homepage Welcome to WebmasterWorld Guest from 107.20.25.215
register, free tools, login, search, pro membership, help, library, announcements, recent posts, open posts,
Pubcon Platinum Sponsor 2014
Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
Forum Library, Charter, Moderators: Ocean10000 & incrediBILL

Search Engine Spider and User Agent Identification Forum

This 327 message thread spans 11 pages: < < 327 ( 1 2 3 4 [5] 6 7 8 9 10 11 > >     
Server Farms - Sept. 2013
Ongoing Hosting Data Center Discussion
incrediBILL




msg:4607413
 11:55 pm on Sep 4, 2013 (gmt 0)

Continuation of the May 2013 thread:
[webmasterworld.com...]

 

wilderness




msg:4623397
 10:57 pm on Nov 14, 2013 (gmt 0)

Are you sure about this one?


lucy,
I'm not "sure" of what my name is.

FWIW, those ranges were retrieved from ARIN Whois and if there are errors?
Please complain to ARIN.

blend27




msg:4623433
 1:50 am on Nov 15, 2013 (gmt 0)

new for me:

NetRange: 23.238.128.0 - 23.238.255.255
CIDR: 23.238.128.0/17
NetName: PSYCHZ-NETWORKS
RegDate: 2013-10-23
Updated: 2013-10-23

not2easy




msg:4623439
 3:05 am on Nov 15, 2013 (gmt 0)

NETWORK INNOVATIONS is
64.237.112.0 - 64.237.127.255 which is 112.0/20

Waveform is the smaller range as shown.

NETWORK INNOVATIONS also includes
NW Colonet NWCOLO
64.237.119.0 - 64.237.119.255

bobothecat2




msg:4623588
 6:58 pm on Nov 15, 2013 (gmt 0)

Cologix Canada, Inc.

74.116.192.0 - 74.116.199.255 74.116.192.0/21
208.94.172.0 - 208.94.175.255 208.94.172.0/22

Angonasec




msg:4623757
 2:00 pm on Nov 16, 2013 (gmt 0)

Not strictly within the remit of this thread, but a pal received a phishing email claiming to be from Apple, which was in fact from eastbaycrabhouse.com (Default Firefox blocks that domain as an attack site.)
Reason enough for me to block the range of TierraNet Inc.
209.240.128.0 - 209.240.159.255 209.240.128.0/19

If they allow phishers on their servers they deserve the Ann Boleyn solution.

bobothecat2




msg:4623759
 2:03 pm on Nov 16, 2013 (gmt 0)

JCHost Internet Services, LLC

199.91.172.0 - 199.91.175.255 199.91.172.0/22

bobothecat2




msg:4623838
 7:55 pm on Nov 16, 2013 (gmt 0)

-

dstiles




msg:4623849
 9:03 pm on Nov 16, 2013 (gmt 0)

> If they allow phishers on their servers they deserve the Ann Boleyn solution.

Correction: If they are servers they deserve... :)

Thanks for the IP I didn't have that one.

lucy24




msg:4623861
 10:09 pm on Nov 16, 2013 (gmt 0)

Met a one-off malign robot at 195.78.109.147 (off the top of your head, anyone recognize "/lightbox/auth/signup/index/navname/signup"? sounds like a CMS). Czech Republic; free lookup says Global Routing with nebulous hint that it's a proxy. But I hate to muck about with /23 slivers so I looked around. 110-111 (the other half of the /22) is Shopzilla, which sounds expendable.

Further:
104-105 195.78.104.0/23 Ukraine
106-107 195.78.106.0/23 Romania
won't even bother to look those up. That's /21

Still further:
96-97 195.78.96.0/23 Ukraine
98-99 195.78.98.0/23 Austria
100-101 195.78.100.0/23 Ukraine
102-103 195.78.102.0/23 Russia
The Austria one is a joint called Cashpoint which may or may not be online gambling.

Still further:
112-113 195.78.112.0/23 Ukraine
114-115 and 116-119 195.78.114.0/23 and 195.78.116.0/22 Russia
120-121 195.78.120.0/23 Netherlands
122-123 195.78.122.0/23 Czech R
124-125 195.78.124.0/23 Romania
126-127 195.78.126.0/23 Russia

Netherlands: "Conduit Connect". Shrug.
Czech Republic: Zeal s.r.o. Search engine says "komplexní datové a telekomunikacní služby · Outsourcing ICT" (You will be disappointed to learn that "služby" apparently just means "services", at least according to google translate. It's really c-hacek but the Forums didn't like that.)

So...

Can I go ahead and lock out the whole /19 to save time? The bottom half of the /18 (from .64 on up) is similarly chopped into /23 slices, mostly central-to-eastern Europe, but I didn't feel like looking them up.

wilderness




msg:4623863
 10:14 pm on Nov 16, 2013 (gmt 0)

TierraNet Inc.
TIERRANET 209.240.128.0 - 209.240.159.255 209.240.128.0/19
TIERRANET-2BLK 216.104.160.0 - 216.104.191.255 216.104.160.0/19
TIERRANET-3BLK 72.1.32.0 - 72.1.47.255 72.1.32.0/20
TIERRANET-4BLK 2606:1400:: - 2606:1400:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

wilderness




msg:4623864
 10:15 pm on Nov 16, 2013 (gmt 0)

JCHost Internet Services, LLC (JCHOS)
JCHOST-NET 199.193.152.0 - 199.193.155.255 199.193.152.0/22
JCHOST-NET 199.91.172.0 - 199.91.175.255 199.91.172.0/22
JCHOST-IPV6 2604:2D00:: - 2604:2D00:FFF:FFFF:FFFF:FFFF:FFFF:FFFF

Angonasec




msg:4623882
 12:34 am on Nov 17, 2013 (gmt 0)

dstiles: Point taken. A distinction I've had greasy cloud serving "hosts" in NY try to make in response to DMCA Notices.

Wilderness: Thank you for helping us keep out TierraNet.
(All California based; such a lawless State.)

Angonasec




msg:4623896
 1:57 am on Nov 17, 2013 (gmt 0)

We 403 theplanet/softlayer by default, so I was surprised to see a hit from 174.123.86.x ( mdservers.net masondevelopment.com ) using that Texan devil attempting to post a long Chinese alphanumeric string... and receive a 404.

bobothecat2




msg:4623984
 3:16 pm on Nov 17, 2013 (gmt 0)

ViaWest

64.58.224.0 - 64.58.239.255 64.58.224.0/20
64.78.144.0 - 64.78.159.255 64.78.144.0/20
64.90.192.0 - 64.90.207.255 64.90.192.0/20
66.51.0.0 - 66.51.31.255 66.51.0.0/19
66.97.128.0 - 66.97.143.255 66.97.128.0/20
66.114.96.0 - 66.114.127.255 66.114.96.0/19
74.63.128.0 - 74.63.191.255 74.63.128.0/18
204.246.128.0 - 204.246.151.255 204.246.144.0/21, 204.246.128.0/20
206.71.64.0 - 206.71.95.255 206.71.64.0/19
207.189.96.0 - 207.189.127.255 207.189.96.0/19
209.170.192.0 - 209.170.223.255 209.170.192.0/19
216.24.128.0 - 216.24.159.255 216.24.128.0/19
216.38.192.0 - 216.38.223.255 216.38.192.0/19
216.46.160.0 - 216.46.191.255 216.46.160.0/19
216.58.128.0 - 216.58.175.255 216.58.128.0/19, 216.58.160.0/20
216.87.64.0 - 216.87.95.255 216.87.64.0/19
216.150.192.0 - 216.150.223.255 216.150.192.0/19

dstiles




msg:4624032
 8:34 pm on Nov 17, 2013 (gmt 0)

Thanks. Several new ones in that list. :)

Angonasec




msg:4624085
 11:17 pm on Nov 17, 2013 (gmt 0)

For your delectation; Another bot from the lawless Wild West:
142.91.79.12.rdns.ubiquity.io Ubiquity Server Solutions LA (Nobis Technology Group, LLC)
142.91.0.0 - 142.91.255.255 142.91.0.0/16

Angonasec




msg:4624087
 11:32 pm on Nov 17, 2013 (gmt 0)

And on the other side we have Peer1 hosting of NY:
66.199.128.0 - 66.199.191.255 66.199.128.0/18

lucy24




msg:4624115
 2:07 am on Nov 18, 2013 (gmt 0)

74.63.128.0 - 74.63.191.255 74.63.128.0/18

This IP seemed awfully familiar so I checked.
74.63.192.0/18 (already blocked) Limestone
74.63.64.0/18 (already blocked) FDC
74.63.32.0/19 Voxel Dot Net, including ExactSeek
that leaves only
74.63.0.0/19
which turns out to be Lightpoint "colo and hosting".

ExactSeek is currently classified as "no skin off my nose". But if you feel differently, that means you could happily block all of
74.63
and be done with it.

bobothecat2




msg:4624237
 1:32 pm on Nov 18, 2013 (gmt 0)

Thanks Lucy, did not know about Lightpoint Colocation & Hosting LLC.:

68.233.0.0 - 68.233.31.255 68.233.0.0/19
74.63.0.0 - 74.63.15.255 74.63.0.0/20
207.162.208.0 - 207.162.223.255 207.162.208.0/20

bobothecat2




msg:4624267
 3:52 pm on Nov 18, 2013 (gmt 0)

Net Access Corporation

64.21.0.0 - 64.21.191.255 64.21.0.0/17, 64.21.128.0/18
64.247.0.0 - 64.247.63.255 64.247.0.0/18
66.29.0.0 - 66.29.127.255 66.29.0.0/17
66.246.0.0 - 66.246.255.255 66.246.0.0/16
67.196.0.0 - 67.196.255.255 67.196.0.0/16
70.47.0.0 - 70.47.255.255 70.47.0.0/16
207.99.0.0 - 207.99.127.255 207.99.0.0/17
207.192.64.0 - 207.192.127.255 207.192.64.0/18
209.123.0.0 - 209.123.255.255 209.123.0.0/16
216.118.64.0 - 216.118.127.255 216.118.64.0/18

dstiles




msg:4624326
 8:46 pm on Nov 18, 2013 (gmt 0)

My nobis ranges are as below. All are blocked at the moment except 23.104.0.0 - 23.111.255.255 for which I have no evidence - anyone care to comment?

23.19.0.0 - 23.19.255.255
23.80.0.0 - 23.83.255.255
23.104.0.0 - 23.111.255.255
64.120.0.0 - 64.120.127.255
69.147.224.0 - 69.147.255.255
70.32.32.0 - 70.32.47.255
108.62.0.0 - 108.62.255.255
108.177.128.0 - 108.177.255.255
142.91.0.0 - 142.91.255.255
142.234.0.0 - 142.234.255.255
147.255.0.0 - 147.255.255.255
172.255.0.0 - 172.255.255.255
173.208.0.0 - 173.208.127.255
173.234.0.0 - 173.234.255.255
174.34.128.0 - 174.34.191.255
216.6.224.0 - 216.6.239.255

dstiles




msg:4624327
 8:47 pm on Nov 18, 2013 (gmt 0)

My current peer-1 ranges, all blocked, are:

64.34.0.0 - 64.34.255.255
64.45.0.0 - 64.45.63.255
64.65.0.0 - 64.65.63.255
64.224.0.0 - 64.227.255.255
65.39.128.0 - 65.39.255.255
66.33.0.0 - 66.33.127.255
66.111.64.0 - 66.111.95.255
66.132.128.0 - 66.132.255.255
66.199.128.0 - 66.199.191.255
66.234.0.0 - 66.234.15.255
67.211.192.0 - 67.211.207.255
69.0.128.0 - 69.0.255.255
69.28.192.0 - 69.28.255.255
69.90.0.0 - 69.90.255.255
69.172.192.0 - 69.172.255.255
70.33.192.0 - 70.33.255.255
72.51.0.0 - 72.51.63.255
76.74.128.0 - 76.74.255.255
83.222.224.0 - 83.222.255.255
107.6.0.0 - 107.6.63.255
176.74.160.0 - 176.74.191.255
198.244.48.0 - 198.244.63.255
209.25.128.0 - 209.25.255.255
209.95.96.0 - 209.95.127.255
209.203.224.0 - 209.203.255.255
209.213.96.0 - 209.213.127.255
216.25.0.0 - 216.25.127.255
216.65.0.0 - 216.65.127.255
216.122.0.0 - 216.122.255.255
216.150.0.0 - 216.150.31.255
216.152.128.0 - 216.152.143.255
216.157.0.0 - 216.157.111.255
216.195.32.0 - 216.195.63.255

Angonasec




msg:4624363
 1:16 am on Nov 19, 2013 (gmt 0)

dstiles: Thank you Sir!

In gratitude, I can only offer this start-up (yet again from the Wild West) currently referrer spamming my access logs:

Automattic, Inc [sic: Yes, they thought that was a good name]
192.0.64.0 - 192.0.127.255 192.0.64.0/18

dstiles




msg:4624615
 9:20 pm on Nov 19, 2013 (gmt 0)

Thanks.:)

I picked that one up late October, visiting with the UA...

WordPress/3.7-beta2-25801; [http://]lucidgypsy[.]wordpress[.]com

([] are mine)

I have a note that there are several wordpress sites on that range, which probably accounts for the bots trying to scrape other sites. Quite apart from wordpress being forever compromised anyway.

bobothecat2




msg:4624776
 1:00 pm on Nov 20, 2013 (gmt 0)

ColocateUSA

50.115.0.0 - 50.115.15.255 50.115.0.0/20
64.87.32.0 - 64.87.63.255 64.87.32.0/19
67.58.96.0 - 67.58.111.255 67.58.96.0/20
67.216.80.0 - 67.216.95.255 67.216.80.0/20
98.142.0.0 - 98.142.15.255 98.142.0.0/20
208.69.112.0 - 208.69.119.255 208.69.112.0/21
208.75.176.0 - 208.75.183.255 208.75.176.0/21
208.87.88.0 - 208.87.95.255 208.87.88.0/21

bobothecat2




msg:4624779
 1:16 pm on Nov 20, 2013 (gmt 0)

Silicon Valley Web Hosting, Inc.

67.207.192.0 - 67.207.207.255 67.207.192.0/20
69.50.224.0 - 69.50.255.255 69.50.224.0/19
208.69.176.0 - 208.69.183.255 208.69.176.0/21
208.78.240.0 - 208.78.247.255 208.78.240.0/21
208.166.48.0 - 208.166.63.255 208.166.48.0/20

bobothecat2




msg:4624841
 4:33 pm on Nov 20, 2013 (gmt 0)

EBOUNDHOST

69.27.32.0 - 69.27.47.255 69.27.32.0/20
216.14.112.0 - 216.14.127.255 216.14.112.0/20

dstiles




msg:4625146
 5:37 pm on Nov 21, 2013 (gmt 0)

Another Peer-1 today, in UK...

5.44.16.0 - 5.44.23.255

Split into small sub-ranges in DNS.

Angonasec




msg:4625593
 1:55 am on Nov 24, 2013 (gmt 0)

Datashack, LC:
192.151.144.0 - 192.151.159.255 192.151.144.0/20

And yet another wretched Rackspace Cloud bot:
162.242.128.0 - 162.242.255.255 162.242.128.0/17

dstiles




msg:4625665
 4:05 pm on Nov 24, 2013 (gmt 0)

A new (Sep 2013) Rackspace IP range...

162.242.128.0 - 162.242.255.255

Making my current (HUGE!) Rackspace list...

5.79.0.0 - 5.79.63.255
31.222.128.0 - 31.222.191.255
37.188.96.0 - 37.188.127.255
46.38.160.0 - 46.38.191.255
50.56.0.0 - 50.57.255.255
64.39.0.0 - 64.39.31.255
64.49.192.0 - 64.49.255.255
65.61.128.0 - 65.61.191.255
66.216.64.0 - 66.216.127.255
67.192.0.0 - 67.192.255.255
67.207.128.0 - 67.207.223.255
69.20.0.0 - 69.20.127.255
72.3.128.0 - 72.3.255.255
72.4.112.0 - 72.4.127.255
72.32.0.0 - 72.32.255.255
74.205.0.0 - 74.205.127.255
78.136.0.0 - 78.136.63.255
89.234.0.0 - 89.234.63.255
92.52.64.0 - 92.52.127.255
94.236.0.0 - 94.236.127.255
95.138.128.0 - 95.138.191.255
98.129.0.0 - 98.129.255.255
108.166.0.0 - 108.166.127.255
108.171.160.0 - 108.171.191.255
120.136.32.0 - 120.136.47.255
162.13.0.0 - 162.13.255.255
162.209.0.0 - 162.209.127.255
162.242.128.0 - 162.242.255.255
164.177.128.0 - 164.177.159.255
166.78.0.0 - 166.78.255.255
173.203.0.0 - 173.203.255.255
174.143.0.0 - 174.143.255.255
180.150.128.0 - 180.150.159.255
184.106.0.0 - 184.106.255.255
192.237.128.0 - 192.237.255.255
198.61.128.0 - 198.61.255.255
198.101.128.0 - 198.101.255.255
204.232.128.0 - 204.232.255.255
207.97.192.0 - 207.97.255.255
209.61.128.0 - 209.61.191.255
209.114.32.0 - 209.114.63.255
212.64.128.0 - 212.64.159.255
212.100.224.0 - 212.100.255.255

keyplyr




msg:4625688
 8:02 pm on Nov 24, 2013 (gmt 0)


Been getting a half dozen daily single page hits, no other files, from Hewlett-Packard. These pages are not being harvested from any social sites AFAIK.

IP: 15.185.110.49
UA: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0
ASN: AS6301 HP-CLOUD-SERVICES
15.0.0.0 - 15.255.255.255
15.0.0.0/8

Anyone know is HP sends any human traffic? Anyone blocking this range?

This 327 message thread spans 11 pages: < < 327 ( 1 2 3 4 [5] 6 7 8 9 10 11 > >
Global Options:
 top home search open messages active posts  
 

Home / Forums Index / Search Engines / Search Engine Spider and User Agent Identification
rss feed

All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
Home ¦ Free Tools ¦ Terms of Service ¦ Privacy Policy ¦ Report Problem ¦ About ¦ Library ¦ Newsletter
WebmasterWorld is a Developer Shed Community owned by Jim Boykin.
© Webmaster World 1996-2014 all rights reserved