Cyveillance back on new IP's

Cyveillance, 38.118.25.56 - 38.118.25.63, 38.118.42.32 - 38.118.42.39

[gordongecko]

Didn't see mention of this in any prior threads.

A heads up to anyone who despises the bandwidth hog Cyveillance - like yours truly. :]

New ip's logged:
38.118.25.56 - 38.118.25.63
38.118.42.32 - 38.118.42.39

RewriteCond %{REMOTE_ADDR} ^38\.118\.25\.(5[6-9]¦6[0-3])$ [OR]
RewriteCond %{REMOTE_ADDR} ^38\.118\.42\.3[2-9]$ [OR]

* mind the broken pipes "¦" - they should be unbroken

If anyone has seen any other new Cyveillance ranges please post.

[wilderness]

I'm inclined to deny access to my sites from every range this backbone provides.

I've seem more instances than I care to count from unwanted orgs as their customers.

[Umbra]

This IP 38.113.207.72 sprung our bad bot trap. It had been hitting our site at the exact same time that a Cyveillance IP (63.148.99.239) was requesting pages (and which also eventually landed in the trap).

[uncle_bob]

wilderness - I checked my logs, and less than 1 page request in 6000 comes from the 38. backbone, so I doubt you'll be loosing much legitimate traffic blocking the whole of 38. In fact 90% of the 38. traffic for me comes from inside 38.112.0.0/13 .

[wilderness]

uncle_bob,
Thanks for the insight.

My referecne was not to the 38 range exclusively.
Rather go to ARIN and type in "Performance Systems" (minus the quotes.)

Don

[idoc]

Had already banned 38.118.25. a few days ago due to what I thought was a regular scraper:

38.118.25.60 - - [08/Jan/2005:17:45:08 -0500] "GET / HTTP/1.1" 200 28799 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows XP)"

They were scraping the site in entirety until they were banned. I have now added 38.118.42. to the list. Thanks for the heads-up.