Server Farms - February 2015

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[not2easy]

LIBERO-INFOSTRADA WIND
Claims to be an Italian Telecom but I only see scrapers from their ranges. They keep falling in my traps.
This one I had not seen before, the others go back to 2011:
151.26.0.0/16
151.26.0.0 - 151.26.255.255

151.27.0.0/16
151.27.0.0 - 151.27.255.255

151.29.0.0/16
151.29.0.0 - 151.29.255.255

151.54.0.0/16
151.54.0.0 - 151.54.255.255
There are probably more.
______________________________________________

Also another XOVI I didn't have:
DE-XOVI First Colo Datacenter
185.53.44.0 - 185.53.44.255
185.53.44.0/24

For XOVI I had
212.224.119.128 - 212.224.119.191
212.224.119.128/26

(within 212.224.0.0/17 ) from previous threads here.

Another previous sighting of the XoviBot thing:
Dedicated and virtual Servers of BONNtel - OPTEAMAX
185.27.252.0 - 185.27.252.223
185.27.252.0/22

[lucy24]

DE-XOVI First Colo Datacenter
185.53.44.0 - 185.53.44.255
185.53.44.0/24

I'm pretty sure it's safe to proceed directly to /22. At least I hope so, because notes say I've already got them blocked that way.

[keyplyr]

I'm pretty sure it's safe to proceed directly to /22. At least I hope so, because notes say I've already got them blocked that way.

Confirmed. I've had them blocked for a while now:

First Colo
185.53.44.0/22
185.53.44.0 - 185.53.47.255

[blend27]

... I just thought it funny that blend27 would suggest people on the internet agree on anything :) ....

Yes, Yes, be funny or die in my book...

[lucy24]

31.132.0.0/21
UK Dedicated Servers
("UK" is part of the name)

[keyplyr]

Yes, Yes, be funny or die in my book...

Die in your book? When I die, I want to die like my grandfather who died peacefully in his sleep,
not screaming in panic like the passengers in his car.

31.132.0.0/21

UK Servers seem to have expanded. I had them 31.132.3.0/24 from 2011. Thanks for the update.

[keyplyr]

1blu.de
178.254.0.0/19
178.254.0.0 - 178.254.63.255

[keyplyr]

Supernova
46.252.144.0/22
46.252.144.0 - 46.252.150.255

[trintragula]

It would be useful to say what bad behaviour is being seen rather than just who they are - particularly evidence that they are not human.

I do get human visitors from some server farms listed here.

[Angonasec]

Sinobot living in Toronto
168.144.82.115 SoftcomCA 168.144.0.0/16 ber...locked!

[keyplyr]

It would be useful to say what bad behaviour is being seen rather than just who they are - particularly evidence that they are not human.

Irrelevant. This is a "server farms" forum. We just identify & list the ranges. It is up to each web master to determine what affect that has on their web site.

trintragula, many webmasters feel that other web servers have no legit business accessing our web servers, especially those servers found at server farms (hosting companies, data centers, colocation & cloud.) Hits from these are typically not human and often are malicious and damaging to our businesses.

There is of course the occasional collateral damage in blocking other servers. Some businesses may lease space at these facilities and also have employees who surf the web from their work computers. Again, discretionary per web master.

[keyplyr]

ProISP
213.162.240.0/23
213.162.240.0 - 213.162.241.255

[wilderness]

It would be useful to say what bad behaviour is being seen rather than just who they are - particularly evidence that they are not human.

I began this thread in 2012, course that a 50-cents may get me a phone call.

There are old-timers in this forum that will verify that for longest time I would not even submit or discuss a server farms IP's (or name) in the open forum because I believed it to be free advertising for the farm (still inclined to lean in that direction).

The inability to link directly to a particular submission of farm pretty much makes this overall thread useless (we know that from experience and the depth of the Close to Perfect htaccess thread).

The one constant idea of this forum has been that each webmaster must determine what is beneficial or detrimental to their own website (s), thus I agree with keyplr.

Why make the 'useless thread' even more complicated and useless than it already is?

[keyplyr]

dedipower.com > pulsant.com

46.236.0.0/18
46.236.0.0 - 46.236.63.255

89.151.64.0/18
89.151.64.0 - 89.151.127.255

185.20.4.0/22
185.20.4.192 - 185.20.4.223

[bobothecat2]

New (to me) Interserver range (there's lots of others already known):

104.37.184.0 - 104.37.191.255
104.37.184.0/21

[keyplyr]

Interserver ranges*

64.20.32.0/19
64.20.32.0 - 64.20.63.255

66.23.224.0/20
66.23.224.0 - 66.23.239.255

66.45.224.0/19
66.45.224.0 - 66.45.255.255

68.168.208.0/20
68.168.208.0 - 68.168.223.255

69.10.32.0/19
69.10.32.0 - 69.10.63.25

104.37.184.0/21
104.37.184.0 - 104.37.191.255

162.216.112.0/22
162.216.112.0 - 162.216.115.255

162.220.160.0/21
162.220.160.0 - 162.220.167.255

162.250.120.0/21
162.250.120.0 - 162.250.127.255

173.214.160.0/20
173.214.160.0 - 173.214.175.255

192.64.80.0/21
192.64.80.0 - 192.64.87.255

199.231.184.0/21
199.231.184.0 - 199.231.191.255

206.72.192.0/20
206.72.192.0 - 206.72.207.255

209.159.144.0/20
209.159.144.0 - 209.159.159.255

*Please post additions/corrections

[keyplyr]

TitanInternet
85.232.32.0/21
85.232.32.0 - 85.232.39.255

[blend27]

VpsQuan L.L.C

69.165.64.0 - 69.165.79.255 VPSQUAN-LA1 69.165.64.0/22
23.251.32.0 - 23.251.63.255 VPSQUAN-3 23.251.32.0/19
198.44.160.0 - 198.44.191.255 VPSQUAN-2 198.44.160.0/19
107.151.192.0 - 107.151.255.255 VPSQUAN-4 107.151.192.0/18

[keyplyr]

23.251.0.0/18 Combins these two:

23.251.0.0/19 #Krypt 23.251.0.0 - 23.251.31.255
23.251.32.0/19 #VpsQuan 23.251.32.0 - 23.251.63.255

[lucy24]

173.214.160.0/20
173.214.160.0 - 173.214.175.255

Uh-oh. I'd had this blocked for who-knows-how-long as ../19 i.e. 160-191

And now the good news...
173.214.176.0/20
(the bottom half of the /19)
turns out to be an outfit called KVC Hosting, which sounds very much like No Humans Were Harmed.

Whew.

Incidentally...
Next door to 209.159.144.0/20 (InterServer, above) is
209.159.128.0/20
which bills itself as "IP Transit and Colocation", meaning it is probably safe to proceed directly to /19 there too. Parts of this range are or were Xeex; I think they're sublets.

[keyplyr]

Old client returned. Digging through my previous work I saw I had these 2 ranges blocked but not on my own site. Note to self... Do unto self as you would do unto others.

Carpathia Hosting:

66.235.224.0/19
66.235.224.0 - 66.235.255.255

174.140.128.0/19
174.140.128.0 - 174.140.159.255

[keyplyr]

Discovered a Linode (top range) I didn't know about:


Linode List*

23.92.16.0/20
23.92.16.0 - 23.92.31.255

23.239.0.0/19
23.239.0.0 - 23.239.31.255

45.56.64.0/18
45.56.64.0 - 45.56.127.255

50.116.0.0/18
50.116.0.0 - 50.116.63.255

66.175.208.0/20
66.175.208.0 - 66.175.223.255

66.228.32.0/19
66.228.32.0 - 66.228.63.255

69.164.192.0/19
69.164.192.0 - 69.164.223.255

72.14.176.0/20
72.14.176.0 - 72.14.191.255

74.207.224.0/19
74.207.224.0 - 74.207.255.255

80.85.84.0/22
80.85.84.0 - 80.85.87.255

85.159.208.0/21
85.159.208.0 - 85.159.215.255

88.80.184.0/21
88.80.184.0 - 88.80.191.255

96.126.96.0/19
96.126.96.0 - 96.126.127.255

104.200.16.0/20
104.200.16.0 - 104.200.31.255

106.187.32.0/20
106.187.32.0 - 106.187.47.255

109.74.192.0/20
109.74.192.0 - 109.74.207.255

139.162.0.0/16
139.162.0.0 - 139.162.255.255

151.236.216.0/21
151.236.216.0 - 151.236.223.255

162.216.16.0/22
162.216.16.0 - 162.216.19.255

173.230.128.0/19
173.230.128.0 - 173.230.159.255

173.255.192.0/18
173.255.192.0 - 173.255.255.255

176.58.96.0/19
176.58.96.0 - 176.58.127.255

178.79.128.0/18
178.79.128.0 - 178.79.191.255

185.3.92.0/22
185.3.92.0 - 185.3.95.255

192.81.128.0/21
192.81.128.0 - 192.81.135.255

192.155.80.0/20
192.155.80.0 - 192.155.95.255

198.58.96.0/19
198.58.96.0 - 198.58.127.255

198.74.48.0/20
198.74.48.0 - 198.74.63.255

212.71.232.0/21
212.71.232.0 - 212.71.239.255

212.111.40.0/22
212.111.40.0 - 212.111.43.255

213.52.128.0/22
213.52.128.0 - 213.52.131.255


*Please post additions/corrections

[blend27]

91.123.201.238
ip-91-123-201-238.kna.citycloud.se
UA: ResearchBot. Visit httpd for info

Farm
City Network Hosting AB
91.123.192.0 - 91.123.207.255 CNH01 91.123.192.0/20

P.S. 23.**.... starts to gain momentum on the scraper side of things these days.

[lucy24]

23.**.... starts to gain momentum

The top half of 23 was unassigned until quite recently. A lot of 23.128/10 is still open. That's a lot of room for server farms.

:: idly wondering why Nigeria and South Africa don't jump in and register all of 102 and then turn around and sell it for a fortune to European servers ::

[lucy24]

Elsewhere...
Would anyone care to speculate what "SpecAvtomatika" is, means or does?
194.6.231
194.6.232.0/23
(really)
Ukraine. Just met an unattractive robot from 194.6.233.33.

[keyplyr]

Would anyone care to speculate what "SpecAvtomatika" is, means or does?

From specavtomatika.ru:

LLC "Specavtomatikaservis" is the production company involved in production of equipment and materials for overhead power transmission lines with voltage 6-20 kV with protected wires. (trans from Russian)

From specavtomatika.net:

The company was founded in 2000. Main activity is the construction of systems of fire alarm. (trans from Russian)

So there you have it :)

Just a FYI - your bot could possibly be coming from a compromised IP.

[lucy24]

your bot could possibly be coming from a compromised IP.

It didn't seem like a strongly humanoid range, so I just blocked 'em :) Gotta admit, the nature of their business does not seem an exceptionally strong match for any of my content.

But a while back I added an environmental variable (imaginatively called bad_russia) to deal with selected human IPs that are especially infection-prone. They, along with certain bogus yandex referers, get sent to a redirect page headed with apologies in four languages. From there, they are free to continue on to the originally requested page if they let me set a short-lived cookie. I don't think anyone has ever done so, but it seems a viable compromise.

[not2easy]

A few more Linode:
97.107.128.0/20
97.107.128.0 - 97.107.143.255

104.237.128.0/19
104.237.128.0 - 104.237.159.255

[keyplyr]

Thanks not2easy,

I actually had both of those Linode ranges... they just didn't get into my post :)

[keyplyr]

Comnet International

185.17.112.0/22
185.17.112.0 - 185.17.115.255

185.73.200.0/22
185.73.200.0 - 185.73.203.255


PlanetHoster

199.16.128.0/22
99.16.128.0 - 199.16.131.255