34.120.0 - 8.34.127.255

dstiles




msg:4563207
 7:39 pm on Apr 9, 2013 (gmt 0)

Thanks, Guys. All new!

keyplyr




msg:4563252
 9:08 pm on Apr 9, 2013 (gmt 0)





I saw their TV commercial yesterday then looked them up to block... probably not what they had in mind :)

wilderness




msg:4563607
 8:08 pm on Apr 10, 2013 (gmt 0)

NETROUTING-INC 199.71.232.0 - 199.71.235.255 199.71.232.0/22
NETROUTING 208.76.52.0 - 208.76.55.255 208.76.52.0/22
NETROUTING-DEDICATED-SERVERS 208.76.54.0 - 208.76.54.255 208.76.54.0/24
NETROUTING-INC 2606:ED00:: - 2606:ED00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

wilderness




msg:4564725
 3:34 pm on Apr 14, 2013 (gmt 0)

Didn't compare to larger backbones.

Windstream Hosted Solutions'
WHSL 199.233.224.0 - 199.233.227.255 199.233.224.0/22
WHSL-207-154-0-0-18 207.154.0.0 - 207.154.63.255 207.154.0.0/18
WHSL-207-254-208-0-20 207.254.208.0 - 207.254.223.255 207.254.208.0/20
WHSL-209-59-0-0-19 209.59.0.0 - 209.59.31.255 209.59.0.0/19
HSAL-216-27-0-0-18 216.27.0.0 - 216.27.95.255 216.27.0.0/18 216.27.64.0/19
WHSL-69-166-129-0-19 69.166.128.0 - 69.166.159.255 69.166.128.0/19
WHSL-74-213-128-0-19 74.213.128.0 - 74.213.159.255 74.213.128.0/19
WHSL-V6 2600:2C00:: - 2600:2C03:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

dstiles




msg:4564759
 8:40 pm on Apr 14, 2013 (gmt 0)

Thanks. I only had 3 of those, and they were listed under Hosted Solutions not Windstream.

wilderness




msg:4565684
 5:15 pm on Apr 17, 2013 (gmt 0)

LIONLINK NETWORKS
NET-199-19-99-0 199.19.99.0 - 199.19.99.255 199.19.99.0/24
NET-199-116-84-0-1 199.116.84.0 - 199.116.87.255 199.116.84.0/22
NET-23-29-52-0 23.29.52.0 - 23.29.52.255
NET-23-29-53-0-1 23.29.53.0 - 23.29.53.255
NET-23-29-55-0-1 23.29.55.0 - 23.29.55.255
NET-23-29-56-0-1 23.29.56.0 - 23.29.56.255
NET-23-29-57-0-1 23.29.57.0 - 23.29.57.255
NET-23-29-58-0-1 23.29.58.0 - 23.29.58.255
NET-LIONLINK 2604:DE00:33:: - 2604:DE00:33:FFFF:FFFF:FFFF:FFFF:FFFF
NET-LIONLINK 2604:DE00:32:: - 2604:DE00:32:FFFF:FFFF:FFFF:FFFF:FFFF

dstiles




msg:4565755
 8:28 pm on Apr 17, 2013 (gmt 0)

All can be combined under the title DM Systems, which means 23.29.48.0/20

keyplyr




msg:4565765
 9:01 pm on Apr 17, 2013 (gmt 0)

I have these for DMSystems:

23.29.48.0 - 23.29.63.255
23.29.48.0/20

199.19.96.0 - 199.19.99.255
199.19.99.0/22

199.116.84.0 - 199.116.87.255
199.116.84.0/22

motorhaven




msg:4566102
 8:17 pm on Apr 18, 2013 (gmt 0)

Didn't compare to larger backbones.

Windstream Hosted Solutions'
WHSL 199.233.224.0 - 199.233.227.255 199.233.224.0/22
WHSL-207-154-0-0-18 207.154.0.0 - 207.154.63.255 207.154.0.0/18
WHSL-207-254-208-0-20 207.254.208.0 - 207.254.223.255 207.254.208.0/20
WHSL-209-59-0-0-19 209.59.0.0 - 209.59.31.255 209.59.0.0/19
HSAL-216-27-0-0-18 216.27.0.0 - 216.27.95.255 216.27.0.0/18 216.27.64.0/19
WHSL-69-166-129-0-19 69.166.128.0 - 69.166.159.255 69.166.128.0/19
WHSL-74-213-128-0-19 74.213.128.0 - 74.213.159.255 74.213.128.0/19
WHSL-V6 2600:2C00:: - 2600:2C03:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF


I have
1. Mobile phone browsers/users coming in through: 207.154.0.0/18
2. Corporate users through: 216.27.0.0/18, 69.166.128.0 and 74.213.128.0/19

... so I only block single abusive IPs in those.

blend27




msg:4566319
 12:17 pm on Apr 19, 2013 (gmt 0)

198.52.117.204(no rdns) several requests to none WWW root of the site at 1 hit per second with an outdated FF UA and bare-bones headers.

SOooooo......

Canyon Country..

MULTACOM CORPORATION.... as of today from bgp.he.net

198.52.96.0 - 198.52.127.255 - 198.52.96.0/19
100.42.64.0 - 100.42.79.255 - 100.42.64.0/20
108.166.192.0 - 108.166.223.255 108.166.192.0/19
198.148.96.0 - 198.148.127.255 198.148.96.0/19
198.211.0.0 - 198.211.63.255 - 198.211.0.0/18
198.74.96.0 - 198.74.127.255 198.74.96.0/19
204.13.152.0 - 204.13.155.255 - 204.13.152.0/22
204.15.72.0 - 204.15.79.255 - 204.15.72.0/21
208.162.36.0 - 208.162.39.255 208.162.36.0/22(within SAVIS 208.162.0.0/16)
208.64.224.0 - 208.64.231.255 - 208.64.224.0/21
216.127.160.0 - 216.127.191.255 - 216.127.160.0/19
216.24.240.0 - 216.24.255.255 - 216.24.240.0/20
66.152.160.0 - 66.152.191.255 - 66.152.160.0/19
96.43.80.0 - 96.43.95.255 - 96.43.80.0/20
72.44.64.0 - 72.44.79.255 - 72.44.64.0/20
2607:F130:: - 2607:F130:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF - 2607:F130::/32

wilderness




msg:4566384
 2:51 pm on Apr 19, 2013 (gmt 0)

WebNX, Inc. (WEBNX)

2012 thread by keyplr [webmasterworld.com] with references to earlier threads.

These ranges have changed since 2012.
Five are subnets of PacketExchange.
A few are new, others (old threads) are no longer leased.

WebNX, Inc. (WEBNX)
WEBNX-BLK-5 100.42.208.0 - 100.42.223.255 100.42.208.0/20
WEBNX-BLK-6 108.171.192.0 - 108.171.223.255 108.171.192.0/19
WEBNX-BLK-7 142.4.32.0 - 142.4.63.255 142.4.32.0/19
WEBNX-BLK-3 173.231.0.0 - 173.231.63.255 173.231.0.0/18
WEBNX-BLK-8 192.69.192.0 - 192.69.223.255 192.69.192.0/19
WEBNX-BLK-9 216.158.64.0 - 216.158.95.255 216.158.64.0/19
WEBNX-BLK-2 216.18.192.0 - 216.18.223.255 216.18.192.0/19
WEBNX-BLK-4 50.115.32.0 - 50.115.47.255 50.115.32.0/20
PacketExchange, Inc (PACKE-25) 67.201.0.0 - 67.201.63.255 67.201.0.0/18
  MZIMA04-CUST-WEBNX01 67.201.12.0 - 67.201.15.255   67.201.12.0/22
WEBNX 67.220.192.0 - 67.220.223.255 67.220.192.0/19
PacketExchange, Inc (PACKE-25) 68.64.128.0 - 68.64.191.255 68.64.128.0/18
   MZIMA07-CUST-WEBNX05 68.64.156.0 - 68.64.159.255 68.64.156.0/22
PacketExchange, Inc (PACKE-25) 72.37.128.0 - 72.37.255.255 72.37.128.0/17
   MZIMA03-CUST-WEBNX02 72.37.150.0 - 72.37.150.255 72.37.150.0/24
   MZIMA03-CUST-WEBNX01 72.37.184.0 - 72.37.185.255 72.37.184.0/23
   MZIMA03-CUST-WEBNX03 72.37.245.0 - 72.37.245.255 72.37.245.0/24

wilderness




msg:4566654
 6:55 pm on Apr 20, 2013 (gmt 0)

Note three of the ranges are leased from Hurricane.

Fork Networking
FORK-NETWORKING 199.87.228.0 - 199.87.231.255 199.87.228.0/22
FORK-NETWORKING 199.30.64.0 - 199.30.67.255 199.30.64.0/22
FORK-NETWORKING 100.42.16.0 - 100.42.31.255 100.42.16.0/20
Hurricane Electric, Inc. (HURC) 184.104.0.0 - 184.105.255.255 184.104.0.0/15
  HURRICANE-DC0413-B869DA00 184.105.218.0 - 184.105.218.255
  HURRICANE-DC0413-B869DC00 184.105.220.0 - 184.105.220.255
  HURRICANE-DC0413-B869DD00 184.105.221.0 - 184.105.221.255

dstiles




msg:4566680
 8:25 pm on Apr 20, 2013 (gmt 0)

I have the whole of the hurricane range blocked:

184.104.0.0 - 184.105.255.255
184.104.0.0/15

keyplyr




msg:4566761
 12:56 am on Apr 21, 2013 (gmt 0)

wilderness - Thanks for the WebNX info and the Forked.com ranges. Like dstiles, I had the Hurricane blocked.

Thanks blend27 I had all the the multacom ranges except:
198.211.0.0 - 198.211.63.255
198.211.0.0/18

The others have been listed before in this forum.

[edited by: keyplyr at 1:38 am (utc) on Apr 21, 2013]

wilderness




msg:4566765
 1:06 am on Apr 21, 2013 (gmt 0)

FWIW, the only reason I listed the Hurricane ranges (which we've all denied previously) was because they are shown in the Fork ranges.

keyplyr




msg:4566767
 1:10 am on Apr 21, 2013 (gmt 0)

These ranges have changed since 2012.
Five are subnets of PacketExchange.
A few are new, others (old threads) are no longer leased.


That's an important dynamic... ranges change. I don't know about anyone else, but I have close to 2k ranges in my block list and I have NEVER gone through, one-by-one, and rechecked to see if any have changed. The only time I catch it is by chance when adding a new range that might overlap, and I've caught dozens this way.

The only consolatory aspect might be that these ranges would likely be absorbed into or released to the very same type companies, and not to an ISP, but that's academic.

keyplyr




msg:4566932
 3:37 am on Apr 22, 2013 (gmt 0)

Virpus.com dedi servers
50.115.160.0 - 50.115.175.255
50.115.160.0/20

Hosting Services, GB
37.130.227.128 - 37.130.227.135
37.130.227.128/29

wilderness




msg:4566941
 4:18 am on Apr 22, 2013 (gmt 0)

VIRPUS-KC-2 173.0.48.0 - 173.0.63.255 173.0.48.0/20
DNSSLAVE7 198.167.136.0 - 198.167.143.255 198.167.136.0/21
DNSSLAVE6 198.175.124.0 - 198.175.127.255 198.175.124.0/22
VIRPUS-KC-3 199.119.224.0 - 199.119.227.255 199.119.224.0/22
DNSSLAVE4 199.180.128.0 - 199.180.135.255 199.180.128.0/21
DNSSLAVE5 50.115.160.0 - 50.115.175.255 50.115.160.0/20
VIRPUS-KC-1 208.89.208.0 - 208.89.215.255 208.89.208.0/21
VIRPUS 2604:C00:: - 2604:C00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

keyplyr




msg:4566961
 5:41 am on Apr 22, 2013 (gmt 0)

We make a good team :)

wilderness




msg:4567794
 6:38 am on Apr 25, 2013 (gmt 0)

US Net Inc
NETBLK-USNET-CBLK1 198.240.64.0 - 198.240.127.255 198.240.64.0/18
US-NET-INCORPORATED 206.225.0.0 - 206.225.31.255 206.225.0.0/19
US-NET-INCORPORATED 207.244.192.0 - 207.244.255.255 207.244.192.0/18
USNET-209-99-146-0 209.99.146.0 - 209.99.146.255 209.99.146.0/24
USNET-209-99-180-0 209.99.180.0 - 209.99.180.255 209.99.180.0/24
USNET-BLK-6 209.99.128.0 - 209.99.191.255 209.99.128.0/18

Kendo




msg:4567798
 6:53 am on Apr 25, 2013 (gmt 0)

I have the whole of the hurricane range blocked


Why would anyone want to block services running on the Hurricane network?

Also, do you realise that the IP ranges mentioned above are only a tip of their iceberg?

This 92 message thread spans 4 pages: < < 92 ( 1 [2] 3 4 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About
© Webmaster World 1996-2014 all rights reserved