Server Farms - August 2014 - Crawler, Spider, and User Agent ID forum at WebmasterWorld

Forum Moderators: open

Message Too Old, No Replies

Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

incrediBILL

12:37 am on Jul 31, 2014 (gmt 0)

Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

April 2014 [webmasterworld.com...]
Feb 2014 [webmasterworld.com...]
Sep 2013 [webmasterworld.com...]
May 2013 [webmasterworld.com...]
Mar 2013 [webmasterworld.com...]
May 2012 [webmasterworld.com...]

wilderness

2:50 pm on Sep 12, 2014 (gmt 0)

keyplr provided one rang on pg 6 of this thread [webmasterworld.com]

Arvixe, LLC
ARVIXE-NETWORK-1 100.42.48.0 - 100.42.63.255 100.42.48.0/20
RVIXE-NETWORK-9 104.152.64.0 - 104.152.71.255 104.152.64.0/21
ARVIXE-NETWORK-10 104.171.0.0 - 104.171.15.255 104.171.0.0/20
ARVIXE-NETWORK-2 108.175.144.0 - 108.175.159.255 108.175.144.0/20
ARVIXE-NETWORK-7 162.253.144.0 - 162.253.151.255 162.253.144.0/21
ARVIXE-NETWORK-8 162.254.160.0 - 162.254.167.255 162.254.160.0/21
ARVIXE-NETWORK-4 192.169.48.0 - 192.169.63.255 192.169.48.0/20
ARVIXE-NETWORK-5 198.252.64.0 - 198.252.79.255 198.252.64.0/20
ARVIXE-NETWORK-3 198.58.80.0 - 198.58.95.255 198.58.80.0/20
ARVIXE-NETWORK-6 23.91.112.0 - 23.91.127.255 23.91.112.0/20
ARVIXE-STN 66.36.176.0 - 66.36.187.255 (SiteTurn Networks, Inc. (SITT) 66.36.160.0/19 )
ARVIXE-IPV6-NETWORK-1 2606:6F00:: - 2606:6F00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

keyplyr

8:20 pm on Sep 12, 2014 (gmt 0)

I actually had a couple of those, thanks for the others.

blend27

1:06 am on Sep 13, 2014 (gmt 0)

Something is staring to go off base here.

Several times lately I would get hits from hosting ranges not known to my IP tables, I would go to bgp.he.net, look up the IP and then the range/company name and then go to WebmasterWorld search function, Goog or Bing. The result would come up and when I click on it(bing or goog) it would take me to one of the threads on WebmasterWorld. But then searching for exact string on the page would not have any results.

Example(if I may).

IP came up and got blocked for bad headers: 162.223.10.XXX

BGP response: [bgp.he.net...]

Hosting company name/net name contains word TRANQUIL.

searched thru WebmasterWorld search for TRANQUIL.

Goog & Bing give a result in SERP for this URL: www.webmasterworld.com/search_engine_spiders/4691876.htm

Searching for exact word via FF search for TRANQUIL comes back with nothing.

What am I missing?

wilderness

1:12 am on Sep 13, 2014 (gmt 0)

blend,
why are you using SE's for searches on IP's?
I only use SE's to confirm the services offered by a domain that is related to an IP.

Rather, use one of the registrars (ARIN, RIPE, APNIC, etc.,) to look up a domain.

My apologies if I've misunderstood.

wilderness

1:14 am on Sep 13, 2014 (gmt 0)

Here's the search at WW for Tranquil [google.com], however you search have been searching Tranquil Hosting (their name)

blend27

2:24 am on Sep 13, 2014 (gmt 0)

Don, sorry for the confusion, if any, here is what I do normally.

Get IP, go to BGP site and look IP address UP.

Lets say results give me this as a part of the screen:

NetRange: 162.223.8.0 - 162.223.15.255
CIDR: 162.223.8.0/21
OriginAS:
NetName: TRANQUIL-HOSTING-NETBLK-8

This is from this URL: (BGP) - [bgp.he.net...]

Get a hosting name, net name, anything that has a common string to search for/. do a search.. In this case it is TRANQUIL, so next search for

TRANQUIL

at [bgp.he.net...] = BGP comes up with list of results.

Now I take the same string and search for TRANQUIL on WebmasterWorld Search utility for the ranges to compare to the ranges that might have missed so far(new ones).

When I do that I get a result(on Bing and G) pointing to a page on WebmasterWorld that has proper intent, but the string of TRANQUIL is no where to be found on a target URL.

E.G. >> Result I see on G is Server Farms - August 2014 Search Engine Spider and User Agent ... : [google.com...] (NOTE: goog URL with q=TRANQUIL+site:webmasterworld.com as QS)

In other words I cant find TRANQUIL on WebmasterWorld if I click on:

Server Farms - August 2014 Search Engine Spider and User Agent ...
www.webmasterworld.com/search_engine_spiders/4691876.htm
162.223.8.0 - 162.223.15.255. wilderness msg:4694250, 4:37 pm on Aug 9, 2014 (gmt 0). Tranquil Hosting Related Networks [whois.arin.net].

hmm.. BTW

here what turns up from bgp and my ip table for the TRANQUIL:

66.219.16.0 - 66.219.31.255 NETRIPLEX-AVL-DIMENSION4-66-219-20-0 66.219.20.0/24
208.91.128.0 - 208.91.135.255 208.91.133.0/24
208.86.224.0 - 208.86.227.255 TRANQUIL-HOSTING-NETBLK-2 208.86.224.0/22
208.79.80.0 - 208.79.83.255 TRANQUIL-HOSTING-NETBLK-1 208.79.80.0/22
204.109.56.0 - 204.109.63.255 TRANQUIL-HOSTING-NETBLK-3 204.109.56.0/21
199.48.128.0 - 199.48.135.255 TRANQUIL-HOSTING-NETBLK-4 199.48.128.0/21
199.233.228.0 - 199.233.231.255 TRANQUIL-HOSTING-NETBLK-6 199.233.228.0/22
199.102.76.0 - 199.102.79.255 TRANQUIL-HOSTING-NETBLK-5 199.102.76.0/22
185.34.0.0 - 185.34.3.255 US-TQHOSTING-20130827 185.34.0.0/22
185.16.48.0 - 185.16.51.255 FR-TRANQUILIT-20130118 185.16.48.0/22
162.223.8.0 - 162.223.15.255 TRANQUIL-HOSTING-NETBLK-8 162.223.8.0/21
162.217.112.0 - 162.217.115.255 TRANQUIL-HOSTING-NETBLK-7 162.217.112.0/22
103.254.160.0 - 103.254.163.255 TRANQUIL-HOSTING 103.254.160.0/22

wilderness

2:46 am on Sep 13, 2014 (gmt 0)

blend,
For the longest while here at Webmaster World we were able to utilize bookmarks to a specific submission by a user (s) and within a page.

Some while back all that was changed.
That pretty much makes these multiple server farms threads USELESS as a reference.

EX:
www.webmasterworld.com/search_engine_spiders/4691876-2-20.htm#msg4701661

Angonasec

6:02 am on Sep 13, 2014 (gmt 0)

I occasionally still find this thread useful, if only for exposing...

Yet another Chinese bot caught using Western owned servers in Seattle.
BigTip, Inc.
192.126.168.231
192.126.128.0 - 192.126.255.255 192.126.128.0/17

keyplyr

7:13 pm on Sep 13, 2014 (gmt 0)

New one for me: us.gmocloud.com

192.249.64.0 - 192.249.79.255
192.249.64.0/20

I previously had it in with: dacentec.com

192.254.64.0 - 192.254.79.255
192.254.64.0/20

dstiles

7:34 pm on Sep 13, 2014 (gmt 0)

If you run linux of any kind then I recommend Network Tools for discovering IP ranges and rDNS and Umit for checking open IP ports.

No doubt there are similar Windows tools but the last one I used (Sam Spade - not the web site) was old hat before I stopped using it years ago.

I use ixquick for cross-checking if Umit fails to show up open ports (clouds often do not easily give up their open ports list). Sometimes blacklistalert[.]org is usfeul in picking up DSL ranges.

not2easy

7:53 pm on Sep 13, 2014 (gmt 0)

And on Mac there's the Network Utilities for Whois lookups. It doesn't do LACNIC or AFRINIC though.

keyplyr

8:10 pm on Sep 13, 2014 (gmt 0)

Network tools will heckle you upgrade to their pay service. Not necessary IMO as there are many free IP look-ups.

For example Domain Dossier gives you 50 look-ups per day per user. As I keep a pretty complete IP host DB, this is usually all I need.

And here's a couple of pests:

HostPro
194.28.84.0 - 194.28.87.255
194.28.84.0/22

Vautron
83.243.56.0 - 83.243.63.255
83.243.56.0/21

wilderness

8:38 pm on Sep 13, 2014 (gmt 0)

us.gmocloud.com

Two more ranges:
NH1-V4-GMO1-V4 209.54.49.0 - 209.54.63.255 (Native Hosting, Inc. (NATIV-7) 209.54.48.0/20 )
LVLT-GCA-29-8-30-160 8.30.160.0 - 8.30.167.255

and one leads to another backbone:
Native Hosting
NH2-V4 162.249.188.0 - 162.249.191.255 162.249.188.0/22
NH1-V4 209.54.48.0 - 209.54.63.255 209.54.48.0/20

keyplyr

5:02 am on Sep 14, 2014 (gmt 0)

Network tools will heckle you [to] upgrade to their pay service.

Sorry, I was thinking of Domain Tools :)

wilderness

4:49 pm on Sep 14, 2014 (gmt 0)

isn't the www an interesting puzzle

66.211.109.11 - - [14/Sep/2014:10:33:37 -0600] "GET /MySub/MyPage.html HTTP/1.1" 403 554 "-" "HubPages V0.2.2 (http://hubpages. com/help/crawlingpolicy)"

Evocative, Inc.
Q1010-65-115-70-0 63.147.60.0 - 63.147.61.255 (QWEST-INET-8 63.147.60.0/23 )
Q1010-65-115-70-0 65.115.70.0 - 65.115.71.255 (QWEST-INET-10 65.112.0.0/12)
EVOC-NET-1 66.211.96.0 - 66.211.111.255 66.211.96.0/20
Q1010-67-131-248-0 67.131.248.0 - 67.131.251.255 (QWEST-INET-11 67.128.0.0/13 )
Q1010-67-133-32-0 67.133.32.0 - 67.133.35.255 (QWEST-INET-11 67.128.0.0/13 )
Q1010-67-134-12-0 67.134.12.0 - 67.134.15.255 (QWEST-INET-11 67.128.0.0/13 )
Q1004-2001-0428-1402-0103-0000-0000-0000-0000 2001:428:1402:103:: - 2001:428:1402:103:FFFF:FFFF:FFFF:FFFF
EVOCAT-6 2605:BB00:: - 2605:BB00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

dstiles

6:29 pm on Sep 14, 2014 (gmt 0)

not2easy - if it's linux mac then it should be the same tool? I had a problem with some IP ranges missing a few years ago (newly assigned ranges) but an update fixed that.

keyplyr - the linux lookup tools are free downloadable software available from the Software Manager or other repositories. How this applies to linux Mac I do not know.

wilderness

2:36 pm on Sep 15, 2014 (gmt 0)

Host Collective WHOIS list 21-ranges, however the majority are part of Savis backbone.

HOSTCOLLECTIVE 162.250.72.0 - 162.250.75.255 162.250.72.0/22
HOSTCOLLECTIVE 199.233.252.0 - 199.233.255.255 199.233.252.0/22
HCI-BLK-1 96.31.32.0 - 96.31.47.255 96.31.32.0/20
HOSTCOLLECTIVE 2607:1600:: - 2607:1600:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

bobothecat2

9:12 pm on Sep 16, 2014 (gmt 0)

New one for me... I'm sure there's more than this range, just don't have the time to look at this moment:

Dimension Data Cloud Solutions, Inc.
162.216.168.0 - 162.216.175.255
162.216.168.0/21

Just took a quick glance, and there are in fact quite a few more ranges. Will post shortly assuming Don doesn't first. :)

wilderness

2:47 am on Sep 17, 2014 (gmt 0)

Dimension Data Cloud Solutions, Inc. (OPSOU)
OPSOURCE-AGGREGATE5 162.212.0.0 - 162.212.3.255 162.212.0.0/22
OPSOURCE-AGG6 162.216.168.0 - 162.216.175.255 162.216.168.0/21
OPSOURCE-AGGREGATE6 162.249.208.0 - 162.249.215.255 162.249.208.0/21
OPSOURCE-AGGREGATE-4 198.46.48.0 - 198.46.63.255 198.46.48.0/20
OPSOURCE 199.127.64.0 - 199.127.67.255 199.127.64.0/22
OPSOURCE-BLOCK-1 209.34.64.0 - 209.34.95.255 209.34.64.0/19
UU-65-200-35-D4 65.200.35.0 - 65.200.35.255 (UUNET65 65.192.0.0/11 )
OPSOURCE-INC-2 2607:F480:: - 2607:F480:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

wilderness

1:39 am on Sep 19, 2014 (gmt 0)

American Internet Services
AIS-OWB-NETBLK-2 173.213.240.0 - 173.213.255.255 173.213.240.0/20
AIS-LWDC-NETBLK-2 204.68.96.0 - 204.68.127.255 204.68.96.0/19
AIS-EMERALD-NETBLK-1 204.68.100.0 - 204.68.101.255 204.68.96.0/19 (96-127)
ADN-WEST 206.251.224.0 - 206.251.255.255 206.251.224.0/19
AIS-NIRVANIX-NETBLK-2 206.251.254.32 - 206.251.254.63 206.251.224.0/19
AIS-AMERICAS-VACATION-CENTER-NETBLK-1 206.251.251.96 - 206.251.251.127 206.251.224.0/19
AIS-NIRVANIX-NETBLK-1 206.251.254.0 - 206.251.254.31 206.251.224.0/19
AIS-SDTC-NETBLK-1 206.71.160.0 - 206.71.191.255 206.71.160.0/19
AIS-AMERICAS-VACATION-CENTER-NETBLK-2 207.158.21.96 - 207.158.21.127 207.158.0.0/18 (0-63)
AIS-WEST2 207.158.0.0 - 207.158.63.255 207.158.0.0/18
AIS-OWB-NETBLK-1 209.112.240.0 - 209.112.255.255 209.112.240.0/20
AIS-CHARGER-TECH-SERVICES-NETBLK-1 209.112.242.0 - 209.112.242.255 209.112.240.0/20 (240-255)
ADN-WEST-3 209.216.192.0 - 209.216.255.255 209.216.192.0/18
STATESTREET-IMS-NETBLK-1 209.216.211.0 - 209.216.211.255 209.216.192.0/18 (192-255)
AIS-AMERICAS-VACATION-CENTER-NETBLK-3 209.216.243.32 - 209.216.243.63 209.216.192.0/18 (192-255)
AIS-LWDC-NETBLK-1 67.207.208.0 - 67.207.223.255 67.207.208.0/20
AIS-VBDC-NETBLK-1 69.165.48.0 - 69.165.63.255 69.165.48.0/20
AIS-NET6 2600:4400:: - 2600:4407:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

keyplyr

2:17 am on Sep 19, 2014 (gmt 0)

Thanks Don, didn't have most of those.

However this: AIS range:
67.207.208.0 - 67.207.223.255
67.207.208.0/20

Is inside of this Rackspace range:
67.207.128.0 - 67.207.223.255
67.207.128.0/18
67.207.192.0/19

And the rest of the AIS ranges can basically be condensed into:

69.165.48.0/20 #AIS 69.165.48.0 - 69.165.63.255
173.213.240.0/20 #AIS 173.213.240.0 - 173.213.255.255
204.68.96.0/19 #AIS 204.68.96.0 - 204.68.127.255
206.71.160.0/19 #AIS 206.71.160.0 - 206.71.191.255
206.251.224.0/19 #AIS 206.251.224.0 - 206.251.255.255
207.158.0.0/18 #AIS 207.158.0.0 - 207.158.63.255
209.112.240.0/20 #AIS 209.112.240.0 - 209.112.255.255
209.216.192.0/18 #AIS 209.216.192.0 - 209.216.255.255

Angonasec

5:48 am on Sep 19, 2014 (gmt 0)

Quadranet NY caught hosting another Chinese bot
155.94.128.0/18 ber...locked!

wilderness

11:47 am on Sep 19, 2014 (gmt 0)

Quadranet old threads:
[webmasterworld.com...]
[webmasterworld.com...]

keyplyr

12:11 pm on Sep 19, 2014 (gmt 0)

@Angonasec - that Quadranet range is actually:

155.94.128.0/17
155.94.128.0 - 155.94.255.255

blend27

2:08 am on Sep 20, 2014 (gmt 0)

IP: 206.223.153.XXX
UA: masscan/1.0 (removed url... I see this one used a lot lately)

OrgName: N.T. Technology, Inc.
NetRange: 206.223.144.0 - 206.223.159.255
CIDR: 206.223.144.0/20
NetName: NTTECH-1

Angonasec

8:11 am on Sep 20, 2014 (gmt 0)

More Chinese scraper bots discovered using western hemisphere servers:
198.23.155.47 on ColoCrossing 198.23.128.0/17
191.101.10.36 on 191.101.8/21 Digital Energy Technologies Ltd

keyplyr

11:25 am on Sep 20, 2014 (gmt 0)

@Angonasec - that DigitalEnergyTech range is actually:

191.101.0.0/16
191.101.0.0 - 191.101.255.255

Note: If you check on each side of the range, you'll often find they extend farther than initially reported by these services.

Angonasec

2:41 pm on Sep 20, 2014 (gmt 0)

I'm not so fussy, and actually block ALL 191.101. :)

wilderness

6:16 pm on Sep 20, 2014 (gmt 0)

I'm not so fussy, and actually block ALL 191.101.

RewriteCond %{REMOTE_ADDR} ^19[01]\. [OR]

keyplyr

6:41 pm on Sep 20, 2014 (gmt 0)

I'm not so fussy, and actually block ALL 191.101. :)

191.101.0.0/16 IS all 191.101.

This 285 message thread spans 10 pages: 285