Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• April 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[keyplyr]

The pro version of Domain Dossier lists the IP owners (leasers) by date w/ 72 hour currency AFAIK. Whether my notes are kept to that standard is questionable :)

[lucy24]

Today's scrapings, courtesy "nyet.gif" botnet:

87.101.0.0/20
(Happy Hosting, Netherlands)

108.165
(Ace Data Centers)

Forums search didn't turn up either one.

[wilderness]

Ace Data Centers, Inc. (ADC-96)
ACE-NETWORK-7 108.165.0.0 - 108.165.255.255 108.165.0.0/16
ACE-NETWORK-9 136.255.0.0 - 136.255.255.255 136.255.0.0/16
ACE-NETWORK-10 166.0.0.0 - 166.1.255.255 166.0.0.0/15
ACE-NETWORK-2 199.115.192.0 - 199.115.195.255 199.115.192.0/22
ACE-NETWORK-1 199.58.196.0 - 199.58.199.255 199.58.196.0/22
ACE-NETWORK-8 23.26.0.0 - 23.26.255.255 23.26.0.0/16
ACE-NETWORK-4 50.114.0.0 - 50.114.255.255 50.114.0.0/16
ACE-NETWORK-6 50.119.0.0 - 50.119.255.255 50.119.0.0/16
ACE-NETWORK-3 69.27.160.0 - 69.27.175.255 69.27.160.0/20
ACE-NETWORK-5 74.206.192.0 - 74.206.223.255 74.206.192.0/19
ACE-IPV6-NETWORK-1 2604:BA00:: - 2604:BA00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[trintragula]

Roya Hosting
104.143.16.0/20

I've collected a handful of IPs from there in the last few months.
Firefox/2[1-2]
Probably spamming, but with that browser UA I don't wait to find out.

Best Hosting (Ukraine)
193.201.224.0/22
They have other ranges

[wilderness]

ROYA 104.143.16.0 - 104.143.31.255 104.143.16.0/20
ROYA 104.166.96.0 - 104.166.127.255 104.166.96.0/19
ROYA 104.224.0.0 - 104.224.63.255 104.224.0.0/18
ROYA-HOSTING 107.152.177.0 - 107.152.177.255 (B2NETSOLUTIONS 107.152.128.0 - 107.152.255.255 107.152.128.0/17)
CUSTBLOCK-192-230-51-0-24 192.230.51.0 - 192.230.51.255 (MICFO 192.230.32.0 - 192.230.63.255 192.230.32.0/19)
ROYA-HOSTING 192.241.94.0 - 192.241.94.255 (B2NETSOLUTIONS 192.241.64.0 - 192.241.127.255 192.241.64.0/18)
ROYA-HOSTING 23.236.141.0 - 23.236.141.255 (B2NETSOLUTIONS 23.236.128.0 - 23.236.255.255 23.236.128.0/17)
ROYA 45.59.128.0 - 45.59.191.255 45.59.128.0/18

[Angonasec]

VolumeDrive, Inc Pa USA
199.180.112.0 - 199.180.119.255 199.180.112.0/21 ber...locked!

[trintragula]

Infobox
109.120.128.0/18

fast scraping with a blank UA (ignoring robots.txt) in mid December.
now showing up with "Add Catalog/2.1" as part of the UA.

They have other ranges:
77.221.128.0/19
92.243.64.0/19
92.243.91.0/24

blend27 mentioned them four years ago on another thread.
They're still at it.

[keyplyr]

Infobox:
77.221.128.0/19
77.221.128.0 - 77.221.143.255

92.243.64.0/19
92.243.64.0 - 92.243.67.255

92.243.91.0/24
92.243.91.0 - 92.243.91.255

109.120.128.0/18
109.120.128.0 - 109.120.135.255

109.120.136.0/22
109.120.136.0 - 109.120.141.255

109.120.140.0/23
109.120.136.0 - 109.120.141.255

109.120.155.0/24
109.120.155.0 - 109.120.157.255

109.120.156.0/23
109.120.155.0 - 109.120.157.255

Gandi:
92.243.0.0/19
92.243.0.0 - 92.243.7.255

[wilderness]

Net3 Inc.
NET3-INC 104.232.32.0 - 104.232.47.255 104.232.32.0/20
NET3-INC 107.161.144.0 - 107.161.159.255 107.161.144.0/20
NET3-INC 162.218.88.0 - 162.218.95.255 162.218.88.0/21
NET3-INC 162.221.176.0 - 162.221.183.255 162.221.176.0/21
NET3-INC 216.170.112.0 - 216.170.127.255 216.170.112.0/20
NET3-INC 23.249.160.0 - 23.249.175.255 23.249.160.0/20

[wilderness]

OrgName: Colo at 55, LLC

COLOA 104.200.128.0 - 104.200.159.255 104.200.128.0/19
COLOA 107.152.96.0 - 107.152.111.255 107.152.96.0/20
COLOAT 107.181.160.0 - 107.181.191.255 107.181.160.0/19
COLOAT 184.170.240.0 - 184.170.255.255 184.170.240.0/20
COLOA 192.111.128.0 - 192.111.143.255 192.111.128.0/20
COLOA 192.252.208.0 - 192.252.223.255 192.252.208.0/20
COLOA 198.8.80.0 - 198.8.95.255 198.8.80.0/20
COLOAT 199.116.112.0 - 199.116.119.255 199.116.112.0/21
COLOAT 199.187.208.0 - 199.187.211.255 199.187.208.0/22
COLOA 199.229.248.0 - 199.229.255.255 199.229.248.0/21
COLOAT 199.58.184.0 - 199.58.187.255 199.58.184.0/22
COLOAT 74.119.144.0 - 74.119.147.255 74.119.144.0/22

[keyplyr]

Didn't have any of the Net3, thanks.

Had a lot of the Colo55, and then a couple same ranges but different name. Several were new for me, thanks.

[wilderness]

What a stinking mess at ARIN WHOIS.
There are enough small (sub-sub) ranges listed by this reseller that the quantity exceeds the 255 limit and omits their ONLY valid range (206.221.176.0/20). All the rest of the ranges are as a reseller via CHOOPA ranges.

ReliableSite.Net LLC (RL-102 [whois.arin.net])

ReliableSite.Net LLC RELIABLESITE-NETBLOCK 206.221.176.0 - 206.221.191.255 206.221.176.0/20
ReliableSite.Net 108.61.6.0 - 108.61.143.255 (CHOOPA-NETBLK08 108.61.0.0 - 108.61.255.255 108.61.0.0/16)
ReliableSite.Net 209.222.0.0 - 209.222.12.255 (CHOOPA-NETBLK06209.222.0.0 - 209.222.31.255 209.222.0.0/19)
ReliableSite.Net 64.237.33.0 - 64.237.49.255 (CHOOPA-NETBLK0164.237.32.0 - 64.237.63.255 64.237.32.0/19)
ReliableSite.Net 66.55.129.0 - 66.55.153.255 (Choopa, LLC (CHOOP-1) 66.55.128.0 - 66.55.159.255 66.55.128.0/19)
ReliableSite.Net 68.232.180.0 - 68.232.188.255 (CHOOPA-NETBLK0568.232.160.0 - 68.232.191.255 68.232.160.0/19)

[keyplyr]

So long and thanks for all the fish.

[trintragula]

Glad to see some people remember THHGTTG. :)

[trintragula]

It occurs to me that anyone who rents a VPS or dedicated server and connects to it using some kind of remote desktop may find themselves browsing the web from it as they work. In fact I think I may even have seen people doing this (I think in some cases it's not proxying).
There will also be staff at those data centres, who will browse the web sometimes.
This leads me to think that not all access from server farms is necessarily mischief.

As previously noted, we each make our own choices about these things.

[wilderness]

trintragula,
There are going to be exceptions and innocents for just about every resolution.
That is where the human enters and creates custom ranges for known, identified and/or desired visitors.

There's no benefit to allowing traffic from servers.

[lucy24]

There's no benefit to allowing traffic from servers.

If you're on shared hosting you have to poke a hole for your own hosting company or else they may have trouble investigating problems. (They can access your files, of course, but sometimes you need them to view things in a browser.)

Conversely...

anyone who rents a VPS or dedicated server and connects to it using some kind of remote desktop may find themselves browsing the web from it as they work

But they don't have to use their own server as a proxy. In fact it may be illuminating to see how many sites block your server's IP.

I've never come across a host's front page saying outright "We welcome all botrunners, good bad or mediocre" * -- but some hosts do end up with a worse reputation than others.


* As long as we're dropping literary allusions...

[wilderness]

If you're on shared hosting you have to poke a hole for your own hosting company or else they may have trouble investigating problems.

While reviewing some lines, and as a result of this thread, I came across a solitary line poked in the 78/8 for an old host support that was vacationing in Spain ;)

Generally speaking, your own host from a trouble ticket will notify you that they are unable to access your site.
A competent host tech support, simply renames htaccess until they resolve the issue.
An incompetent host tech will not have any clue as why of their denial (good time to determine if changing providers is on the calendar).

[keyplyr]

If you're on shared hosting you have to poke a hole for your own hosting company or else they may have trouble investigating problems.

For a couple sites, I block the ranges of the hosting companies. Another site at a different host I need to "poke a hole." It depends how the file servers & routers are set-up. Also, using relative vrs absolute paths may play a role.

[keyplyr]

. In fact it may be illuminating to see how many sites block your server's IP.

Personally I could care less if anyone blocks my server's IP since I don't crawl from where I host... even I block my server's IP :)

[trintragula]

I'm on shared hosting, so I share my IP with some thousands of other sites. The great thing about shared hosting is that every IP is a small server farm... :)

[lucy24]

A competent host tech support, simply renames htaccess until they resolve the issue.

If someone chose to disable an entire htaccess file in order to browse the site-- which could well make the site non-functional-- I don't think I would describe them as "competent".

[wilderness]

A competent host tech support, simply renames htaccess until they resolve the issue.

If someone chose to disable an entire htaccess file in order to browse the site-- which could well make the site non-functional-- I don't think I would describe them as "competent".

lucy, the alternative reply/action would be something like the like the following:
"We're unable to access your site and resolve your trouble ticket. Any further support will be fee based at the rate of $90 per hour."

Since 1999 I've had multiple reactions from varied hosts when they were unable to access my sites.
1) They delete the htaccess entirely
2) They rename the htaccess and notify you of same while they fulfill the trouble ticket.
3) They simply restore your site (s) to a previous configuration
4) They notify you that they are unable to access the website and close the trouble ticket without fulfillment.
5) they simply feed you a line of crap proclaiming they don't know.
6) They actually don't know.

[keyplyr]

Solution = stop calling support. I stopped dealing with those clowns years ago; always just seemed to add more problems. I usually ended up teaching them their job.

If I can help it, I also never use shells or other host utilities. If I can't execute everything from my local machine via ftp or sftp, I find another host.
Silly to pay for a VPS or dedicated server if the site doesn't need it, but I try to get as close to it as I can for my own piece of mind.

[not2easy]

I have two of these listed already, pretty sure these have been listed on the forum here, I don't have a date with them:
82.146.52.0/22 RU -- ISPSYSTEM
82.146.52.0 - 82.146.55.255

82.146.56.0/21 RU -- ISPSYSTEM
82.146.56.0 - 82.146.63.255

So today a lookup gives me a new one:
82.146.38.0/23 RU -- ISPSYSTEM CLOUD-NET
82.146.32.0 - 82.146.39.255

Anyone know a reason not to combine
82.146.32.0 - 82.146.63.255 ?

[keyplyr]

It's all them:

TheFirst / ISPSystem
82.146.32.0/19
82.146.32.0 - 82.146.63.255



And right above them is Bulgaria hosting:

netissat.bg
82.146.4.0/22
82.146.8.0/21
82.146.16.0/20
82.146.4.0 - 82.146.31.255

[keyplyr]

truIT, Uganda (home & biz broadband, web servers)
196.45.124.0/22
196.45.124.0 - 196.45.127.255

[dstiles]

Another rackspace one today, operating in Australia and Hong Kong...

119.9.0.0 - 119.9.255.255
119.9.0.0/16

[keyplyr]

JasTel Datacenters, Thailand
103.247.60.0/22
103.247.60.0 - 103.247.63.255

[keyplyr]

Noticed bot behavior from this range. Delicate situation since this company leases broadband to schools (significant traffic for me) however their product list also includes cloud servers, VM websites, colos & datacenters.

oarnet.com, Columbus, Ohio
199.18.0.0/16
199.18.0.0 - 199.18.255.255