Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• April 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[wilderness]

Just a FYI - my htaccess file is approaching 90kb, 98% of which is blocked IP ranges, and Google Pagespeed says my server response time is fast.

Mine is 120k, and that's after condensing/combining ranges and using different methods of accomplishing the same thing.
Should I tackle it again, than that would be the fourth time that I've exceeded 120k.

Nor, am I having any server speed issues. My pages however don't use any PHP, MySQL or Java.

[wilderness]

69.50.201.102 - - [01/Nov/2005:23:26:53 -0800] "GET /MyFolder/MyFile.htm
HTTP/1.1" 200 41325 "-" "Mozilla/7.0"
http: //www. atjeu. com/

BTW, back then it was called Atjeu Publishing.

[keyplyr]

Nor, am I having any server speed issues. My pages however don't use any PHP, MySQL or Java.

However if your site is hosted in a shared environment, it is prudent to assure other accounts on your server don't use these resources to excess.

As an aside: I had a site on a shared host where another account ran a Wordpress forum that allowed its 30k members to upload videos and perform other resource intensive actions. This one account, while not actually exceeding its bandwidth allotment, caused my site to take over a minute to load; my traffic dropped steadily. Since that account was not doing anything against the host's ToS, I had no other recourse but to move to a new host; traffic recovered and increased.

[wilderness]

Haven't seen this IP previously (seems new addition; 216.144.)
Have results from the same provider during 2008 running under "Swish-e [google.com]" there are 41 results within multiple forums under that name.

Secured Private Network (SPNW)
SPN1W 216.144.224.0 - 216.144.239.255 216.144.224.0/20
SPN2W 66.212.16.0 - 66.212.31.255 66.212.16.0/20
SPN3W 67.215.224.0 - 67.215.255.255 67.215.224.0/19

[Angonasec]

dstiles et al:
indubitably, but I prefer "open pending" until I see a hit.

Our site is super-brisk loading, and though my htaccess is somewhat slim at 22kb compared to my fellow log-heads, I +DO+ notice loading slow down when it gets bloated with IPs.

I'm averse to MYSQL Javascript and php for the same reasons. So I keep it simple, clean and lean.

[dstiles]

> I prefer "open pending" until I see a hit.

Then expect a lot more bad activity on your sites. :(

If your site speed is really slowed down by larger htaccess files I'd suggest a new server. All of my sites use MySQL not only as a trap repository but to serve site pages as well, including in-process parsing of content. Even on the old windows 2003 server, speed was still more than adequate. And being Windows, it is in any case far slower than the equivalent linux/unix server.

Not sure where javascript comes in as that is usually client-side. And PHP is a better parser than ASP.

[bobothecat2]

Here's one I haven't seen before:

Atjeu Hosting
69.50.192.0 - 69.50.223.255
69.50.192.0/19

2 more ranges as well:

68.171.96.0 - 68.171.111.255
68.171.96.0/20

98.173.134.0 - 98.173.134.255
98.173.134.0/24

[keyplyr]

@bobothecat2 - I've been seeing Atjeu as well, and had those first 2 ranges blocked.

However, 98.173.134.0/24 is Cox Communications, a cable broadband company. In fact it is *my* ISP :)

[dstiles]

It may be your ISP but there is at least one www in the DNS for that range and I've had problems with it to the extent I've blocked 98.173.32.0/19

[keyplyr]

Maybe when you blocked it, the range was being used by other agents. Current info does say recently reassigned. Cox is the 4th largest BB company in the US and Canada. That's a lot of humans to block IMO.

[wilderness]

Cox is the 4th largest BB company in the US and Canada. That's a lot of humans to block IMO.

Like to know how Cox fits all those customers in that little /19 range ;)


FWIW, their ranges are many [whois.arin.net], and blocking one portion does not include their entire customer set.

[keyplyr]

Like to know how Cox fits all those customers in that little /19 range ;)

What makes to assume they do? Look them up, they've got many IP ranges. However, like most large ISPs, they have biz service products. I do actually have a few small spots blocked. And just like Comcast & others, customers can upgrade to higher bandwidth upstreams to serve web sites (or run bots.) I tried it for a while but kept getting charged for overages.

[Angonasec]

dstiles: "Then expect a lot more bad activity on your sites."

So far, I'm spotting them quickly and feeding them zero bytes, but inevitably the time will arrive when we raise the drawbridge... as it will for each of us.

No bots to report today! :)

[Angonasec]

Big Apple Sinobot:
155.254.114.154
OppoBox OPPOBOX 155.254.96.0 - 155.254.127.255 155.254.96.0/19 ber...locked!
OppoBox NY-NEWYORK 155.254.114.0 - 155.254.114.255

[wilderness]

OPPOBOX 104.207.64.0 - 104.207.95.255 104.207.64.0/19
OPPOBOX 107.182.112.0 - 107.182.127.255 107.182.112.0/20
OPPOBOX 107.190.160.0 - 107.190.175.255 107.190.160.0/20
OPPOBOX 155.254.96.0 - 155.254.127.255 155.254.96.0/19

[keyplyr]

Aruba, Italy
46.37.0.0 - 46.37.0.255
46.37.0.0/19

[Angonasec]

Another Sinobot:
B2 Net Solutions Inc.
23.236.243.102
Proxy-N-VPN 23.236.243.0 - 23.236.243.127
B2 Net Solutions Inc. 23.236.128.0 - 23.236.255.255 23.236.128.0/17 ber...locked!

[keyplyr]

That have that as all ServerMania/B2Net:

23.229.67.0 - 23.229.67.255
23.229.0.0/17

23.236.128.0 - 23.236.255.255
23.236.128.0/17

69.4.80.0 - 69.4.95.255
69.4.80.0/20

69.58.0.0 - 69.58.15.255
69.58.0.0/20

* 173.232.162.0 - 173.232.162.255
173.232.162.0/24

192.157.48.0 - 192.157.63.255
192.157.48.0/20

192.186.128.0 - 192.186.191.255
192.186.128.0/18

192.198.96.0 - 192.198.127.255
192.198.96.0/19

192.241.64.0 - 192.241.127.255
192.241.64.0/18

198.20.160.0 - 198.20.191.255
198.20.160.0/19

198.154.80.0 - 198.154.95.255
198.154.80.0/20

208.78.63.0 - 208.78.63.255
208.78.63.0/24

208.92.115.0 - 208.92.119.255
208.92.112.0/21


* Part of Eonix 173.232.0.0 - 173.232.255.25 173.232.0.0/16

[System]

The following message was cut out to new thread by ocean10000. New thread at: search_engine_spiders/4708090.htm [webmasterworld.com]
10:24 am on Oct 12, 2014 (utc -8)

[dstiles]

B2Net - Also...

107.152.128.0 - 107.152.255.255
198.245.64.0 - 198.245.79.255

208.78.63.0/24 and 208.92.112.0/21 are part of juch at
208.78.56.0 - 208.78.63.255
208.92.112.0 - 208.92.119.255 (which you expanded)

[keyplyr]

Hmmm, I had 198.245.64.0/20 but for some reason didn't list it above. Didn't have 107.152.128.0/17 nor the juch-tech. And thanks for pointing out the typo.

[dstiles]

I currently have the following for canadian juch:

173.224.224.0 - 173.224.239.255
208.78.56.0 - 208.78.63.255
208.92.112.0 - 208.92.119.255

[keyplyr]

New for me:

UberGlobal
175.107.128.0 - 175.107.143.255
175.107.128.0/20

Proserve
193.93.172.0 - 193.93.175.255
193.93.172.0/22

[Angonasec]

Sinobot at Power Up Hosting, Inc. LA USA
162.244.14.85
162.244.8.0 - 162.244.15.255 162.244.8.0/21 ber...locked!

[lucy24]

Oh happy day. I was visited by a robot from 23.254.46.abc, which turns out to be MG Hosting.

And your point is...?

23.254.128.0/17 is Hostwinds, resulting in a net 9-byte reduction in size of htaccess file :)

Is there a recent Webazilla list? I thought I had them, but just met one from 188.164.248.0/21 that I hadn't known about.

Incidentally, some predictable follow-ups on 23.254etcetera led to
23.255.128.0/17 Google Fiber
What the bleep is google fiber?* Free lookup says Kansas City, but contact info includes the usual suspects in Mountain View, so yup, it's G###.


* Past experience tells me that five minutes after closing this window, I will come up with some absolutely priceless pun to answer the question.

[bobothecat2]

Google Fiber appears to be nothing more than hosting servers... here's the complete list that I've found:

23.228.128.0 - 23.228.191.255
23.255.128.0 - 23.255.255.255
107.188.128.0 - 107.188.255.255
192.119.16.0 - 192.119.31.255
192.200.224.0 - 192.200.255.255
216.21.160.0 - 216.21.175.255

I stand corrected... apparently Google is getting in to the Internet access business.

"A different kind of Internet and TV

Google Fiber starts with a connection that is up to 100 times faster than today's average broadband speeds. Instant downloads. Crystal clear high definition TV. And endless possibilities."

[dstiles]

23.254.46.abc - full B2 network is 23.254.0.0/17 so the whole /16 can be blocked.

webazilla:
78.140.128.0 - 78.140.191.255
88.85.64.0 - 88.85.95.255
188.164.248.0 - 188.164.255.255

[not2easy]

Something new from Abovenet? I didn't have this anyway:
Covenant Eyes, Inc. ZAYO-IPYX
208.184.77.176 - 208.184.77.191
Abovenet Communications, Inc ABOVENET-6
208.184.0.0 - 208.185.255.255
Zayo was the perp.

[not2easy]

Some that I have not fully checked out, putting them here in case someone has more info? The activities were unusual, but similar to a lot that I see on Verizon/AT&T so I didn't block these yet.

nFrame NFRAME (NET-216-239-240-0-1)
216.239.240.0 - 216.239.255.255

Managed Network Systems Inc. MNSI-BLK-1 (NET-216-8-128-0-1)
216.8.128.0 - 216.8.191.255

[mslina2002]

Is this one new?

iWeb

67.205.64.0-67.205.127.255
67.205.64.0/18

Only noticed because it was repeatedly grabbing robots.txt