Server Farms - February 2015

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[keyplyr]

Thanks blend27, I also was missing a couple ranges for VolumeDrive. Others I have included in collective blocks for easier management. Looking at my IP range DB now, it''s easy to see why we need IPv6.

[keyplyr]

serverel.com
109.206.160.0/19
109.206.160.0 - 109.206.191.255

I discovered this range when a bad actor circumvented my IP block and used a service named Unblock Today, which launches a VPN to get access to a site.

[keyplyr]

Chobi - IT Services (cdlan.it)
178.249.184.0/21
178.249.184.0 - 178.249.191.255

[keyplyr]

netirons.com
158.222.0.0/20
158.222.0.0 - 158.222.15.255

[dstiles]

Another new (to me) OVH range, rented by several countries such as LT, ES.

149.202.0.0 - 149.202.255.255
149.202.0.0/16

[keyplyr]

Just saw an aggressive botnet from ServerMania/B2Net. Here's my current block list:

23.229.0.0/17
23.229.0.0 - 23.229.127.255

23.236.128.0/17
23.236.128.0 - 23.236.255.255

23.250.0.0/17
23.250.0.0 - 23.250.127.255

23.254.0.0/16
23.254.0.0 - 23.254.255.255

45.57.128.0/17
45.57.128.0 - 45.57.255.255

45.72.0.0/17
45.72.0.0 - 45.72.127.255

69.4.80.0/20
69.4.80.0 - 69.4.95.255

69.58.0.0/20
69.58.0.0 - 69.58.15.255

104.144.0.0/16
104.144.0.0 - 104.144.255.255

104.227.0.0/16
104.227.0.0 - 104.227.255.255

107.152.128.0/17
107.152.128.0 - 107.152.255.255

138.128.0.0/17
138.128.0.0 - 138.128.255.255

192.157.48.0/20
192.157.48.0 - 192.157.63.255

192.186.128.0/18
192.186.128.0 - 192.186.191.255

192.198.96.0/19
192.198.96.0 - 192.198.127.255

192.241.64.0/18
192.241.64.0 - 192.241.127.255

198.20.160.0/19
198.20.160.0 - 198.20.191.255

198.154.80.0/20
198.154.80.0 - 198.154.95.255

198.245.64.0/20
198.245.64.0 - 198.245.79.255

208.78.63.0/24 (but inside juch-tech.com 208.78.56.0/21)
208.78.63.0 - 208.78.63.255

208.92.112.0/21
208.92.112.0 - 208.92.119.255

[dstiles]

And yet another OVH - Canada this time...
158.69.0.0 - 158.69.255.255
158.69.0.0/16

[keyplyr]

Had that one :)

[keyplyr]

Inside this KDDI block:
106.128.0.0/10
106.128.0.0 - 106.191.255.255

Are these Linode ranges:
106.184.0.0/21
106.184.0.0 - 106.184.7.255
106.187.32.0/20
106.187.32.0 - 106.187.47.255
106.187.96.0/21
106.187.96.0 - 106.187.103.255

Which turns out to be the source of bad actors mentioned in my earlier posts re KDDI.

[blend27]

WeHostWebsites.com updated list.

72.18.128.0 - 72.18.159.255 NET-WEHOST-1 72.18.128.0/19
64.27.48.0 - 64.27.63.255 NET-WEHOST-2 64.27.48.0/20
68.71.128.0 - 68.71.159.255 NET-WEHOST-3 68.71.128.0/19
192.82.248.0 - 192.82.255.255 NET-WEHOST-4 192.82.248.0/21
173.248.128.0 - 173.248.191.255 NET-WEHOST-5 173.248.128.0/18
162.213.216.0 - 162.213.223.255 NET-WEHOST-6 162.213.216.0/21
23.239.192.0 - 23.239.223.255 NET-WEHOST-8 23.239.192.0/19
192.199.240.0 - 192.199.255.255 NET-WEHOST-7 192.199.240.0/20

[dstiles]

linode japan - I also have...

106.186.16.0 - 106.186.31.255
106.186.112.0 - 106.186.127.255
106.187.88.0 - 106.187.103.255

[keyplyr]

So long and thanks for all the fish.

[keyplyr]

serverroom.net
162.244.80.0/22
162.244.80.0 - 162.244.83.255

[keyplyr]

Found a new Psychz range (noted in my updated list.)

23.91.0.0/19
23.91.0.0 - 23.91.31.255

23.238.128.0/17
23.238.128.0 - 23.238.255.255

45.34.0.0/15
45.34.0.0 - 45.35.255.255

74.117.56.0/21
74.117.56.0 - 74.117.63.255

104.149.0.0/16
104.149.0.0 - 104.149.255.255 (new to me)

108.171.240.0/20
108.171.240.0 - 108.171.255.255

173.224.208.0/20
173.224.208.0 - 173.224.223.255

192.184.32.0/19
192.184.32.0 - 192.184.63.255

192.210.48.0/20
192.210.48.0 - 192.210.63.255

198.13.96.0/19
198.13.96.0 - 198.13.127.255

199.15.112.0/21
199.15.112.0 - 199.15.119.255

199.71.212.0/22
199.71.212.0 - 199.71.215.255

199.119.200.0/21
199.119.200.0 - 199.119.207.255

208.87.240.0/22
208.87.240.0 - 208.87.243.255

216.24.192.0/20
216.24.192.0 - 216.24.207.255

216.99.144.0/20
216.99.144.0 - 216.99.159.255

************

Likewise with DataPipe:

63.131.128.0/19
63.131.128.0 - 63.131.159.255

64.27.64.0/18
64.27.64.0 - 64.27.127.255

64.106.128.0/17
64.106.128.0 - 64.106.255.255

65.17.192.0/18
65.17.192.0 - 65.17.255.255

66.70.0.0/17
66.70.0.0 - 66.70.127.255

74.200.192.0/18
74.200.192.0 - 74.200.255.255 (new to me)

209.18.64.0/18
209.18.64.0 - 209.18.127.255

216.109.128.0/19
216.109.128.0 - 216.109.159.255

*************

And then we have these two entries from the African continent:

Aptus Hosting
41.79.68.0/22
41.79.68.0 - 41.79.71.255

CloudAfrica Hosting
41.79.76.0/22
41.79.76.0 - 41.79.79.255

[blend27]

New FastHosts range for me:

109.228.0.0 - 109.228.19.255
109.228.0.0/18

[blend27]

ehostidc.co.kr

compromised server on 103.249.28.142 - looking for /wp-login.php

103.249.28.0 - 103.249.31.255
27.255.64.0 - 27.255.95.255
180.150.224.0 - 180.150.231.255

[keyplyr]

Interactive 3D (i3d.net) says:

About i3D.net
Managed hosting provider founded in 2004, now operates over 8,500 servers in 16 ISO27001 certified datacenters on six continents world wide.

That's a lot of servers, each with up to 2K IP addresses (depending on their assignment.) These are what I have in my block list:

5.200.0.0/19
5.200.0.0 - 5.200.31.255

31.204.128.0/19
31.204.128.0 - 31.204.159.255

109.200.192.0/20
109.200.192.0 - 109.200.207.255

So it looks as though I'm missing a few :)

[dstiles]

Here's what I have for Interactive3d...

5.200.0.0 - 5.200.31.255
31.204.128.0 - 31.204.159.255
109.200.192.0 - 109.200.207.255
188.122.64.0 - 188.122.95.255
213.163.64.0 - 213.163.95.255

[keyplyr]

I actually had those ranges as well, just under a different company name. Thanks for the update.

[keyplyr]

Found a new infiumhost.com range (noted.)

46.148.16.0/20
46.148.16.0 - 46.148.31.255 - new to me

188.190.96.0/19
188.190.96.0 - 188.190.127.255

193.106.28.0/22
193.106.28.0 - 193.106.31.255

**********

Also...

strato.de
81.169.192.0/18
81.169.192.0 - 81.169.255.255

incos.info
83.64.10.184/29
83.64.10.184 - 83.64.10.191

[blend27]

SE-TRALEX-20110616
176.74.192.0 - 176.74.199.255
176.74.192.0/21

[keyplyr]

I also have for Tralex:

151.252.24.0/21
151.252.24.0 - 151.252.31.255