Server Farms - Feb. 2014

Ongoing Hosting Data Center Discussion

[incrediBILL]

Continuation of the Sept 2013 thread:
[webmasterworld.com...]

[bobothecat2]

I have a few extras for ISPrime

64.111.192.0/19
64.111.192.0 - 64.111.223.255

64.188.48.0/20
64.188.48.0 - 64.188.63.255

66.230.128.0/18
66.230.128.0 - 66.230.191.255

68.169.96.0/20
68.169.64.0 - 68.169.111.255

76.9.0.0/19
76.9.0.0 - 76.9.31.255

92.61.240.0/20
92.61.240.0 - 92.61.255.255

162.217.36.0/22
162.217.36.0 - 162.217.39.255

199.167.64.0/22
199.167.64.0 - 199.167.67.255

[Angonasec]

Thank you Bobo: Filed away for future use.
I've got most of 66. blocked.

[dstiles]

Thanks for the extra ISPrime ranges.

[Angonasec]

Many of you will have this one, which I unaccountably let through. (I'm busy moving our sites after a decade with a splendid-but-even-more-retro-than-me host.)

Arch NY nasty:
Digital Ocean Inc. NY Simple Cloud Hosting

Obeyed robots.txt but nonetheless unwelcome and now blocked:
107.170.0.0 - 107.170.255.255 107.170.0.0/16 Blocked
OriginAS: AS14061, AS62567, AS46652


107.170.42.10 - - [18/Feb/2014] "GET /robots.txt HTTP/1.1" 200 670 "-" "Mozilla/5.0 (compatible; spbot/4.0.7; +http://OpenLinkProfiler.org/bot )"

[blend27]

inetnum: 185.38.249.0 - 185.38.249.255
route: 185.38.248.0/22
netname: SPRINT-SDC-FIRE
descr: Sprint Data Center Customer
country: PL

Comment spammer from 185.38.249.217.

----------------------------------------------------
Aeori Web Hosting (has more ranges)
NetRange: 68.234.0.0 - 68.234.31.255
CIDR: 68.234.0.0/19
country: US

[keyplyr]

Serverius
5.255.72.0/22
5.255.72.0 - 5.255.75.255

[blend27]

Gigas Hosting SL - from Spain

5.56.60.0/22
5.56.60.0 - 5.56.63.255

5.56.56.0/22
5.56.56.0 - 5.56.59.255

146.255.96.0 - 146.255.99.255
146.255.96.0/22

146.255.100.0 - 146.255.103.255
146.255.100.0/22

[keyplyr]

Thanks Blend27. I didn't have either of the broadened ranges. Just had the /22's. So...

These:
5.56.60.0/22
5.56.60.0 - 5.56.63.255
5.56.56.0/22
5.56.56.0 - 5.56.59.255

Can be condensed to:
5.56.60.0/21
5.56.56.0 - 5.56.63.255

And these:
146.255.96.0 - 146.255.99.255
146.255.96.0/22
146.255.100.0 - 146.255.103.255
146.255.100.0/22

Can be condensed to:
146.255.96.0 - 146.255.103.255
146.255.96.0/21

[blend27]

Thanks keyplyr,

These were a morning quickie, 2 IPs from one range were acting up, so I listed all ranges I had.

Would never happen again... :)

[keyplyr]

Fiber Grid (Layered Tech)

165.231.0.0 - 165.231.255.255
165.231.0.0/16

196.196.0.0 - 196.196.255.255
196.196.0.0/16

[keyplyr]

This server range may have some broadband in there, but I've been getting repeat offenders from:

fibersunucu.com.tr
217.195.192.0/20
217.195.192.0 - 217.195.207.255


Which contains what I had formerly noted as:
Buyurl
217.195.202.0/24
217.195.202.0 - 217.195.202.255

[dstiles]

I had that, too. Now set the /20 to TR. The band just above it is a Russian server range, by the way.

[not2easy]

I'm getting bad actors from XO Communications' ALGX at 216.0.0.0 - 216.5.255.255 216.0.0.0/14

And Mainstream Consulting's MCGNET at
64.202.240.0 - 64.202.255.255 64.202.240.0/20

And TOQEN-NET at
198.41.96.0 - 198.41.127.255 198.41.96.0/19

Most interesting was : "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" trying some sql injection from 222.178.10.2XX


_{(Edited to replace missing tabs with spaces/readability..)}

[keyplyr]

My XO list:

207.155.128.0 - 207.155.255.255
207.155.128.0/17

208.176.0.0 - 208.177.255.255
208.176.0.0/15

216.0.0.0 - 216.5.255.255
216.0.0.0/14

[not2easy]

Thank you, I did not have the 207 group, I only had one previous note for XO anywhere.

[Angonasec]

You Gents are far too soft on 217.
Get some Turkish friends to tell you why.

[dstiles]

My XO list below. As listed they are full not-blocked ranges. A few have blocked sub-ranges within them.

64.0.0.0 - 64.3.255.255
64.244.0.0 - 64.245.255.255
65.44.0.0 - 65.47.255.255
66.88.0.0 - 66.89.255.255
66.236.0.0 - 66.239.255.255
67.88.0.0 - 67.95.255.255
67.104.0 - 67.111.255.255
67.152.0.0 - 67.155.255.255
71.4.0.0 - 71.5.255.255
206.83.64.0 - 206.83.95.255
206.111.0.0 - 206.111.255.255
206.205.0.0 - 206.205.255.255
207.86.0.0 - 207.88.255.255
207.155.128.0 - 207.155.255.255
207.238.0.0 - 207.239.255.255
208.36.0.0 - 208.37.255.255
208.176.0.0 - 208.177.255.255
209.31.0.0 - 209.31.255.255
209.116.0.0 - 209.119.255.255
209.164.0.0 - 209.164.63.255
209.220.0.0 - 209.220.255.255
216.0.0.0 - 216.5.255.255
216.112.0.0 - 216.112.255.255
216.120.0.0 - 216.120.127.255
216.156.0.0 - 216.156.255.255

[keyplyr]

QuickWeb

103.246.248.0/24
103.246.248.0 - 103.246.248.255

199.83.100.0/22
199.83.100.0 - 199.83.103.255

More?

[bobothecat2]

QuickWeb

103.246.248.0/24
103.246.248.0 - 103.246.248.255

199.83.100.0/22
199.83.100.0 - 199.83.103.255

More?

I also have:

199.195.140.0/22
199.195.140.0 - 199.195.143.255

[wilderness]

QuickWeb Technologies LLC (QTL-6)
Corporate Colocation Inc. (CORPO-6)
CORPCOLO-66-117-11-16-29 66.117.11.16 - 66.117.11.23 66.117.0.0/20
QUICKWEB-NET 198.154.180.0 - 198.154.183.255 198.154.180.0/22
54046-QUICKWEB-NET-USA 199.231.232.0 - 199.231.235.255 199.231.232.0/22
QUICKWEB-USA-NET 199.195.140.0 - 199.195.143.255 199.195.140.0/22
QUICKWEB-NET-USA 199.83.100.0 - 199.83.103.255 199.83.100.0/22
CORPCOLO-74-124-208-128-27 74.124.208.128 - 74.124.208.159 74.124.192.0/19
CORPCOLO-205-134-242-112-30 205.134.242.112 - 205.134.242.115 205.134.224.0/19
CORPCOLO-205-134-242-116-30 205.134.242.116 - 205.134.242.119 205.134.224.0/19

Corporate Colocation Inc. (CORPO-6)
[whois.arin.net...]

[keyplyr]

Thanks for the XO and the QuickWeb ranges.

[quadranet]

I apologize for my stupidity, but I must ask why our IPs are on this forum as a "server farm".

Also, the 'Web Africa Proxy' comment was a proxy registration of our ASN IRR object on RIPE by the company 'Web Africa'.

We are a datacenter that sell dedicated servers, collocation cabinets and suites/cages.

If you have issues with any of our customers you can report them to [e-mail]. You can also confirm the assignment size by querying our rWHOIS server at rwhois.quadranet.com on port 4321.

[keyplyr]

I must ask why our IPs are on this forum as a "server farm"...
We are a datacenter that sell dedicated servers, collocation cabinets and suites/cages.

Yes, you just described a server farm.

We block IP ranges assigned to server farms since no human traffic results from servers, only robots, most of which conduct bad behavior (data mining, hacking, scraping content, etc.) We do allow some robots that have been determined to be beneficial. This is done on a case by case basis.

Thanks for the abuse contact & query info.

[quadranet]

Thanks keyplyr.

Note that most of our IP space is in-use for hosters and enterprise customers (eg. bittorrent.com) versus 'scrapers'. There are a number of eyeballs on our network. (TOR nodes, VPN companies, and MetroE/T1s)

Blocking our ranges carte blanche will result in some legitimate users being blocked.

[wilderness]

Blocking our ranges carte blanche will result in some legitimate users being blocked.

You mean like this one hammering for PHP vulnerabilities!

96.44.189.102 - - [01/Mar/2013:13:01:20 -0500]

or this one

198.55.109.18 - - [02/Nov/2013:17:45:27 -0600]

[quadranet]

wilderness,

Thanks for the info, I'm going to PM you to hopefully deal with those. The first one is a TOR node, but logs will help so I can speak with the customer about hopefully blocking some abuse.

[wilderness]

Ive the IP ranges denied and a resolution in place.

Thanks anyway.

[Angonasec]

Somebody please give me a full list of Quadranet IPs urgently...

[wilderness]

Their on page 2 of this thread. No reason to duplicate.

[Angonasec]

Roger Don, it was intended as a rhetorical comment on Quadranet personnel :)