Server Farms - Sept. 2013

Ongoing Hosting Data Center Discussion

[incrediBILL]

Continuation of the May 2013 thread:
[webmasterworld.com...]

[wilderness]

Are you sure about this one?

lucy,
I'm not "sure" of what my name is.

FWIW, those ranges were retrieved from ARIN Whois and if there are errors?
Please complain to ARIN.

[blend27]

new for me:

NetRange: 23.238.128.0 - 23.238.255.255
CIDR: 23.238.128.0/17
NetName: PSYCHZ-NETWORKS
RegDate: 2013-10-23
Updated: 2013-10-23

[not2easy]

NETWORK INNOVATIONS is
64.237.112.0 - 64.237.127.255 which is 112.0/20

Waveform is the smaller range as shown.

NETWORK INNOVATIONS also includes
NW Colonet NWCOLO
64.237.119.0 - 64.237.119.255

[bobothecat2]

Cologix Canada, Inc.

74.116.192.0 - 74.116.199.255 74.116.192.0/21
208.94.172.0 - 208.94.175.255 208.94.172.0/22

[Angonasec]

Not strictly within the remit of this thread, but a pal received a phishing email claiming to be from Apple, which was in fact from eastbaycrabhouse.com (Default Firefox blocks that domain as an attack site.)
Reason enough for me to block the range of TierraNet Inc.
209.240.128.0 - 209.240.159.255 209.240.128.0/19

If they allow phishers on their servers they deserve the Ann Boleyn solution.

[bobothecat2]

JCHost Internet Services, LLC

199.91.172.0 - 199.91.175.255 199.91.172.0/22

[bobothecat2]

-

[dstiles]

> If they allow phishers on their servers they deserve the Ann Boleyn solution.

Correction: If they are servers they deserve... :)

Thanks for the IP I didn't have that one.

[lucy24]

Met a one-off malign robot at 195.78.109.147 (off the top of your head, anyone recognize "/lightbox/auth/signup/index/navname/signup"? sounds like a CMS). Czech Republic; free lookup says Global Routing with nebulous hint that it's a proxy. But I hate to muck about with /23 slivers so I looked around. 110-111 (the other half of the /22) is Shopzilla, which sounds expendable.

Further:
104-105 195.78.104.0/23 Ukraine
106-107 195.78.106.0/23 Romania
won't even bother to look those up. That's /21

Still further:
96-97 195.78.96.0/23 Ukraine
98-99 195.78.98.0/23 Austria
100-101 195.78.100.0/23 Ukraine
102-103 195.78.102.0/23 Russia
The Austria one is a joint called Cashpoint which may or may not be online gambling.

Still further:
112-113 195.78.112.0/23 Ukraine
114-115 and 116-119 195.78.114.0/23 and 195.78.116.0/22 Russia
120-121 195.78.120.0/23 Netherlands
122-123 195.78.122.0/23 Czech R
124-125 195.78.124.0/23 Romania
126-127 195.78.126.0/23 Russia

Netherlands: "Conduit Connect". Shrug.
Czech Republic: Zeal s.r.o. Search engine says "komplexní datové a telekomunikacní služby · Outsourcing ICT" (You will be disappointed to learn that "služby" apparently just means "services", at least according to google translate. It's really c-hacek but the Forums didn't like that.)

So...

Can I go ahead and lock out the whole /19 to save time? The bottom half of the /18 (from .64 on up) is similarly chopped into /23 slices, mostly central-to-eastern Europe, but I didn't feel like looking them up.

[wilderness]

TierraNet Inc.
TIERRANET 209.240.128.0 - 209.240.159.255 209.240.128.0/19
TIERRANET-2BLK 216.104.160.0 - 216.104.191.255 216.104.160.0/19
TIERRANET-3BLK 72.1.32.0 - 72.1.47.255 72.1.32.0/20
TIERRANET-4BLK 2606:1400:: - 2606:1400:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[wilderness]

JCHost Internet Services, LLC (JCHOS)
JCHOST-NET 199.193.152.0 - 199.193.155.255 199.193.152.0/22
JCHOST-NET 199.91.172.0 - 199.91.175.255 199.91.172.0/22
JCHOST-IPV6 2604:2D00:: - 2604:2D00:FFF:FFFF:FFFF:FFFF:FFFF:FFFF

[Angonasec]

dstiles: Point taken. A distinction I've had greasy cloud serving "hosts" in NY try to make in response to DMCA Notices.

Wilderness: Thank you for helping us keep out TierraNet.
(All California based; such a lawless State.)

[Angonasec]

We 403 theplanet/softlayer by default, so I was surprised to see a hit from 174.123.86.x ( mdservers.net masondevelopment.com ) using that Texan devil attempting to post a long Chinese alphanumeric string... and receive a 404.

[bobothecat2]

ViaWest

64.58.224.0 - 64.58.239.255 64.58.224.0/20
64.78.144.0 - 64.78.159.255 64.78.144.0/20
64.90.192.0 - 64.90.207.255 64.90.192.0/20
66.51.0.0 - 66.51.31.255 66.51.0.0/19
66.97.128.0 - 66.97.143.255 66.97.128.0/20
66.114.96.0 - 66.114.127.255 66.114.96.0/19
74.63.128.0 - 74.63.191.255 74.63.128.0/18
204.246.128.0 - 204.246.151.255 204.246.144.0/21, 204.246.128.0/20
206.71.64.0 - 206.71.95.255 206.71.64.0/19
207.189.96.0 - 207.189.127.255 207.189.96.0/19
209.170.192.0 - 209.170.223.255 209.170.192.0/19
216.24.128.0 - 216.24.159.255 216.24.128.0/19
216.38.192.0 - 216.38.223.255 216.38.192.0/19
216.46.160.0 - 216.46.191.255 216.46.160.0/19
216.58.128.0 - 216.58.175.255 216.58.128.0/19, 216.58.160.0/20
216.87.64.0 - 216.87.95.255 216.87.64.0/19
216.150.192.0 - 216.150.223.255 216.150.192.0/19

[dstiles]

Thanks. Several new ones in that list. :)

[Angonasec]

For your delectation; Another bot from the lawless Wild West:
142.91.79.12.rdns.ubiquity.io Ubiquity Server Solutions LA (Nobis Technology Group, LLC)
142.91.0.0 - 142.91.255.255 142.91.0.0/16

[Angonasec]

And on the other side we have Peer1 hosting of NY:
66.199.128.0 - 66.199.191.255 66.199.128.0/18

[lucy24]

74.63.128.0 - 74.63.191.255 74.63.128.0/18

This IP seemed awfully familiar so I checked.
74.63.192.0/18 (already blocked) Limestone
74.63.64.0/18 (already blocked) FDC
74.63.32.0/19 Voxel Dot Net, including ExactSeek
that leaves only
74.63.0.0/19
which turns out to be Lightpoint "colo and hosting".

ExactSeek is currently classified as "no skin off my nose". But if you feel differently, that means you could happily block all of
74.63
and be done with it.

[bobothecat2]

Thanks Lucy, did not know about Lightpoint Colocation & Hosting LLC.:

68.233.0.0 - 68.233.31.255 68.233.0.0/19
74.63.0.0 - 74.63.15.255 74.63.0.0/20
207.162.208.0 - 207.162.223.255 207.162.208.0/20

[bobothecat2]

Net Access Corporation

64.21.0.0 - 64.21.191.255 64.21.0.0/17, 64.21.128.0/18
64.247.0.0 - 64.247.63.255 64.247.0.0/18
66.29.0.0 - 66.29.127.255 66.29.0.0/17
66.246.0.0 - 66.246.255.255 66.246.0.0/16
67.196.0.0 - 67.196.255.255 67.196.0.0/16
70.47.0.0 - 70.47.255.255 70.47.0.0/16
207.99.0.0 - 207.99.127.255 207.99.0.0/17
207.192.64.0 - 207.192.127.255 207.192.64.0/18
209.123.0.0 - 209.123.255.255 209.123.0.0/16
216.118.64.0 - 216.118.127.255 216.118.64.0/18

[dstiles]

My nobis ranges are as below. All are blocked at the moment except 23.104.0.0 - 23.111.255.255 for which I have no evidence - anyone care to comment?

23.19.0.0 - 23.19.255.255
23.80.0.0 - 23.83.255.255
23.104.0.0 - 23.111.255.255
64.120.0.0 - 64.120.127.255
69.147.224.0 - 69.147.255.255
70.32.32.0 - 70.32.47.255
108.62.0.0 - 108.62.255.255
108.177.128.0 - 108.177.255.255
142.91.0.0 - 142.91.255.255
142.234.0.0 - 142.234.255.255
147.255.0.0 - 147.255.255.255
172.255.0.0 - 172.255.255.255
173.208.0.0 - 173.208.127.255
173.234.0.0 - 173.234.255.255
174.34.128.0 - 174.34.191.255
216.6.224.0 - 216.6.239.255

[dstiles]

My current peer-1 ranges, all blocked, are:

64.34.0.0 - 64.34.255.255
64.45.0.0 - 64.45.63.255
64.65.0.0 - 64.65.63.255
64.224.0.0 - 64.227.255.255
65.39.128.0 - 65.39.255.255
66.33.0.0 - 66.33.127.255
66.111.64.0 - 66.111.95.255
66.132.128.0 - 66.132.255.255
66.199.128.0 - 66.199.191.255
66.234.0.0 - 66.234.15.255
67.211.192.0 - 67.211.207.255
69.0.128.0 - 69.0.255.255
69.28.192.0 - 69.28.255.255
69.90.0.0 - 69.90.255.255
69.172.192.0 - 69.172.255.255
70.33.192.0 - 70.33.255.255
72.51.0.0 - 72.51.63.255
76.74.128.0 - 76.74.255.255
83.222.224.0 - 83.222.255.255
107.6.0.0 - 107.6.63.255
176.74.160.0 - 176.74.191.255
198.244.48.0 - 198.244.63.255
209.25.128.0 - 209.25.255.255
209.95.96.0 - 209.95.127.255
209.203.224.0 - 209.203.255.255
209.213.96.0 - 209.213.127.255
216.25.0.0 - 216.25.127.255
216.65.0.0 - 216.65.127.255
216.122.0.0 - 216.122.255.255
216.150.0.0 - 216.150.31.255
216.152.128.0 - 216.152.143.255
216.157.0.0 - 216.157.111.255
216.195.32.0 - 216.195.63.255

[Angonasec]

dstiles: Thank you Sir!

In gratitude, I can only offer this start-up (yet again from the Wild West) currently referrer spamming my access logs:

Automattic, Inc [sic: Yes, they thought that was a good name]
192.0.64.0 - 192.0.127.255 192.0.64.0/18

[dstiles]

Thanks.:)

I picked that one up late October, visiting with the UA...

WordPress/3.7-beta2-25801; [http://]lucidgypsy[.]wordpress[.]com

([] are mine)

I have a note that there are several wordpress sites on that range, which probably accounts for the bots trying to scrape other sites. Quite apart from wordpress being forever compromised anyway.

[bobothecat2]

ColocateUSA

50.115.0.0 - 50.115.15.255 50.115.0.0/20
64.87.32.0 - 64.87.63.255 64.87.32.0/19
67.58.96.0 - 67.58.111.255 67.58.96.0/20
67.216.80.0 - 67.216.95.255 67.216.80.0/20
98.142.0.0 - 98.142.15.255 98.142.0.0/20
208.69.112.0 - 208.69.119.255 208.69.112.0/21
208.75.176.0 - 208.75.183.255 208.75.176.0/21
208.87.88.0 - 208.87.95.255 208.87.88.0/21

[bobothecat2]

Silicon Valley Web Hosting, Inc.

67.207.192.0 - 67.207.207.255 67.207.192.0/20
69.50.224.0 - 69.50.255.255 69.50.224.0/19
208.69.176.0 - 208.69.183.255 208.69.176.0/21
208.78.240.0 - 208.78.247.255 208.78.240.0/21
208.166.48.0 - 208.166.63.255 208.166.48.0/20

[bobothecat2]

EBOUNDHOST

69.27.32.0 - 69.27.47.255 69.27.32.0/20
216.14.112.0 - 216.14.127.255 216.14.112.0/20

[dstiles]

Another Peer-1 today, in UK...

5.44.16.0 - 5.44.23.255

Split into small sub-ranges in DNS.

[Angonasec]

Datashack, LC:
192.151.144.0 - 192.151.159.255 192.151.144.0/20

And yet another wretched Rackspace Cloud bot:
162.242.128.0 - 162.242.255.255 162.242.128.0/17

[dstiles]

A new (Sep 2013) Rackspace IP range...

162.242.128.0 - 162.242.255.255

Making my current (HUGE!) Rackspace list...

5.79.0.0 - 5.79.63.255
31.222.128.0 - 31.222.191.255
37.188.96.0 - 37.188.127.255
46.38.160.0 - 46.38.191.255
50.56.0.0 - 50.57.255.255
64.39.0.0 - 64.39.31.255
64.49.192.0 - 64.49.255.255
65.61.128.0 - 65.61.191.255
66.216.64.0 - 66.216.127.255
67.192.0.0 - 67.192.255.255
67.207.128.0 - 67.207.223.255
69.20.0.0 - 69.20.127.255
72.3.128.0 - 72.3.255.255
72.4.112.0 - 72.4.127.255
72.32.0.0 - 72.32.255.255
74.205.0.0 - 74.205.127.255
78.136.0.0 - 78.136.63.255
89.234.0.0 - 89.234.63.255
92.52.64.0 - 92.52.127.255
94.236.0.0 - 94.236.127.255
95.138.128.0 - 95.138.191.255
98.129.0.0 - 98.129.255.255
108.166.0.0 - 108.166.127.255
108.171.160.0 - 108.171.191.255
120.136.32.0 - 120.136.47.255
162.13.0.0 - 162.13.255.255
162.209.0.0 - 162.209.127.255
162.242.128.0 - 162.242.255.255
164.177.128.0 - 164.177.159.255
166.78.0.0 - 166.78.255.255
173.203.0.0 - 173.203.255.255
174.143.0.0 - 174.143.255.255
180.150.128.0 - 180.150.159.255
184.106.0.0 - 184.106.255.255
192.237.128.0 - 192.237.255.255
198.61.128.0 - 198.61.255.255
198.101.128.0 - 198.101.255.255
204.232.128.0 - 204.232.255.255
207.97.192.0 - 207.97.255.255
209.61.128.0 - 209.61.191.255
209.114.32.0 - 209.114.63.255
212.64.128.0 - 212.64.159.255
212.100.224.0 - 212.100.255.255