Server Farms, Elron Technologies and more

[wilderness]

single root request.
No images, no robots.

Visited a few times previously.

207.232.29.zzz - - [22/May/2012:15:27:14 +0100] "GET / HTTP/1.1" 403 559 "-" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.14) Gecko/20100824 BonEcho/2.0.0.14"

207.232.0.0 - 207.232.63.255
199.203.0.0 - 199.203.255.255

[keyplyr]

There's an old thread on this [webmasterworld.com] by keyplr

Vivid Hosting
VIVID-HOSTING-4 192.154.192.0 - 192.154.255.255 192.154.192.0/18
VIVID-HOSTING-2 192.158.224.0 - 192.158.239.255 192.158.224.0/20
VIVID-HOSTING-3 198.37.96.0 - 198.37.127.255 198.37.96.0/19
VIVID-HOSTING-1 198.177.120.0 - 198.177.127.255 198.177.120.0/21
VIVID-HOSTING 199.188.88.0 - 199.188.95.255 199.188.88.0/21
VIVID-HOSTING-NET 209.133.107.128 - 209.133.107.255 209.133.107.128/25
MZIMA07-CUST-VIVID02 68.64.128.0 - 68.64.129.255 68.64.128.0/23
MZIMA07-CUST-VIVID01 68.64.136.0 - 68.64.137.255 68.64.136.0/23

So it appears the range I identified in that old thread:

68.64.128.0 - 68.64.191.255
68.64.128.0/18

is now operated by PacketExchange

As is this one:

68.64.128.0 - 68.64.191.255
68.64.128.0/18

And this is AboveNet:

209.133.0.0 - 209.133.127.255
209.133.0.0/17

[wilderness]

keyplr,
I'm helping a friend with a website, whom has an SMF forum and the Ip's are a different creature.

The Vivid's were the result of an access by:

199.188.88.203

which is a sub-net reseller.

[keyplyr]

Yes, I understand that and I'm just sayn' that a couple of those are part of larger ranges that many of us already block.

Your 2 Vivid Hosting ranges:
MZIMA07-CUST-VIVID02 68.64.128.0 - 68.64.129.255 68.64.128.0/23
MZIMA07-CUST-VIVID01 68.64.136.0 - 68.64.137.255 68.64.136.0/23

are inside of these 2 PacketExchange rages:
68.64.128.0 - 68.64.191.255 68.64.128.0/18
68.64.128.0 - 68.64.191.255 68.64.128.0/18

And this Vivid Hosting range:
VIVID-HOSTING-NET 209.133.107.128 - 209.133.107.255 209.133.107.128/25

is inside of this Abovenet range:
209.133.0.0 - 209.133.127.255 209.133.0.0/17

I already had these ranges blocked, which is why I posted. Thanks for the other Vivid Hosting ranges, which I did not have :)

[keyplyr]

PacketExchange* ranges I have blocked:

67.201.0.0 - 67.201.63.255
67.201.0.0/18

68.64.128.0 - 68.64.191.255
68.64.128.0/18

69.174.0.0 - 69.174.127.255
69.174.0.0/17

70.39.128.0 - 70.39.255.255
70.39.128.0/17

72.37.128.0 - 72.37.255.255
72.37.128.0/17

80.253.96.0 - 80.253.127.255
80.253.96.0/19

89.167.221.0 - 89.167.221.255
89.167.221.0/24

216.193.192.0 - 216.193.255.255
216.193.192.0/18



Abovenet* ranges I have blocked:

64.124.0.0 - 64.125.255.255
64.124.0.0/15

64.125.118.64 - 64.125.118.95
64.125.118.64/27

209.133.0.0 - 209.133.127.255
209.133.0.0/17

209.249.0.0 - 209.249.255.255
209.249.0.0/16


*Highly likely I'm missing ranges for both.

[wilderness]

QUASAR DATA CENTER, LTD. (QDCL)
QUASAR-DATA-CENTER 199.188.244.0 - 199.188.247.255 199.188.244.0/22
QUASAR-DATA-CENTER 204.61.220.0 - 204.61.223.255 204.61.220.0/22
QUASAR-DATA-CENTER 74.122.120.0 - 74.122.123.255 74.122.120.0/22
QDC-IPV6 2605:9700:: - 2605:9700:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[dstiles]

Didn't have any of those, which indicates I haven't been troubled by them yet. :)

[dstiles]

Just been hit from another Hetzner range - previous threads closed so appending to this one:

144.76.0.0 - 144.76.255.255
144.76.0.0/16

[keyplyr]

Thanks, I didn't have that one either.

[wilderness]

some of these are part of larger DimeNoc ranges.

Avante Hosting Services
AHS-136 184.171.251.192 - 184.171.251.255 184.171.251.192/26
AVANTE-3 192.119.144.0 - 192.119.159.255 192.119.144.0/20
AVANTE-5 192.161.192.0 - 192.161.255.255 192.161.192.0/18
AVANTE-2 192.241.8.0 - 192.241.15.255 192.241.8.0/21
AHS-136 198.136.55.0 - 198.136.55.255 198.136.55.0/24
AVANTE-1 199.195.156.0 - 199.195.159.255 199.195.156.0/22
AHS-136 66.7.222.192 - 66.7.222.255 66.7.222.192/26
AVANTE-4 66.248.192.0 - 66.248.223.255 66.248.192.0/19
AVANTE 2607:BD00:: - 2607:BD00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[dstiles]

I didn't have most of those BUT some are sub-ranges of HostDime...

184.171.240.0 - 184.171.255.255
198.136.48.0 - 198.136.63.255
66.7.192.0 - 66.7.223.255

[keyplyr]

I agree. I had the 3 HostDime ranges, but not the Avante. Thanks Don.

[wilderness]

keyplr added a heads-up for Landis Holdings on page 2 of this thread.
For some reason, when I attempt to link to that response, I get a stylus error.

Here's two more from Landis.

LH-GOLD-NETWORK 209.217.224.0 - 209.217.255.255 209.217.224.0/19
LH-GOLD-NETWORK 69.73.128.0 - 69.73.191.255 69.73.128.0/18

[keyplyr]

Thanks Don, didn't have either of those two.

Looking back at IP block list, it seems that for the first 10 years or so I would only block the offending range (sometimes just that specific IP address) and not investigate other IP ranges registered to that agent, usually a host, colo or data center.

It is likely due to discussions here at WW that a few years ago I changed my approach and started adding all that fit the criteria, whether or not they ever hit my servers (yet.)

I now feel it is a wiser path to be proactive. Thanks for everyone contributing.

[wilderness]

FWIW, they some valid T1 commercial services, however that is not how this visitor acted.

Ethr.Net LLC (ETHRN)
ETHRN 216.224.112.0 - 216.224.127.255 216.224.112.0/20
ETHR-NET 216.83.32.0 - 216.83.63.255 216.83.32.0/19
ETHR-NET 69.176.80.0 - 69.176.95.255 69.176.80.0/20
ETHRN 96.43.96.0 - 96.43.111.255 96.43.96.0/20
ETHRN 2607:F260:: - 2607:F260:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

FWIW, they some valid T1 commercial services, however that is not how this visitor acted.

They offer Dedicated Servers & Colocation so they're not exempt from bad neighborhoods.

[wilderness]

OC3 Networks
OC3-NETWORKS2 173.254.192.0 - 173.254.255.255 173.254.192.0/18
QUADRANET 192.161.48.0 - 192.161.63.255 92.161.48.0/20
QUADRANET 198.55.96.0 - 198.55.127.255 198.55.96.0/19
QUADRANET 198.96.88.0 - 198.96.95.255 198.96.88.0/21
OC3-NETWORKS2 204.152.192.0 - 204.152.223.255 204.152.192.0/19
OC3-NETWORKS 216.45.48.0 - 216.45.63.255 216.45.48.0/20
OC3-NETWORKS 66.63.160.0 - 66.63.191.255 66.63.160.0/19
OC3-NETWORKS 72.11.128.0 - 72.11.159.255 72.11.128.0/19
OC3-NETWORKS2 96.44.128.0 - 96.44.191.255 96.44.128.0/18
OC3-NETWORKS2 98.143.144.0 - 98.143.159.255 98.143.144.0/20
OC3NET-V6-NET1 2607:FCD0:: - 2607:FCD0:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

Thanks, only had one of those from 4 years ago.

[keyplyr]

Eurovps.com Hosting
77.235.45.0 - 77.235.45.255
77.235.45.0/24

[incrediBILL]

continued here: [webmasterworld.com...]