Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• April 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[blend27]

Updated list for VPLSNET - Krypt Technologies

98.126.0.0 - 98.126.255.255 VPLSNET 98.126.0.0/16
96.62.0.0 - 96.62.255.255 VPLSNET 96.62.0.0/16
74.222.128.0 - 74.222.191.255 VPLSNET 74.222.128.0/18
67.229.0.0 - 67.229.255.255 VPLSNET 67.229.0.0/16
67.198.128.0 - 67.198.255.255 VPLSNET 67.198.128.0/17
66.186.32.0 - 66.186.63.255 VPLSNET 66.186.32.0/19
23.91.192.0 - 23.91.223.255 VPLSNET 23.91.192.0/19
23.251.0.0 - 23.251.31.255 VPLSNET 23.251.0.0/19
209.11.240.0 - 209.11.255.255 VPLSNET 209.11.240.0/20
198.61.96.0 - 198.61.127.255 VPLSNET 198.61.96.0/19
192.174.96.0 - 192.174.127.255 VPLSNET 192.174.96.0/19
184.83.0.0 - 184.83.255.255 VPLSNET-EAST 184.83.0.0/16
184.75.176.0 - 184.75.191.255 VPLSNET-EAST 184.75.176.0/20
184.164.192.0 - 184.164.223.255 VPLSNET-EAST 184.164.192.0/19
174.139.0.0 - 174.139.255.255 VPLSNET 174.139.0.0/16
173.214.0.0 - 173.214.127.255 VPLSNET 173.214.0.0/17
107.6.192.0 - 107.6.255.255 VPLSNET 107.6.192.0/18
104.200.192.0 - 104.200.223.255 VPLSNET 104.200.192.0/19
100.43.128.0 - 100.43.191.255 VPLSNET 100.43.128.0/18

IPV6 is also here: [bgp.he.net...]

[dstiles]

> 23.251.0.0/19

For what it's worth, I have the much larger range of 23.192.0.0 - 23.255.255.255 blocked. It seems to contain nothing but servers, although there is probably the odd small broadband or educatioon range therein.

[lucy24]

New one on me, and doesn't come up in search:

185.53.44.0/22

That's another from our friends at Xovi [webmasterworld.com] aka First Colo Datacenter. I'd previously noted that in their dialect of German, "selbstverständlich" translates as "hardly ever". Fortunately, the words "Colo" and "Datacenter" require no translation.

This is 185, so don't waste time hoping for anything bigger than /22.

Elsewhere: Can't figure out if
66.7.192.0/19
(HostDime) has been previously noted. Found them in near-tandem with 67.23.224.0/19 which has been around for a while.

Continuing: I'm not sure if all of
213.221.0.0/18
is hosting, but some of it definitely is ("64 websites use this address") and the whole slab is Vimpelcom, which tends to be dirty even when human.

And finally: I'm also not sure about
155.133.18.0/23
(Delorian Internet in Poland, under a Germany umbrella) but looking back, I've never seen an unambiguous human from the area. Once you pass a certain ratio of infected browsers to legitimate visitors, I guess it doesn't matter much.

:: wandering off to play with 2015 edition of At Home With The Robots ::

[blend27]

I have the much larger range of 23.192.0.0 - 23.255.255.255 blocked

There is at least one in between there that I have customers from:

Time Warner Cable Internet LLC
NetRange: 23.240.0.0 - 23.243.255.255
CIDR: 23.240.0.0/14
Comment: Allocations for this OrgID serve Road Runner residential customers out of the Honolulu, HI, Kansas City, KS, Orange, CA and San Diego, CA RDCs.


I've only started getting LIVE traffic from an entire 23.* range about 2.5 years ago. 70% of it are Scrape attempts.

[blend27]

With additions to Incero

23.92.64.0 - 23.92.79.255 INCERO-LLC 23.92.64.0/20
23.29.112.0 - 23.29.127.255 INCERO 23.29.112.0/20
23.227.160.0 - 23.227.191.255 INCERO-LLC 23.227.160.0/19
192.211.48.0 - 192.211.63.255 INCERO-LLC 192.211.48.0/20
162.213.192.0 - 162.213.199.255 INCERO-LLC 162.213.192.0/21
162.212.56.0 - 162.212.59.255 INCERO-LLC 162.212.56.0/22
107.155.64.0 - 107.155.127.255 INCERO-LLC 107.155.64.0/18

[blend27]

With Additions to RAMNODE

23.226.224.0 - 23.226.239.255 RAMNODE-6 23.226.224.0/20
199.241.28.0 - 199.241.31.255 RAMNODE-1 199.241.28.0/22
192.73.232.0 - 192.73.239.255 RAMNODE-3 192.73.232.0/21
192.30.32.0 - 192.30.35.255 RAMNODE-2 192.30.32.0/22
192.249.56.0 - 192.249.63.255 RAMNODE-4 192.249.56.0/21
192.184.80.0 - 192.184.95.255 RAMNODE-5 192.184.80.0/20
185.52.0.0 - 185.52.3.255 US-RAMNODE-20140327 185.52.0.0/22
168.235.64.0 - 168.235.127.255 RAMNODE-10 168.235.64.0/18
167.88.112.0 - 167.88.127.255 RAMNODE-8 167.88.112.0/20
107.191.96.0 - 107.191.127.255 RAMNODE-9 107.191.96.0/19
107.161.16.0 - 107.161.31.255 RAMNODE-7 107.161.16.0/20

There are also a few under RIPE, but those are under
81.4.64.0 - 81.4.127.255
route: 81.4.64.0/18
descr: ProServe Networks

[dstiles]

> Time Warner Cable Internet LLC

Oh, yes, I have that one but missed it. Sorry. :(

Thanks for the extra ranges. :)

[keyplyr]

One could choose to block 107.155.0.0/17 to cover both:
107.155.0.0/18 #ChinaCache 107.155.0.0 - 107.155.63.255
107.155.64.0/18 #Incero 107.155.64.0 - 107.155.127.255

[wilderness]

Crissic Solutions, LLC
CRISSIC 104.129.0.0 - 104.129.63.255 104.129.0.0/18
CRISSIC 107.150.0.0 - 107.150.31.255 107.150.0.0/19
CRISSIC 162.218.208.0 - 162.218.211.255 162.218.208.0/22
CRISSIC 162.220.8.0 - 162.220.15.255 162.220.8.0/21
CRISSIC 167.160.160.0 - 167.160.191.255 167.160.160.0/19
CRISSIC 23.226.128.0 - 23.226.143.255 23.226.128.0/20
CRISSIC 2602:FFEA:: - 2602:FFEA:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

Nodes Direct
NODESDIRECT 107.155.128.0 - 107.155.191.255 107.155.128.0/18
NODESDIRECT 155.94.64.0 - 155.94.127.255 155.94.64.0/18
NODESDIRECT 162.216.152.0 - 162.216.159.255 162.216.152.0/21
NODESDIRECT 162.216.0.0 - 162.216.3.255 162.216.0.0/22
NODESDIRECT 184.175.192.0 - 184.175.255.255 184.175.192.0/18
NODESDIRECT 199.48.160.0 - 199.48.167.255 199.48.160.0/21
NODESDIRECT 208.84.132.0 - 208.84.135.255 208.84.132.0/22
NODESDIRECT 23.239.64.0 - 23.239.95.255 23.239.64.0/19
NODESDIRECT 23.92.80.0 - 23.92.95.255 23.92.80.0/20
NODESDIRECT 2604:4600:: - 2604:4600:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[keyplyr]

Normally I ignore log spam, but this joker hit my index page (no other files) 40x coming from:

Fast IT Colo
62.141.32.0 - 62.141.47.255
62.141.32.0/20

[lucy24]

Hurrah, I think I've found a Russian server farm. Nice break from the usual run of infected human browsers.

37.140.192.0/21
reg.ru Hosting

Not to be confused with the immediately adjacent 37.140.128.0/18 which is legitimately Yandex.

[keyplyr]

Another Russian server farm (hurrah):

masterhost.ru
87.242.64.0/18
87.242.64.0 - 87.242.127.255

[keyplyr]

5.148.175.141 - - [12/Feb/2015:23:32:02 -0800] "GET /robots.txt HTTP/1.1" 200 4853 "-" "Newscuratorbot/1.0"

nine.ch servers
5.148.160.0/19
5.148.160.0 - 5.148.191.255

[keyplyr]

serverclub.com
188.42.240.0/21
188.42.240.0 - 188.42.247.255

[incrediBILL]

Thread continued in Feb 2015: [webmasterworld.com...]