Server Farms - Feb. 2014

Ongoing Hosting Data Center Discussion

[incrediBILL]

Continuation of the Sept 2013 thread:
[webmasterworld.com...]

[dstiles]

Several new-ish google ranges, registered or updated last October/November.

Many linux wgets in about 50 minutes on 19 IPs from those ranges.

NetRange: 23.251.128.0 - 23.251.159.255
CIDR: 23.251.128.0/19
OriginAS: AS15169
NetName: GOOGLE-CLOUD

NetRange: 23.236.48.0 - 23.236.63.255
CIDR: 23.236.48.0/20
OriginAS: AS15169
NetName: GOOGLE-CLOUD

NetRange: 162.222.176.0 - 162.222.183.255
CIDR: 162.222.176.0/21
OriginAS: AS15169
NetName: GOOGLE-CLOUD

NetRange: 108.59.80.0 - 108.59.95.255
CIDR: 108.59.80.0/20
OriginAS: AS15169
NetName: GOOGLE-CLOUD

[keyplyr]

@dstiles - same here

[not2easy]

Thanks for the corrections, seriously appreciated! The ARCOR designation was in the Vodaphone record so I thought that Arcor maint. servers is what the wider range covered, and for Vodaphone, Verizon, Roadrunner etc. communications cases I always only block the offending user, then watch for more of the same. I do copy the entire record for all my lookups, helps to see changes next time. :)

[not2easy]

Two more scrapers today:
188.138.220.0 - 188.138.220.255
STARNETMD in Moldova
route: 188.138.128.0/17
CIDR: (from online converter..) 188.138.220.0/24

185.35.128.0 - 185.35.131.255
RU-MAGAS
CIDR: 185.35.128.0/22

[keyplyr]

Starnet.md is a Moldova ISP. There may be a user running a scraper tool or private bot, but I usually don't block ISPs and their customers.

Whereas Terralink(RU-MAGAS) does offer cloud hosting and appears to be developing even more. Thanks.

[dstiles]

Starnet may be an ISP but the six ranges I have are blocked.

37.233.0.0 - 37.233.63.255
87.248.160.0 - 87.248.191.255
89.28.0.0 - 89.28.127.255
95.65.0.0 - 95.65.127.255
178.168.0.0 - 178.168.127.255
188.138.128.0 - 188.138.255.255

[keyplyr]

162.212.131.32 - - [31/Mar/2014:13:14:56 -0700] "GET /components/com_community/index.html HTTP/1.1" 403 1370 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2"
162.212.131.32 - - [31/Mar/2014:13:14:56 -0700] "GET /buildings/components/com_community/index.html HTTP/1.1" 403 1370 "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.14.0.0 zlib/1.2.3 libidn/1.18 libssh2/1.4.2"

Blocked due to UA, but of note because of server farm:


A2Hosting
162.212.128.0 - 162.212.135.255
162.212.128.0/21

[not2easy]

I had a similar but different visitor come in with the blocked UA:
"curl/7.15.5 (i386-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5"
from ADD2NET-DOT-COM67.210.96.0 - 67.210.127.255
I had not seen such a combination before.

Tiscali scraper I had no record for: (FR) IE-POOL-BUSINESS-HOSTING
62.210.128.0 - 62.210.255.255

[keyplyr]

@not2easy that range is actually:

Illiad Enterprises (http://www.online.net , http://iliad-entreprises.fr)
62.210.0.0 - 62.210.255.255
62.210.0.0/16

A long-time offender

[not2easy]

OK, thanks! It has both names in the record and I have lots of other Tiscali listings so it was put with them, but I'll set it right.
It shows:
netname: IE-POOL-BUSINESS-HOSTING
descr: IP Pool for Iliad-Entreprises Business Hosting Customers
country: FR
admin-c: IENT-RIPE
tech-c: IENT-RIPE
status: LIR-PARTITIONED PA
mnt-by: MNT-TISCALIFR-B2B

[keyplyr]

uni5.net servers in Brazil
177.12.160.0 - 177.12.163.255
177.12.160.0/20

[not2easy]

Automated requests for non existent admin files
nFrame NFRAME (NET-216-37-0-0-1)
216.37.0.0 - 216.37.63.255
216.37.0.0/18
nFrame NFRAME (NET-216-37-55-128-1)
216.37.55.128 - 216.37.55.255
216.37.55.128/25

[dstiles]

keyplr - 177.12.160.0/20 is actually (and correctly) 177.12.160.0 - 177.12.175.255 - but thanks for the tip! :(

not2easy - 216.37.0.0/18 includes 216.37.55.128/25 but again, thanks.

[keyplyr]

@dstiles - thanks... I had updated the CIDR (from what the WhoIS reports) but had forgotten to change the range (which I only use for my notes anyway.)

[wilderness]

NFRAME 206.223.22.0 - 206.223.22.255 206.223.22.0/24
NFRAME 208.40.224.0 - 208.40.255.255 208.40.224.0/19
NFRAME 216.239.240.0 - 216.239.255.255 216.239.240.0/20
NFRAME 216.37.0.0 - 216.37.63.255 216.37.0.0/18
NFRAME 64.72.128.0 - 64.72.159.255 64.72.128.0/19
NFRAME 64.255.240.0 - 64.255.255.255 64.255.240.0/20
NFRAME 2607:F218:: - 2607:F218:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

Thanks Don

[keyplyr]

Just a FYI for anyone who cares... NFrame is now Expedient.

[keyplyr]

Ukraine and Russian Servers/VPS:
146.185.232.0 - 146.185.239.255
146.185.232.0/21

DataVektor
146.185.240.0 - 146.185.240.255
146.185.240.0/24

[incrediBILL]

Discussion continued here:
[webmasterworld.com...]