Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• April 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[Angonasec]

New to me...
69.12.75.nnn Colocation host caught scraping html, no images, no robots.
QUADRANET 69.12.64.0 - 69.12.95.255 69.12.64.0/19

[keyplyr]

I believe these QuadraNet ranges have all been listed here before, but if not, here's what I have (all blocked):

66.63.160.0/19
66.63.160.0 - 66.63.191.255

67.215.224.0/19
67.215.224.0 - 67.215.255.255

69.12.64.0/19
69.12.64.0 - 69.12.95.255

72.11.128.0/19
72.11.128.0 - 72.11.159.255

96.44.128.0/18
96.44.128.0 - 96.44.191.255

98.143.144.0/20
98.143.144.0 - 98.143.159.255

107.161.80.0/20
107.161.80.0 - 107.161.95.255

155.94.128.0/17
155.94.128.0 - 155.94.255.255

173.254.192.0/18
173.254.192.0 - 173.254.255.255

192.161.48.0/20
192.161.48.0 - 192.161.63.255

192.161.160.0/19
192.161.160.0 - 192.161.191.255

198.55.96.0/19
198.55.96.0 - 198.55.127.255

198.96.88.0/21
198.96.88.0 - 198.96.95.255

204.44.64.0/18
204.44.64.0 - 204.44.127.255

204.152.192.0/19
204.152.192.0 - 204.152.223.255

[not2easy]

I have another one, I think these were from a list shared last Feb here:
216.45.48.0/20
216.45.48.0 - 216.45.63.255

[keyplyr]

I had 216.45.48/20 listed as OC3, but just checked and it appears it was acquired by QuadrsNet a year ago (as was 66.63.160/19.) Thanks for the heads-up.

[Angonasec]

Yes, thank you, I was sure QUADRANET had featured here, just that this range is new to our site. I did look up the expanding gamut of QUADRANET using Don's tip. Looks like they've acquired many new ranges to entertain us with.

Somebody phone the Daleks please.

[wilderness]

Expedient and/or CONTINENTAL BROADBAND PENNSYLVANIA, INC.

SPRINTLINK 205.246.16.0 - 205.246.17.255 205.246.16.0/23
CBP 206.183.0.0 - 206.183.31.255 206.183.0.0/19
CBP 206.210.64.0 - 206.210.95.255 206.210.64.0/19
CBP 207.54.128.0 - 207.54.191.255 207.54.128.0/18
SPRINTLINK 208.1.140.0 - 208.1.143.255 208.1.140.0/22
SPRINTLINK 208.12.110.0 - 208.12.111.255 208.12.110.0/23
SPRINTLINK 208.27.132.0 - 208.27.132.255 208.27.132.0/24
CBP 208.40.128.0 - 208.40.207.255 208.40.128.0/18 208.40.192.0/20
CBP 209.114.128.0 - 209.114.191.255 209.114.128.0/18
CBP 209.166.128.0 - 209.166.191.255 209.166.128.0/18
CBP 209.190.128.0 - 209.190.191.255 209.190.128.0/18
CBP 209.221.0.0 - 209.221.31.255 209.221.0.0/19
CBP 216.130.0.0 - 216.130.31.255 216.130.0.0/19
CBP 216.151.64.0 - 216.151.127.255 216.151.64.0/18
CBP 216.183.160.0 - 216.183.191.255 216.183.160.0/19
CBP 216.82.64.0 - 216.82.127.255 216.82.64.0/18
SPRINTLINK 63.160.32.0 - 63.160.39.255 63.160.32.0/21
SPRINTLINK 63.169.100.0 - 63.169.103.255 63.169.100.0/22
SPRINTLINK 63.174.16.0 - 63.174.31.255 63.174.16.0/20
CBB 66.11.0.0 - 66.11.31.255 66.11.0.0/19
CBP 66.181.64.0 - 66.181.95.255 66.181.64.0/19
CBP 66.230.64.0 - 66.230.79.255 66.230.64.0/20
CBP 69.7.96.0 - 69.7.111.255 69.7.96.0/20
CBP-IPV6 2607:F4D0:: - 2607:F4D0:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[not2easy]

Thank you immensely for this info!

[wilderness]

Expedient and/or CONTINENTAL BROADBAND PENNSYLVANIA, INC. reciprocating thread [webmasterworld.com]

[keyplyr]

(I guess it is now necessary to post in more than one place)

IMO this has absolutely nothing to do with server farms. Those IP ranges are as they say they are... customer broadband, and as such should not be blocked but YMMV.

The Thuderstone software is a search utility. I use it myself as my site search. Anyone can buy it and use it for a number of things, all search related and harmless. It is not capturing (scraping) your stuff. However, it can be pointed at any domain, any intranet, so someone may be using it to search for information.

[keyplyr]

Tranquil Hosting
162.223.8.0/21
162.223.8.0 - 162.223.15.255

[wilderness]

Tranquil Hosting Related Networks [whois.arin.net]

[wilderness]

Note unusual leading character in UA!
I've the same from a Canadian hosting during Jul & Aug (205.237.88.145 )

208.93.7.118 - - [13/Aug/2014:04:27:25 -0600] "GET / HTTP/1.0" 403 832 "-" "=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16"
208.93.7.102 - - [14/Aug/2014:21:16:41 -0600] "GET / HTTP/1.0" 403 832 "-" "=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16"


Dino Solutions, Inc. (hosting and cloud)
DINONET 208.86.196.0 - 208.86.199.255 208.86.196.0/22
DSNETSOL 208.86.197.0 - 208.86.197.255 208.86.197.0/24
DINONET 208.93.4.0 - 208.93.7.255 208.93.4.0/22
DINONET 208.93.6.0 - 208.93.6.255 208.93.6.0/24
DINONET 208.94.224.0 - 208.94.224.255 208.94.224.0/24
DINONET 208.94.224.0 - 208.94.231.255 208.94.224.0/21
DINO 208.94.229.0 - 208.94.229.255 208.94.229.0/24
DINONET 63.216.90.0 - 63.216.90.255 63.216.90.0/24 (BTN-CIDR5 63.216.0.0/13)
DINONET 66.56.64.0 - 66.56.95.255 66.56.64.0/19
LILLY 66.56.68.0 - 66.56.68.255 66.56.68.0/24
DINONET 74.85.208.0 - 74.85.223.255 74.85.208.0/20

[keyplyr]

New for me, thanks

[Angonasec]

Continuum Data Centers, LLC 64.79.96.0/20 Now blocked

64.79.111.90 - - [14/Aug/2014:01] "GET /example.htm HTTP/1.1" 200 14462 "http://www.example.org/" "Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"

Private Customer CONTINUUM-REASSIGN-64-79-111-0-24
64.79.111.0 - 64.79.111.255
Continuum Data Centers, LLC. CDC-LMB-ARIN3
64.79.96.0 - 64.79.111.255 64.79.96.0/20

[Angonasec]

The similar malformed UA used above by Continuum was also used today by 192.228.96.0/20 (Micfo) and 173.208.166.24/29 (DataShack)

[keyplyr]

In January I posted a Continuum DC list here: [webmasterworld.com...]

[blend27]

DataWagon

162.253.66.0/24
104.128.236.0/24

some garbage UA, dont even want to talk about it

[wilderness]

What a mess!

ONEZERO-01 66.231.184.228 - 66.231.184.231 (INFORELAY-SJC-NETBLOCK-66.231.176.0/20
ONEZERO-03 66.231.184.64 - 66.231.184.71 (INFORELAY-NETBLOCK01 66.231.176.0 - 66.231.191.255 66.231.176.0/20)
ONEZERO-02 66.231.186.112 - 66.231.186.115 (INFORELAY-NETBLOCK01 66.231.176.0 - 66.231.191.255 66.231.176.0/20)
INFORELAY-ONEZERO-05 67.208.66.0 - 67.208.66.255 67.208.64.0/19
ONEZEROHOSTING-01 67.208.69.0 - 67.208.69.255 (INFORELAY-SJC-NETBLOCK-67.208.64.0/19
ONEZEROHOSTING-01 67.208.70.0 - 67.208.71.255 (INFORELAY-SJC-NETBLOCK-67.208.64.0/19
ONEZERO 67.43.32.0 - 67.43.47.255 67.43.32.0/20
ONEZEROHOSTING 68.67.192.0 - 68.67.207.255 68.67.192.0/20
ONEZERO-06 69.169.113.0 - 69.169.113.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0 - 69.169.127.255 69.169.0.0/17)
ONEZERO-07 69.169.114.0 - 69.169.115.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0 - 69.169.127.255 69.169.0.0/17)
INFORELAY-ONEZERO-05 69.169.20.0 - 69.169.21.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0/17
ONEZERO-IR-04 173.45.16.0 - 173.45.31.255 (INFORELAY-SJC-NETBLOCK-173.45.0.0/18
ONEZEROHOSTING-03 173.45.4.0 - (INFORELAY-SJC-NETBLOCK-173.45.4.255 173.45.0.0/18

There's two very old mentions of the backbone (colo)
[webmasterworld.com...]
[webmasterworld.com...]

[keyplyr]

New for me, thanks

[wilderness]

InfoRelay Related Networks [whois.arin.net]

[keyplyr]

Getting some bad agents from kei.pl: 94.152.0.0/16

[wilderness]

root & PHP vulnerabilitiea
Blank UA

CNSERVERSLLC 162.212.252.0 - 162.212.255.255 162.212.252.0/22
CNSERVERSLLC 162.218.48.0 - 162.218.55.255 162.218.48.0/21
CNSERVERS-PDX 162.252.8.0 - 162.252.11.255 162.252.8.0/22
CNSERVERS-PDX 198.12.12.0 - 198.12.15.255 198.12.12.0/22
CNSERVERS-PDX 199.83.48.0 - 199.83.51.255 199.83.48.0/22
CNSERVERS-PDX 208.81.164.0 - 208.81.167.255 208.81.164.0/22
CNSERVERS-PDX 2604:6700:: - 2604:6700:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

A blank UA would get a 403 at my sites, however thanks for the CN Server ranges :)

[Angonasec]

Beyond The Network America, Inc.
63.216.0.0/13

[wilderness]

Beyond The Network America, Inc. Related Networks [whois.arin.net]

[Angonasec]

Thanks Don, excuse my sloppiness, here are the juicy CIDRs for that link;
205.177.0.0 - 205.177.255.255 205.177.0.0/16
BTN-CIDR2 206.161.0.0 - 206.161.255.255 206.161.0.0/16
BTN-CIDR3 207.226.0.0 - 207.226.255.255 207.226.0.0/16
BTN-CIDR4 209.8.0.0 - 209.9.255.255 209.8.0.0/16
BTN-CIDR5 63.216.0.0 - 63.223.255.255 63.216.0.0/13
BTN-CIDR6 65.72.0.0 - 65.72.255.255 65.72.0.0/16
BTN-CIDR7 205.252.0.0 - 205.252.255.255 205.252.0.0/16
BTN-CIDR8 207.176.0.0 - 207.176.127.255 207.176.0.0/17
LVLT-BNA-42-208-178-217 208.178.217.0 - 208.178.217.255 208.178.217.0/24

[blend27]

EVANZO e-commerce GmbH

178.254.0.0 - 178.254.63.255 178.254.32.0/20

more IPV4 & 6 ranges here: [bgp.he.net...]

IP: 178.254.33.X
UA Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; fr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8

Not even .9?

Missing headers, looking-sniffing for random file names, blocked.

[wilderness]

Yomura Corporation (YC-5)
199.233.247.14 - - [09/Sep/2014:05:24:05 -0600] "GET / HTTP/1.1" 403 775 "-" "Xenu Link Sleuth/1.3.8"

YOMURA-CORE-001 107.189.32.0 - 107.189.63.255 107.189.32.0/19
YOMURA-WEST-001 199.204.184.0 - 199.204.187.255 199.204.184.0/22
YOMURA-EAST-001 199.233.244.0 - 199.233.247.255 199.233.244.0/22
YOMURA-CORE-001 2605:980:: - 2605:980:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[wilderness]

Nerdie Networks LLC
199.96.156.87 - - [12/Sep/2014:07:10:42 -0600] "GET /wp/wp-admin/ HTTP/1.1" 403 561 "-" "-"

NERDIE-NETWORKS 199.192.216.0 - 199.192.219.255 199.192.216.0/22
NERDIE-NETWORKS 199.96.156.0 - 199.96.159.255 199.96.156.0/22
NERDIE 64.38.229.0 - 64.38.229.63 (CWIE, LLC (CWIE) 64.38.192.0/18 )
NERDIE-NETWORKS 2602:FFFF:: - 2602:FFFF:FFF:FFFF:FFFF:FFFF:FFFF:FFFF

This little pest has lead me (via their CWIE backbone) to six major backbones.
The ranges are too large to list here, and some have been listed multiple times previously.
One I'm not sure is a server, as it calls itself a CDN (Content Delivery Network), however their IP's are many.

Computer Sciences Corporation
CWIE, LLC (CWIE)
Highwinds Network Group, Inc. (HNG-3) (very large CDN)
SECURED SERVERS LLC

LVLT
Savis