Server Farms - March 2013

Ongoing WMW server farm report

[wilderness]

Continued from previous thread: [webmasterworld.com...]

---

The old thread has become too large, and there is no longer any method of linking to individual submissions within threads at Webmaster World, thus making the previous thread useless as a reference (they do come up in the search results).

Joe's Datacenter
JOESDC-02 204.27.56.0 - 204.27.63.255 204.27.56.0/21
JOESDC-01 208.94.240.0 - 208.94.247.255 208.94.240.0/21
JOESDC-01 69.195.128.0 - 69.195.159.255 69.195.128.0/19
JOESDC-01 96.43.128.0 - 96.43.143.255 96.43.128.0/20
JOESDC-01 2604:5800:: - 2604:5800:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[edited by: incrediBILL at 12:59 am (utc) on Mar 8, 2013]
[edit reason] Added link to previous thread [/edit]

[wilderness]

88.115.2.170 - - [07/Apr/2013:09:40:42 -0600] "GET /MyFolder/SubFolder/MYpage.html HTTP/1.1" 403 644 "http://www.google.fi/oBSCURED" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0"
69.194.230.43 - - [07/Apr/2013:09:41:32 -0600] "GET /SameFolder/SameSub/SamePage.html HTTP/1.1" 200 20343 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0"

[wilderness]

88.112.0.0/14
Elisa Oyj

If you'd look further down the RIPE page, you'd get:

role: Elisa Hostmaster

[dstiles]

The word Hostmaster is not a guarantee. A lot of foreign-language - and even some English - DNS entries use the word to describe broadband-hosting as well as server-hosting.

A brief test on the Elisa range shows no actual open-port IPs and very few stealth-port (this was only a small IP sample!). Most return fully closed - ie normal broadband.

Apart from large companies such as G, MS and amazon very few /14 IP ranges resolve to monolithic server farms, especially outside the rather prolific USA.

I have only 15 IPs blocked (total about 30 hits) for all the Elisa ranges I have in my database, going back to 2010. This is a VERY low number for any given ISP range.

You may well be correct, but my own analysis satisfies me for now. :)

[keyplyr]

Thanks for the ranges.

I concur. The term "hostmaster" really does not specify the role as web server hosting. IMO it really means the person/company responsible for hosting the range, like a webmaster is for a web site.

BTW Don, you're reported some of those Colo4 ranges before, just with different names (Colocrossing, Colo4Dallas, etc)

[wilderness]

BTW Don, you're reported some of those Colo4 ranges before, just

keyplr,
I was almost sure, however was unable to locate any cross-references in my data.

[lucy24]

am I missing something or is there a degree of tautology in your numbers?

Yes, you are missing something, and I bet you figured it out five minutes after the Edit deadline passed. I was pointing out glitches in the list directly above my post :)

[keyplyr]

Just FYI to all (especially to cut'n pasters): It is wise to check & recheck all ranges in block or allow lists periodically and conflate where needed. Often times there are overlaps. I know I've found a few.

[dstiles]

Lucy - sorry, completely missed that! :(

I must pay attention
I must pay attention
I must pay attention
I must pay attention
...

[keyplyr]

Scalematrix.com cloud hosting (San Diego)
199.187.240.0 - 199.187.247.255
199.187.240.0/21

[wilderness]

Scalematrix
SM-SANDIEGO-3 192.175.52.0 - 192.175.55.255 192.175.52.0/22
SM-SANDIEGO-2 199.73.48.0 - 199.73.55.255 199.73.48.0/21
SM-SANDIEGO-1 199.187.240.0 - 199.187.247.255 199.187.240.0/21
LVLT-SCALE-3-8-34-120 8.34.120.0 - 8.34.127.255

[dstiles]

Thanks, Guys. All new!

[keyplyr]

I saw their TV commercial yesterday then looked them up to block... probably not what they had in mind :)

[wilderness]

NETROUTING-INC 199.71.232.0 - 199.71.235.255 199.71.232.0/22
NETROUTING 208.76.52.0 - 208.76.55.255 208.76.52.0/22
NETROUTING-DEDICATED-SERVERS 208.76.54.0 - 208.76.54.255 208.76.54.0/24
NETROUTING-INC 2606:ED00:: - 2606:ED00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[wilderness]

Didn't compare to larger backbones.

Windstream Hosted Solutions'
WHSL 199.233.224.0 - 199.233.227.255 199.233.224.0/22
WHSL-207-154-0-0-18 207.154.0.0 - 207.154.63.255 207.154.0.0/18
WHSL-207-254-208-0-20 207.254.208.0 - 207.254.223.255 207.254.208.0/20
WHSL-209-59-0-0-19 209.59.0.0 - 209.59.31.255 209.59.0.0/19
HSAL-216-27-0-0-18 216.27.0.0 - 216.27.95.255 216.27.0.0/18 216.27.64.0/19
WHSL-69-166-129-0-19 69.166.128.0 - 69.166.159.255 69.166.128.0/19
WHSL-74-213-128-0-19 74.213.128.0 - 74.213.159.255 74.213.128.0/19
WHSL-V6 2600:2C00:: - 2600:2C03:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[dstiles]

Thanks. I only had 3 of those, and they were listed under Hosted Solutions not Windstream.

[wilderness]

LIONLINK NETWORKS
NET-199-19-99-0 199.19.99.0 - 199.19.99.255 199.19.99.0/24
NET-199-116-84-0-1 199.116.84.0 - 199.116.87.255 199.116.84.0/22
NET-23-29-52-0 23.29.52.0 - 23.29.52.255
NET-23-29-53-0-1 23.29.53.0 - 23.29.53.255
NET-23-29-55-0-1 23.29.55.0 - 23.29.55.255
NET-23-29-56-0-1 23.29.56.0 - 23.29.56.255
NET-23-29-57-0-1 23.29.57.0 - 23.29.57.255
NET-23-29-58-0-1 23.29.58.0 - 23.29.58.255
NET-LIONLINK 2604:DE00:33:: - 2604:DE00:33:FFFF:FFFF:FFFF:FFFF:FFFF
NET-LIONLINK 2604:DE00:32:: - 2604:DE00:32:FFFF:FFFF:FFFF:FFFF:FFFF

[dstiles]

All can be combined under the title DM Systems, which means 23.29.48.0/20

[keyplyr]

I have these for DMSystems:

23.29.48.0 - 23.29.63.255
23.29.48.0/20

199.19.96.0 - 199.19.99.255
199.19.99.0/22

199.116.84.0 - 199.116.87.255
199.116.84.0/22

[motorhaven]

Didn't compare to larger backbones.

Windstream Hosted Solutions'
WHSL 199.233.224.0 - 199.233.227.255 199.233.224.0/22
WHSL-207-154-0-0-18 207.154.0.0 - 207.154.63.255 207.154.0.0/18
WHSL-207-254-208-0-20 207.254.208.0 - 207.254.223.255 207.254.208.0/20
WHSL-209-59-0-0-19 209.59.0.0 - 209.59.31.255 209.59.0.0/19
HSAL-216-27-0-0-18 216.27.0.0 - 216.27.95.255 216.27.0.0/18 216.27.64.0/19
WHSL-69-166-129-0-19 69.166.128.0 - 69.166.159.255 69.166.128.0/19
WHSL-74-213-128-0-19 74.213.128.0 - 74.213.159.255 74.213.128.0/19
WHSL-V6 2600:2C00:: - 2600:2C03:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

I have
1. Mobile phone browsers/users coming in through: 207.154.0.0/18
2. Corporate users through: 216.27.0.0/18, 69.166.128.0 and 74.213.128.0/19

... so I only block single abusive IPs in those.

[blend27]

198.52.117.204(no rdns) several requests to none WWW root of the site at 1 hit per second with an outdated FF UA and bare-bones headers.

SOooooo......

Canyon Country..

MULTACOM CORPORATION.... as of today from bgp.he.net

198.52.96.0 - 198.52.127.255 - 198.52.96.0/19
100.42.64.0 - 100.42.79.255 - 100.42.64.0/20
108.166.192.0 - 108.166.223.255 108.166.192.0/19
198.148.96.0 - 198.148.127.255 198.148.96.0/19
198.211.0.0 - 198.211.63.255 - 198.211.0.0/18
198.74.96.0 - 198.74.127.255 198.74.96.0/19
204.13.152.0 - 204.13.155.255 - 204.13.152.0/22
204.15.72.0 - 204.15.79.255 - 204.15.72.0/21
208.162.36.0 - 208.162.39.255 208.162.36.0/22(within SAVIS 208.162.0.0/16)
208.64.224.0 - 208.64.231.255 - 208.64.224.0/21
216.127.160.0 - 216.127.191.255 - 216.127.160.0/19
216.24.240.0 - 216.24.255.255 - 216.24.240.0/20
66.152.160.0 - 66.152.191.255 - 66.152.160.0/19
96.43.80.0 - 96.43.95.255 - 96.43.80.0/20
72.44.64.0 - 72.44.79.255 - 72.44.64.0/20
2607:F130:: - 2607:F130:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF - 2607:F130::/32

[wilderness]

WebNX, Inc. (WEBNX)

2012 thread by keyplr [webmasterworld.com] with references to earlier threads.

These ranges have changed since 2012.
Five are subnets of PacketExchange.
A few are new, others (old threads) are no longer leased.

WebNX, Inc. (WEBNX)
WEBNX-BLK-5 100.42.208.0 - 100.42.223.255 100.42.208.0/20
WEBNX-BLK-6 108.171.192.0 - 108.171.223.255 108.171.192.0/19
WEBNX-BLK-7 142.4.32.0 - 142.4.63.255 142.4.32.0/19
WEBNX-BLK-3 173.231.0.0 - 173.231.63.255 173.231.0.0/18
WEBNX-BLK-8 192.69.192.0 - 192.69.223.255 192.69.192.0/19
WEBNX-BLK-9 216.158.64.0 - 216.158.95.255 216.158.64.0/19
WEBNX-BLK-2 216.18.192.0 - 216.18.223.255 216.18.192.0/19
WEBNX-BLK-4 50.115.32.0 - 50.115.47.255 50.115.32.0/20
PacketExchange, Inc (PACKE-25) 67.201.0.0 - 67.201.63.255 67.201.0.0/18
  MZIMA04-CUST-WEBNX01 67.201.12.0 - 67.201.15.255   67.201.12.0/22
WEBNX 67.220.192.0 - 67.220.223.255 67.220.192.0/19
PacketExchange, Inc (PACKE-25) 68.64.128.0 - 68.64.191.255 68.64.128.0/18
   MZIMA07-CUST-WEBNX05 68.64.156.0 - 68.64.159.255 68.64.156.0/22
PacketExchange, Inc (PACKE-25) 72.37.128.0 - 72.37.255.255 72.37.128.0/17
   MZIMA03-CUST-WEBNX02 72.37.150.0 - 72.37.150.255 72.37.150.0/24
   MZIMA03-CUST-WEBNX01 72.37.184.0 - 72.37.185.255 72.37.184.0/23
   MZIMA03-CUST-WEBNX03 72.37.245.0 - 72.37.245.255 72.37.245.0/24

[wilderness]

Note three of the ranges are leased from Hurricane.

Fork Networking
FORK-NETWORKING 199.87.228.0 - 199.87.231.255 199.87.228.0/22
FORK-NETWORKING 199.30.64.0 - 199.30.67.255 199.30.64.0/22
FORK-NETWORKING 100.42.16.0 - 100.42.31.255 100.42.16.0/20
Hurricane Electric, Inc. (HURC) 184.104.0.0 - 184.105.255.255 184.104.0.0/15
  HURRICANE-DC0413-B869DA00 184.105.218.0 - 184.105.218.255
  HURRICANE-DC0413-B869DC00 184.105.220.0 - 184.105.220.255
  HURRICANE-DC0413-B869DD00 184.105.221.0 - 184.105.221.255

[dstiles]

I have the whole of the hurricane range blocked:

184.104.0.0 - 184.105.255.255
184.104.0.0/15

[keyplyr]

wilderness - Thanks for the WebNX info and the Forked.com ranges. Like dstiles, I had the Hurricane blocked.

Thanks blend27 I had all the the multacom ranges except:
198.211.0.0 - 198.211.63.255
198.211.0.0/18

The others have been listed before in this forum.

[edited by: keyplyr at 1:38 am (utc) on Apr 21, 2013]

[wilderness]

FWIW, the only reason I listed the Hurricane ranges (which we've all denied previously) was because they are shown in the Fork ranges.

[keyplyr]

These ranges have changed since 2012.
Five are subnets of PacketExchange.
A few are new, others (old threads) are no longer leased.

That's an important dynamic... ranges change. I don't know about anyone else, but I have close to 2k ranges in my block list and I have NEVER gone through, one-by-one, and rechecked to see if any have changed. The only time I catch it is by chance when adding a new range that might overlap, and I've caught dozens this way.

The only consolatory aspect might be that these ranges would likely be absorbed into or released to the very same type companies, and not to an ISP, but that's academic.

[keyplyr]

Virpus.com dedi servers
50.115.160.0 - 50.115.175.255
50.115.160.0/20

Hosting Services, GB
37.130.227.128 - 37.130.227.135
37.130.227.128/29

[wilderness]

VIRPUS-KC-2 173.0.48.0 - 173.0.63.255 173.0.48.0/20
DNSSLAVE7 198.167.136.0 - 198.167.143.255 198.167.136.0/21
DNSSLAVE6 198.175.124.0 - 198.175.127.255 198.175.124.0/22
VIRPUS-KC-3 199.119.224.0 - 199.119.227.255 199.119.224.0/22
DNSSLAVE4 199.180.128.0 - 199.180.135.255 199.180.128.0/21
DNSSLAVE5 50.115.160.0 - 50.115.175.255 50.115.160.0/20
VIRPUS-KC-1 208.89.208.0 - 208.89.215.255 208.89.208.0/21
VIRPUS 2604:C00:: - 2604:C00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

We make a good team :)

[wilderness]

US Net Inc
NETBLK-USNET-CBLK1 198.240.64.0 - 198.240.127.255 198.240.64.0/18
US-NET-INCORPORATED 206.225.0.0 - 206.225.31.255 206.225.0.0/19
US-NET-INCORPORATED 207.244.192.0 - 207.244.255.255 207.244.192.0/18
USNET-209-99-146-0 209.99.146.0 - 209.99.146.255 209.99.146.0/24
USNET-209-99-180-0 209.99.180.0 - 209.99.180.255 209.99.180.0/24
USNET-BLK-6 209.99.128.0 - 209.99.191.255 209.99.128.0/18