Server Farms - Sept. 2013

Ongoing Hosting Data Center Discussion

[incrediBILL]

Continuation of the May 2013 thread:
[webmasterworld.com...]

[Angonasec]

Ta for the tip, Sir: Done!

[Angonasec]

"They seem to host across several EU countries."

Iceland yesterday, Europe today, tomorrow ze vorld!"

Nazis just never learn.

[lucy24]

Nazis just never learn.

I probably should not have laughed quite so hard when I started pasting-in EDIS ranges and found that the 37.235.c.d. piece was in my notes as Poland...

[Angonasec]

My German friends claim every vestige of Nazism has been eradicated, and are truly ashamed of their modern history.
But Austrians...

[Angonasec]

Moving rapidly on from the subject of National Socialism...

Ontario, Canada, is also host to some very unpleasant characters, amongst which we present: spdnetwork

67.213.64.0 - 67.213.95.255 67.213.64.0/19 Blocked
AS40028 SPDNETWORK-03

Visited our valid robots.txt, ignored its disallow, and proceeded to grab dozens of pages until zapped.

67.213.90.nn - - [02/Feb/2014] "GET /robots.txt HTTP/1.1" 200 3101 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT)"

[lucy24]

MSIE five? Even on my (very permissive) site they'd never have got past the Old Browsers page.

[keyplyr]

ditto

[Angonasec]

OK, where do we draw the line if not Netscape 3? :)

We still have css hacks for IE 6...

But in my defence, we've blocked Blackberry on UA (and principle) for ages.

[dstiles]

New MS range, registered last June:

23.96.0.0 - 23.103.255.255
23.96.0.0/13

I've started off with it blocked; we'll see what developes.

[blend27]

But in my defence, we've blocked Blackberry on UA (and principle) for ages.

I know 12,000+ people, well educated(think 100K+) that use BBs, me(I have 3) included. I actually had to redo several intranet apps recently to accommodate the browser.

[Angonasec]

You work in the Pentagon?
If so, advise your colleagues, if they do not already know, why they are not welcome on the 21C internet. :)

[bobothecat2]

New DataShack range (to me) registered 12/2013

107.150.32.0 - 107.150.63.255
107.150.32.0/19

[keyplyr]

Actually I'm pretty sure that DS range has been around since about March of 2011 (according to my notes.)

[bobothecat2]

NetRange: 107.150.32.0 - 107.150.63.255
CIDR: 107.150.32.0/19
OriginAS: AS33387
NetName: DSV4-8
NetHandle: NET-107-150-32-0-1
Parent: NET-107-0-0-0-0
NetType: Direct Allocation
RegDate: 2013-12-03
Updated: 2013-12-03

[keyplyr]

Not that it actually matters, but I've had 107.150.32.0/19 blocked in a client's htaccess for well over 2 years and my note says it was registered 03/2011. I've often seen the original registration date changed when the info is updated.

FWIW - whois.domaintools.com also says AS33387 DATASHACK - DataShack, LC (registered Mar 18, 2011)

[bobothecat2]

Actually, the entire 107.150. range was re-registered/appointed during 12/2013.

Not that it matters. :)

[keyplyr]

Yup, that's what I said :)

I've often seen the original registration date changed when the info is updated.

[lucy24]

keyplyr, are you positive your notes aren't attached to some type of time machine? I've still got huge slabs of 107 labeled bogon, including most of 144-191 with isolated holes. (Almost all of the holes are block-on-sight server farms. Figures.)

[not2easy]

Found one I had no info on, not a new register, but new to me:
Netelligent Hosting Services (Montreal)
67.212.64.0 - 67.212.95.255
67.212.64.0/19

Wearing UA "c3.sh/0.01" which I have not seen before.

[keyplyr]

@lucy24 did you look at the source I gave?

[Angonasec]

Thought I had HP fully blocked, but today 15.126.240.nnn displayed identical behaviour to those hyperactive Swedish fellows, xeex, et al...
Make your own minds up.
For me 15.0.0.0/8 is now Blocked

[lucy24]

Fer hevvins sakes, I'm not saying you're wrong. Just that you seem to get a lot of retroactively correct information, which is unnerving :)

[keyplyr]

oh

[Angonasec]

Mention of Bogons is relevant.

I had to contact two site hosts recently because I couldn't access their sites.

The first one took some time to resolve.

It was my national Asian ISP, who had used a Bogon IP (quite legitimately) in relaying, but the host-site had not updated their Bogon filter.

The second incident:
Took me three months to get the CTO's attention, (whilst being fobbed-off by their Indian call-centre).

I'd guessed the same precipitating cause.

The guilty party this time was a major UK utility company using an old Bogon filter, until I nudged them to update it.

Problem solved.

Lesson: Regularly refresh +our+ Bogon filters.

[keyplyr]

Automattic.com
192.0.64.0/18
192.0.64.0 - 192.0.127.255

[Angonasec]

Yet another nasty piece of work residing in Ontario Canada.
Identical behaviour to xeex, eonix, and those jolly Swedish chaps, but with a different UA

AS22923 YESUP-COM
166.48.0.0 - 166.48.255.255 166.48.0.0/16 Blocked

166.48.192.nnn - - [05/Feb/2014] "GET /example.htm HTTP/1.1" 200 6101 "Mozilla/5.0 (iPad; CPU OS 5_1_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9B206 Safari/7534.48.3"

[incrediBILL]

Thread too big.

Continued in the Feb. 2014 thread:
[webmasterworld.com...]