Server Farms - Feb. 2014

Ongoing Hosting Data Center Discussion

[incrediBILL]

Continuation of the Sept 2013 thread:
[webmasterworld.com...]

[keyplyr]

API-Digital
67.58.64.0/19
67.58.64.0 - 67.58.95.255

[keyplyr]

Delta-X, RU
91.206.200.0/23
91.206.200.0 - 91.206.201.255

[wilderness]

API-Digital

keyplr,
Although it's not part of my normal vocabulary, I'd suggest caution with this categorization.

API-Digital is a very large network (15 ranges in all) and colo is a mere part of their overall service.

[keyplyr]

Thanks Don, of course you're correct.

The trouble came from a media site that has a small sub-range within 67.58.64.0/19. When I saw that API-Digital also hosted gaming sites (a thorn in my side for years) as well as other colo services, I pulled the trigger.

Now that you've drawn my attention I see wireless and other ISP types speckled in there :)

[keyplyr]

ecommerce.com & ixwebhosting
173.83.0.0/16
173.83.0.0 - 173.83.255.255

[not2easy]

Such a shiny new thread!
Seeing a new Amazon range at 54.72.0.0 - 54.95.255.255 with CIDRs: 54.72.0.0/13 and 54.80.0.0/12 that was registered 11-25-13.

Edited to add - I see now that dstiles posted this over in the Amazon pages - sorry, I'm having ISP difficulties this week and limping on a mobile modem so I'm missing a lot.

[Angonasec]

I block all of 54.

Tethered to a mobile; Luxury!

Try Asian dial-ups, or even maintaining a site via "Internet Shops". (Remember those?)

[keyplyr]

Lots of people connect throughout 54. Example: Whitehouse Telecom, New Jersey where my brother is.

[Angonasec]

Not to our site they don't.

Your brother... a missionary or inmate? :)

[dstiles]

> Lots of people connect throughout 54

Tough. If Amazon cannot delineate their services properly they get blocked. I even block proxy accesses through them - especially block!

[keyplyr]

Tough. If Amazon cannot delineate their services properly they get blocked.

Nothing to do with Amazon. Anyone blocking 54/8 is shutting out a lot of human traffic.

[lucy24]

95.141.32.0/20
"SeFlow.it Internet Services"

One-off robot from 95.141.41.2, but I think it's all servers.

[keyplyr]

I've had them blocked for well over a year.

BTW, what does "one-off" mean?

[keyplyr]

Fast-Serv.com
199.58.160.0/21
199.58.160.0 - 199.58.167.255

[lucy24]

BTW, what does "one-off" mean?

I've seen them only one time, making only one request. Or just once per site.* I'm currently in a grumpy mode w/r/t robots, and am therefore blocking them wholesale. Ordinarily I ignore any isolated requests for front page alone, since I'm not a front-driven site and it's really no skin off my nose.


* For some reason I now own five domains. This would seem to be at least four more than I need, but oh well.

[Angonasec]

"Tough. If Amazon cannot delineate their services properly they get blocked. I even block proxy accesses through them - especially block!"

:)


Gobbling 403's; A nasty hacking attempt today from the Mormon owned data centre in, you guessed, Utah, USA;

We present...

Unified Layer
198.1.64.0 - 198.1.127.255 198.1.64.0/18 Blocked

[Angonasec]

You need 95. Lucy?
Let them go, we only allow 3 CIDRs from that A.

[keyplyr]

Brinkster
65.182.96.0/20
65.182.96.0 - 65.182.111.255

[keyplyr]

Servers and open proxy

Quadranet
192.161.48.0/20
192.161.48.0 - 192.161.63.255

[wilderness]

Believe there's an old thread on OC3/Quadranet

QuadraNet, Inc (QUADR-20) [OC3 Networks]
QuadraNet provides dedicated hosting servers, enterprise level solutions, infracloud, and
colocation services
QUADRANET 107.161.80.0 - 107.161.95.255 107.161.80.0/20
QUADRANET 173.254.192.0 - 173.254.255.255 173.254.192.0/18
QUADRANET 192.161.48.0 - 192.161.63.255 192.161.48.0/20
QUADRANET 192.161.160.0 - 192.161.191.255 192.161.160.0/19
QUADRANET 198.55.96.0 - 198.55.127.255 198.55.96.0/19
QUADRANET 198.96.88.0 - 198.96.95.255 198.96.88.0/21
QUADRANET 204.152.192.0 - 204.152.223.255 204.152.192.0/19
PacketExchange, Inc 216.193.192.0 - 216.193.255.255 216.193.192.0/18
UNUSED-LEGACY-REALLOCATION 216.193.195.0 - 216.193.195.255 216.193.195.0/24
UNUSED-LEGACY-REALLOCATION 216.193.198.224 - 216.193.198.231 216.193.198.224/29
QUADRANET 216.45.48.0 - 216.45.63.255 216.45.48.0/20
PacketExchange, Inc 64.235.224.0 - 64.235.255.255 64.235.224.0/19
UNUSED-LEGACY-REALLOCATION 64.235.227.72 - 64.235.227.79
UNUSED-LEGACY-REALLOCATION 64.235.237.64 - 64.235.237.71
UNUSED-LEGACY-REALLOCATION 64.235.236.232 - 64.235.236.239
UNUSED-LEGACY-REALLOCATION 64.235.238.224 - 64.235.238.231
UNUSED-LEGACY-REALLOCATION 64.235.249.0 - 64.235.249.255
QUADRANET 66.63.160.0 - 66.63.191.255 66.63.160.0/19
QUADRANET 72.11.128.0 - 72.11.159.255 72.11.128.0/19
PacketExchange, Inc 72.37.128.0 - 72.37.255.255 72.37.128.0/17
UNUSED-LEGACY-REALLOCATION 72.37.130.0 - 72.37.130.255
UNUSED-LEGACY-REALLOCATION 72.37.138.0 - 72.37.138.255
UNUSED-LEGACY-REALLOCATION 72.37.160.248 - 72.37.160.255
UNUSED-LEGACY-REALLOCATION 72.37.174.0 - 72.37.174.255
UNUSED-LEGACY-REALLOCATION 72.37.179.0 - 72.37.179.255
UNUSED-LEGACY-REALLOCATION 72.37.213.0 - 72.37.213.255
UNUSED-LEGACY-REALLOCATION 72.37.214.0 - 72.37.214.255
UNUSED-LEGACY-REALLOCATION 72.37.215.0 - 72.37.215.255
QUADRANET 96.44.128.0 - 96.44.191.255 96.44.128.0/18
QUADRANET 98.143.144.0 - 98.143.159.255 98.143.144.0/20
QUADRANET 2607:FCD0:: - 2607:FCD0:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

Thanks Don, had all those. The one I posted was new to me and also the fact that it was being used as a proxy for a bot in Africa.

[keyplyr]

DFW DataCenter
(Dallas Fort Worth, Texas)
72.9.144.0/20
72.9.144.0 - 72.9.159.255

[keyplyr]

8.37.227.61 - - [14/Feb/2014:23:09:49 -0800] "GET /favicon.ico HTTP/1.1" 403 665 "-" "Nokia3120classic/2.0 (12.35) Profile/MIDP-2.1 Configuration/CLDC-1.1 Opera/9.60 (J2ME/MIDP;Opera Mini/4.2.13337Mod.by.CHIZZY/503; U; en)Presto/2.2.0 UNTRUSTED/1.0"

Chinanetcenter.com
Pasadena, CA
8.37.224.0/20 #8.37.224.0 - 8.37.239.255

Services include Security, Web Acceleration, Hosting & Colo.

[wilderness]

keyplr,
You allow Level3 access?
Don

[lucy24]

8.37.227.61 - - [14/Feb/2014:23:09:49 -0800] "GET /favicon.ico HTTP/1.1" 403 665 "-" "Nokia3120classic/2.0 (12.35) Profile/MIDP-2.1 Configuration/CLDC-1.1 Opera/9.60 (J2ME/MIDP;Opera Mini/4.2.13337Mod.by.CHIZZY/503; U; en)Presto/2.2.0 UNTRUSTED/1.0"

What would a cell phone-- whether TRUSTED or not-- need with a favicon?

[blend27]

inetnum: 91.188.117.0 - 91.188.117.255
netname: RING
country: PL
route: 91.188.117.0/24

91.188.117.249 - guest book trap, comment spam attempts, hopeless...
Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A403 Safari/8536.25

inetnum: 94.228.129.0 - 94.228.131.255
netname: PROLOCATION
country: NL
route: 94.228.128.0/20

[keyplyr]

keyplr,
You allow Level3 access?
Don

Absolutely

What would a cell phone-- whether TRUSTED or not-- need with a favicon?

Dunno. This was obviously a probe to see what's up, but if in fact a cell phone did really request a favicon, there may be use as a tile, much in the same manner as a apple-touch-icon or browserconfig.xml icons. Too many new devices to know how they all work.

[added]Just checked on my Android phone. Yup, for a site where I have not designated an apple-touch-icon or a png to be used as a tile in browserconfig.xml, my Chrome browser uses the favicon as the icon in the bookmarks directory. Can't check the native Android web browser as I've disabled it.

And it's not the device that's UNTRUSTED, it's the network.

[Angonasec]

And from the Spanish-speaking enclave, up pops an ISPrime proxy;

NatCoWeb Corp.
AS23393 ISPrime, Inc.

66.230.128.0 - 66.230.191.255 66.230.128.0/18 Blocked

[keyplyr]

ISPrime

64.188.48.0/20
64.188.48.0 - 64.188.63.255

66.230.128.0/18
66.230.128.0 - 66.230.191.255

68.169.96.0/20
68.169.64.0 - 68.169.111.255

76.9.0.0/19
76.9.0.0 - 76.9.31.255