Welcome to WebmasterWorld Guest from 54.197.116.116

Forum Moderators: Ocean10000 & incrediBILL

Server Farms - August 2014

Tracking and Reporting Data Center IP Ranges

   
12:37 am on Jul 31, 2014 (gmt 0)

WebmasterWorld Administrator incredibill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Continuation of the Server Farm threads.

Since we're at the end of July, I named it August a day early, so sue me.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

2:47 pm on Jul 31, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



New to me...
69.12.75.nnn Colocation host caught scraping html, no images, no robots.
QUADRANET 69.12.64.0 - 69.12.95.255 69.12.64.0/19
6:39 pm on Jul 31, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



I believe these QuadraNet ranges have all been listed here before, but if not, here's what I have (all blocked):

66.63.160.0/19
66.63.160.0 - 66.63.191.255

67.215.224.0/19
67.215.224.0 - 67.215.255.255

69.12.64.0/19
69.12.64.0 - 69.12.95.255

72.11.128.0/19
72.11.128.0 - 72.11.159.255

96.44.128.0/18
96.44.128.0 - 96.44.191.255

98.143.144.0/20
98.143.144.0 - 98.143.159.255

107.161.80.0/20
107.161.80.0 - 107.161.95.255

155.94.128.0/17
155.94.128.0 - 155.94.255.255

173.254.192.0/18
173.254.192.0 - 173.254.255.255

192.161.48.0/20
192.161.48.0 - 192.161.63.255

192.161.160.0/19
192.161.160.0 - 192.161.191.255

198.55.96.0/19
198.55.96.0 - 198.55.127.255

198.96.88.0/21
198.96.88.0 - 198.96.95.255

204.44.64.0/18
204.44.64.0 - 204.44.127.255

204.152.192.0/19
204.152.192.0 - 204.152.223.255
7:44 pm on Jul 31, 2014 (gmt 0)

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month



I have another one, I think these were from a list shared last Feb here:
216.45.48.0/20
216.45.48.0 - 216.45.63.255
8:58 pm on Jul 31, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month




I had 216.45.48/20 listed as OC3, but just checked and it appears it was acquired by QuadrsNet a year ago (as was 66.63.160/19.) Thanks for the heads-up.
5:04 am on Aug 1, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Yes, thank you, I was sure QUADRANET had featured here, just that this range is new to our site. I did look up the expanding gamut of QUADRANET using Don's tip. Looks like they've acquired many new ranges to entertain us with.

Somebody phone the Daleks please.
11:53 am on Aug 8, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Expedient and/or CONTINENTAL BROADBAND PENNSYLVANIA, INC.

SPRINTLINK 205.246.16.0 - 205.246.17.255 205.246.16.0/23
CBP 206.183.0.0 - 206.183.31.255 206.183.0.0/19
CBP 206.210.64.0 - 206.210.95.255 206.210.64.0/19
CBP 207.54.128.0 - 207.54.191.255 207.54.128.0/18
SPRINTLINK 208.1.140.0 - 208.1.143.255 208.1.140.0/22
SPRINTLINK 208.12.110.0 - 208.12.111.255 208.12.110.0/23
SPRINTLINK 208.27.132.0 - 208.27.132.255 208.27.132.0/24
CBP 208.40.128.0 - 208.40.207.255 208.40.128.0/18 208.40.192.0/20
CBP 209.114.128.0 - 209.114.191.255 209.114.128.0/18
CBP 209.166.128.0 - 209.166.191.255 209.166.128.0/18
CBP 209.190.128.0 - 209.190.191.255 209.190.128.0/18
CBP 209.221.0.0 - 209.221.31.255 209.221.0.0/19
CBP 216.130.0.0 - 216.130.31.255 216.130.0.0/19
CBP 216.151.64.0 - 216.151.127.255 216.151.64.0/18
CBP 216.183.160.0 - 216.183.191.255 216.183.160.0/19
CBP 216.82.64.0 - 216.82.127.255 216.82.64.0/18
SPRINTLINK 63.160.32.0 - 63.160.39.255 63.160.32.0/21
SPRINTLINK 63.169.100.0 - 63.169.103.255 63.169.100.0/22
SPRINTLINK 63.174.16.0 - 63.174.31.255 63.174.16.0/20
CBB 66.11.0.0 - 66.11.31.255 66.11.0.0/19
CBP 66.181.64.0 - 66.181.95.255 66.181.64.0/19
CBP 66.230.64.0 - 66.230.79.255 66.230.64.0/20
CBP 69.7.96.0 - 69.7.111.255 69.7.96.0/20
CBP-IPV6 2607:F4D0:: - 2607:F4D0:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
3:36 pm on Aug 8, 2014 (gmt 0)

WebmasterWorld Administrator 5+ Year Member Top Contributors Of The Month



Thank you immensely for this info!
4:14 pm on Aug 8, 2014 (gmt 0)
6:11 pm on Aug 8, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month




(I guess it is now necessary to post in more than one place)

IMO this has absolutely nothing to do with server farms. Those IP ranges are as they say they are... customer broadband, and as such should not be blocked but YMMV.

The Thuderstone software is a search utility. I use it myself as my site search. Anyone can buy it and use it for a number of things, all search related and harmless. It is not capturing (scraping) your stuff. However, it can be pointed at any domain, any intranet, so someone may be using it to search for information.
2:21 pm on Aug 9, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month




Tranquil Hosting
162.223.8.0/21
162.223.8.0 - 162.223.15.255
4:37 pm on Aug 9, 2014 (gmt 0)
3:58 am on Aug 15, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Note unusual leading character in UA!
I've the same from a Canadian hosting during Jul & Aug (205.237.88.145 )

208.93.7.118 - - [13/Aug/2014:04:27:25 -0600] "GET / HTTP/1.0" 403 832 "-" "=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16"
208.93.7.102 - - [14/Aug/2014:21:16:41 -0600] "GET / HTTP/1.0" 403 832 "-" "=Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.204 Safari/534.16"


Dino Solutions, Inc. (hosting and cloud)
DINONET 208.86.196.0 - 208.86.199.255 208.86.196.0/22
DSNETSOL 208.86.197.0 - 208.86.197.255 208.86.197.0/24
DINONET 208.93.4.0 - 208.93.7.255 208.93.4.0/22
DINONET 208.93.6.0 - 208.93.6.255 208.93.6.0/24
DINONET 208.94.224.0 - 208.94.224.255 208.94.224.0/24
DINONET 208.94.224.0 - 208.94.231.255 208.94.224.0/21
DINO 208.94.229.0 - 208.94.229.255 208.94.229.0/24
DINONET 63.216.90.0 - 63.216.90.255 63.216.90.0/24 (BTN-CIDR5 63.216.0.0/13)
DINONET 66.56.64.0 - 66.56.95.255 66.56.64.0/19
LILLY 66.56.68.0 - 66.56.68.255 66.56.68.0/24
DINONET 74.85.208.0 - 74.85.223.255 74.85.208.0/20
6:45 am on Aug 15, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month





New for me, thanks
1:46 am on Aug 16, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Continuum Data Centers, LLC 64.79.96.0/20 Now blocked

64.79.111.90 - - [14/Aug/2014:01] "GET /example.htm HTTP/1.1" 200 14462 "http://www.example.org/" "Mozilla/5.0 (Linux; U; Android 2.2; fr-fr; Desire_A8181 Build/FRF91) App3leWebKit/53.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1"

Private Customer CONTINUUM-REASSIGN-64-79-111-0-24
64.79.111.0 - 64.79.111.255
Continuum Data Centers, LLC. CDC-LMB-ARIN3
64.79.96.0 - 64.79.111.255 64.79.96.0/20
2:03 am on Aug 16, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



The similar malformed UA used above by Continuum was also used today by 192.228.96.0/20 (Micfo) and 173.208.166.24/29 (DataShack)
7:06 am on Aug 16, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month





In January I posted a Continuum DC list here: [webmasterworld.com...]
8:00 pm on Aug 17, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



DataWagon

162.253.66.0/24
104.128.236.0/24

some garbage UA, dont even want to talk about it
9:33 pm on Aug 22, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



What a mess!

ONEZERO-01 66.231.184.228 - 66.231.184.231 (INFORELAY-SJC-NETBLOCK-66.231.176.0/20
ONEZERO-03 66.231.184.64 - 66.231.184.71 (INFORELAY-NETBLOCK01 66.231.176.0 - 66.231.191.255 66.231.176.0/20)
ONEZERO-02 66.231.186.112 - 66.231.186.115 (INFORELAY-NETBLOCK01 66.231.176.0 - 66.231.191.255 66.231.176.0/20)
INFORELAY-ONEZERO-05 67.208.66.0 - 67.208.66.255 67.208.64.0/19
ONEZEROHOSTING-01 67.208.69.0 - 67.208.69.255 (INFORELAY-SJC-NETBLOCK-67.208.64.0/19
ONEZEROHOSTING-01 67.208.70.0 - 67.208.71.255 (INFORELAY-SJC-NETBLOCK-67.208.64.0/19
ONEZERO 67.43.32.0 - 67.43.47.255 67.43.32.0/20
ONEZEROHOSTING 68.67.192.0 - 68.67.207.255 68.67.192.0/20
ONEZERO-06 69.169.113.0 - 69.169.113.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0 - 69.169.127.255 69.169.0.0/17)
ONEZERO-07 69.169.114.0 - 69.169.115.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0 - 69.169.127.255 69.169.0.0/17)
INFORELAY-ONEZERO-05 69.169.20.0 - 69.169.21.255 (INFORELAY-SJC-NETBLOCK-02 69.169.0.0/17
ONEZERO-IR-04 173.45.16.0 - 173.45.31.255 (INFORELAY-SJC-NETBLOCK-173.45.0.0/18
ONEZEROHOSTING-03 173.45.4.0 - (INFORELAY-SJC-NETBLOCK-173.45.4.255 173.45.0.0/18

There's two very old mentions of the backbone (colo)
[webmasterworld.com...]
[webmasterworld.com...]
11:11 pm on Aug 22, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month






New for me, thanks
12:25 am on Aug 23, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



InfoRelay Related Networks [whois.arin.net]
11:14 pm on Aug 23, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month





Getting some bad agents from kei.pl: 94.152.0.0/16
11:54 am on Sep 2, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



root & PHP vulnerabilitiea
Blank UA

CNSERVERSLLC 162.212.252.0 - 162.212.255.255 162.212.252.0/22
CNSERVERSLLC 162.218.48.0 - 162.218.55.255 162.218.48.0/21
CNSERVERS-PDX 162.252.8.0 - 162.252.11.255 162.252.8.0/22
CNSERVERS-PDX 198.12.12.0 - 198.12.15.255 198.12.12.0/22
CNSERVERS-PDX 199.83.48.0 - 199.83.51.255 199.83.48.0/22
CNSERVERS-PDX 208.81.164.0 - 208.81.167.255 208.81.164.0/22
CNSERVERS-PDX 2604:6700:: - 2604:6700:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
7:42 pm on Sep 2, 2014 (gmt 0)

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



A blank UA would get a 403 at my sites, however thanks for the CN Server ranges :)
4:55 am on Sep 8, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Beyond The Network America, Inc.
63.216.0.0/13
10:35 am on Sep 8, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Beyond The Network America, Inc. Related Networks [whois.arin.net]
11:43 am on Sep 8, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Thanks Don, excuse my sloppiness, here are the juicy CIDRs for that link;
205.177.0.0 - 205.177.255.255 205.177.0.0/16
BTN-CIDR2 206.161.0.0 - 206.161.255.255 206.161.0.0/16
BTN-CIDR3 207.226.0.0 - 207.226.255.255 207.226.0.0/16
BTN-CIDR4 209.8.0.0 - 209.9.255.255 209.8.0.0/16
BTN-CIDR5 63.216.0.0 - 63.223.255.255 63.216.0.0/13
BTN-CIDR6 65.72.0.0 - 65.72.255.255 65.72.0.0/16
BTN-CIDR7 205.252.0.0 - 205.252.255.255 205.252.0.0/16
BTN-CIDR8 207.176.0.0 - 207.176.127.255 207.176.0.0/17
LVLT-BNA-42-208-178-217 208.178.217.0 - 208.178.217.255 208.178.217.0/24
12:03 am on Sep 9, 2014 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



EVANZO e-commerce GmbH

178.254.0.0 - 178.254.63.255 178.254.32.0/20

more IPV4 & 6 ranges here: [bgp.he.net...]

IP: 178.254.33.X
UA Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; fr; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8

Not even .9?

Missing headers, looking-sniffing for random file names, blocked.
12:20 pm on Sep 9, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Yomura Corporation (YC-5)
199.233.247.14 - - [09/Sep/2014:05:24:05 -0600] "GET / HTTP/1.1" 403 775 "-" "Xenu Link Sleuth/1.3.8"

YOMURA-CORE-001 107.189.32.0 - 107.189.63.255 107.189.32.0/19
YOMURA-WEST-001 199.204.184.0 - 199.204.187.255 199.204.184.0/22
YOMURA-EAST-001 199.233.244.0 - 199.233.247.255 199.233.244.0/22
YOMURA-CORE-001 2605:980:: - 2605:980:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
2:30 pm on Sep 12, 2014 (gmt 0)

WebmasterWorld Senior Member wilderness is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month



Nerdie Networks LLC
199.96.156.87 - - [12/Sep/2014:07:10:42 -0600] "GET /wp/wp-admin/ HTTP/1.1" 403 561 "-" "-"

NERDIE-NETWORKS 199.192.216.0 - 199.192.219.255 199.192.216.0/22
NERDIE-NETWORKS 199.96.156.0 - 199.96.159.255 199.96.156.0/22
NERDIE 64.38.229.0 - 64.38.229.63 (CWIE, LLC (CWIE) 64.38.192.0/18 )
NERDIE-NETWORKS 2602:FFFF:: - 2602:FFFF:FFF:FFFF:FFFF:FFFF:FFFF:FFFF

This little pest has lead me (via their CWIE backbone) to six major backbones.
The ranges are too large to list here, and some have been listed multiple times previously.
One I'm not sure is a server, as it calls itself a CDN (Content Delivery Network), however their IP's are many.

Computer Sciences Corporation
CWIE, LLC (CWIE)
Highwinds Network Group, Inc. (HNG-3) (very large CDN)
SECURED SERVERS LLC

LVLT
Savis
This 285 message thread spans 10 pages: 285