Server Farms - February 2015

Tracking and Reporting Data Center IP Ranges

[incrediBILL]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[keyplyr]

I musta got on a list. All this today:

Depo Data Center (depo40.ru)
46.161.56.0/21
46.161.56.0 - 46.161.63.255

CrocWeb (hostwhitelabel.com)
104.152.168.0/22
104.152.168.0 - 104.152.171.255

webfusion.com
109.104.64.0/19
109.104.64.0 - 109.104.95.255

OZServers
117.20.0.0/20
117.20.0.0 - 117.20.15.255

Ravand/morvahost.com
164.138.16.0/21
164.138.16.0 - 164.138.23.255

InMotionHosting
192.249.112.0/20
192.249.112.0 - 192.249.127.255

A couple of these I have other ranges for. The above ranges are just new to me.

[dstiles]

New google cloud range, registered last August:

104.196.0.0 - 104.199.255.255
104.196.0.0/14

Two IPs hit my sites a couple of times with python. Well, there you go!

[keyplyr]

Recent chatter about Google now using ranges previously not labeled as "crawl" has motivated me to reconsider my blocking rules when it comes to these ranges. I'm now relying on UA, method & wildcard filtering in an effort to allow more access from the widening digital landscape, especially that of mobile.

Any UA string containing the attribute "python" would be blocked from any range.

[keyplyr]

Might be the first times I've seen an Icelandic server farm (very Orwellian.)
1984.is
93.95.224.0/21
93.95.224.0 - 93.95.231.255

axarnet.es
149.62.168.0/22
149.62.168.0 - 149.62.170.255

[lucy24]

Another day, another Russian server farm. A real one (“1,241 websites use this address”), not an env=bad_russia:
80.93.48.0/20
You may find it broken into /21 and /22 segments but it seems to be all the same gang.

Since we've previously met DigiWeb at 80.93.16-31, I checked the neighborhood. Sadly, the other bits of the /18 seem to be human (Ireland and Austria).

[lucy24]

Elsewhere: Today's headscratcher is
194.150.168.0/23
Free lookup says
(a) Germany
(b) AS250.net Foundation
(c) SacredChao
(d) a list of countries as long as your arm
(e) kaputte.li

Met someone from 194.150.168.abc with an hvd-store referer. Server farm or infected browser?

[keyplyr]

org-name: AS250.net Foundation
org-type: OTHER
address: Planet Earth
remarks: This is called The Sacred Chao.
remarks: I appoint you keepers of it.

Hope this helps :)

[keyplyr]

beget.ru
5.101.152.0/21
5.101.152.0 - 5.101.159.255

scicube.com
103.11.100.0/22
103.11.100.0 - 103.11.103.255

[mrtonyg]

Aggregated Full Amazon IPv4 list:

8.18.144.0/23
23.20.0.0/14
27.0.0.0/22
43.250.192.0/23
46.51.128.0/18
46.51.192.0/20
46.51.216.0/21
46.51.224.0/19
46.137.0.0/17
46.137.128.0/18
46.137.224.0/19
50.16.0.0/14
50.112.0.0/16
52.0.0.0/15
52.4.0.0/14
52.8.0.0/16
52.10.0.0/15
52.12.0.0/15
52.16.0.0/15
52.24.0.0/14
52.28.0.0/16
52.64.0.0/17
52.68.0.0/15
52.74.0.0/16
54.64.0.0/15
54.66.0.0/16
54.67.0.0/17
54.68.0.0/14
54.72.0.0/13
54.80.0.0/13
54.88.0.0/14
54.92.0.0/16
54.94.0.0/15
54.144.0.0/12
54.160.0.0/12
54.176.0.0/14
54.182.0.0/21
54.182.134.0/23
54.182.136.0/21
54.182.144.0/20
54.182.160.0/23
54.182.176.0/21
54.182.184.0/23
54.182.195.0/24
54.182.196.0/22
54.182.200.0/21
54.183.0.0/16
54.184.0.0/13
54.192.0.0/19
54.192.32.0/21
54.192.44.0/22
54.192.48.0/20
54.192.64.0/19
54.192.96.0/21
54.192.108.0/22
54.192.116.0/22
54.192.120.0/21
54.192.128.0/20
54.192.144.0/21
54.192.156.0/22
54.192.160.0/22
54.192.172.0/22
54.192.180.0/22
54.192.184.0/21
54.192.192.0/20
54.192.208.0/21
54.192.216.0/22
54.192.224.0/21
54.192.232.0/22
54.192.240.0/21
54.193.0.0/16
54.194.0.0/15
54.196.0.0/14
54.200.0.0/13
54.208.0.0/13
54.216.0.0/14
54.220.0.0/15
54.224.0.0/14
54.228.0.0/15
54.230.0.0/16
54.231.0.0/17
54.231.128.0/18
54.231.192.0/19
54.231.224.0/20
54.231.240.0/21
54.231.252.0/23
54.231.254.0/24
54.232.0.0/16
54.233.64.0/18
54.233.128.0/17
54.234.0.0/15
54.236.0.0/15
54.238.0.0/16
54.239.2.0/23
54.239.4.0/22
54.239.8.0/21
54.239.16.0/20
54.239.32.0/21
54.239.48.0/20
54.239.96.0/24
54.239.98.0/23
54.239.104.0/23
54.239.128.0/20
54.239.144.0/23
54.239.151.0/24
54.239.152.0/23
54.239.154.0/24
54.239.156.0/22
54.239.160.0/20
54.239.176.0/21
54.239.186.0/23
54.239.188.0/22
54.239.192.0/22
54.239.196.0/24
54.239.200.0/21
54.239.208.0/21
54.239.216.0/22
54.239.220.0/23
54.239.222.0/24
54.239.242.0/23
54.240.0.0/20
54.240.16.0/24
54.240.24.0/22
54.240.28.0/24
54.240.192.0/22
54.240.196.0/24
54.240.198.0/23
54.240.200.0/24
54.240.203.0/24
54.240.204.0/22
54.240.216.0/21
54.240.225.0/24
54.240.226.0/23
54.240.228.0/22
54.240.232.0/22
54.240.244.0/22
54.240.248.0/21
54.241.0.0/16
54.242.0.0/15
54.244.0.0/14
54.248.0.0/13
67.202.0.0/18
72.21.192.0/19
72.44.32.0/19
75.101.128.0/17
79.125.0.0/17
87.238.80.0/21
96.127.0.0/17
103.246.148.0/22
107.20.0.0/14
122.248.192.0/18
174.129.0.0/16
176.32.64.0/19
176.34.0.0/16
178.236.0.0/20
184.72.0.0/15
184.169.128.0/17
185.48.120.0/22
199.127.232.0/22
199.255.192.0/22
203.83.220.0/22
204.236.128.0/17
204.246.160.0/21
204.246.168.0/22
204.246.174.0/23
204.246.176.0/23
204.246.179.0/24
204.246.180.0/23
204.246.182.0/24
204.246.184.0/21
205.251.192.0/19
205.251.224.0/20
205.251.240.0/22
205.251.244.0/23
205.251.247.0/24
205.251.248.0/22
205.251.252.0/23
205.251.254.0/24
207.171.160.0/19
216.137.32.0/21
216.137.40.0/22
216.137.44.0/23
216.137.48.0/20
216.182.224.0/20

[mrtonyg]

Aggregated ColoCrossing IPv4 List:

23.94.0.0/15
65.99.193.0/24
65.99.246.0/24
66.225.194.0/23
66.225.198.0/24
66.225.231.0/24
66.225.232.0/24
69.31.134.0/24
72.249.94.0/24
72.249.124.0/24
75.102.10.0/24
75.102.27.0/24
75.102.34.0/24
75.102.38.0/23
75.127.0.0/22
75.127.5.0/24
75.127.6.0/23
75.127.8.0/21
96.8.112.0/22
96.8.116.0/23
96.8.119.0/24
96.8.120.0/23
96.8.122.0/24
96.8.125.0/24
96.8.126.0/23
104.168.0.0/17
107.172.0.0/14
108.174.48.0/20
172.245.0.0/16
192.3.0.0/16
192.210.128.0/18
192.210.192.0/20
192.210.208.0/23
192.210.212.0/23
192.210.216.0/21
192.210.224.0/19
192.227.128.0/17
198.12.64.0/18
198.23.128.0/17
198.46.128.0/17
198.144.176.0/20
199.21.112.0/22
199.188.100.0/22
205.234.152.0/23
205.234.159.0/24
205.234.203.0/24
206.123.95.0/24
206.217.128.0/20
207.210.239.0/24
216.246.49.0/24
216.246.108.0/23

[keyplyr]

@mrtonyg - Thanks for those :)

However, I hope you're not going to post every server farm IP list. Most all are already in these forum archives. We usually just post the *new* ones as they show up.

[mrtonyg]

@keyplyr - I just figured two of the big players in aggregated format would do good.

[blend27]

new range for HOSTWINDS on my list

NetRange: 104.168.128.0 - 104.168.255.255
CIDR: 104.168.128.0/17
RegDate: 2014-09-03

[keyplyr]

That range is actually a /16 when you include the reseller:

Colocrossing/Hostwinds
104.168.0.0/16
104.168.0.0 - 104.168.255.255

[keyplyr]

esoterica.pt
80.172.240.0/23
80.172.240.0 - 80.172.241.255

[wilderness]

Black Fox Limited BFL-22
BFL-22 104.243.16.0 - 104.243.31.255 104.243.16.0/20
BFL-22 107.182.16.0 - 107.182.31.255 107.182.16.0/20
BFL-22 2604:EA00:: - 2604:EA00:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[lucy24]

Can someone point to the most recent OVH list? At some point when I wasn't paying attention*
151.80
jumped ship from its former Wind (wide-ranging Italian IP that still occupies most of the neighborhood). Can't seem to decide if it's Ireland, France or Rumania, but happily "OVH" is the same in all languages.


* Free lookup says this point occurred in 2001. Odd.

[mrtonyg]

@lucy24

OVH IPv4 list:

5.135.0.0/16
5.196.0.0/16
5.39.0.0/17
8.18.128.0/24
8.18.136.0/21
8.18.172.0/24
8.20.110.0/24
8.21.41.0/24
8.24.8.0/21
8.26.94.0/24
8.29.224.0/24
8.30.208.0/21
8.33.128.0/21
8.33.136.0/24
8.33.137.0/24
8.33.96.0/21
8.7.244.0/24
37.187.0.0/16
37.59.0.0/16
46.105.0.0/16
46.105.192.0/20
46.105.192.0/23
46.105.194.0/23
46.105.196.0/23
46.105.198.0/24
87.98.128.0/17
91.121.0.0/16
92.222.0.0/16
94.23.0.0/16
109.190.0.0/16
142.4.192.0/19
149.202.0.0/16
151.80.0.0/16
167.114.0.0/16
176.31.0.0/16
176.31.160.0/22
176.31.176.0/22
176.31.184.0/22
176.31.188.0/22
178.32.0.0/15
178.32.133.0/24
178.32.134.0/24
178.32.135.0/24
188.165.0.0/16
192.95.0.0/18
192.99.0.0/16
198.100.144.0/20
198.245.48.0/20
198.27.64.0/18
198.50.128.0/17
198.50.175.0/24
213.186.32.0/19
213.251.128.0/18

[keyplyr]

OVH is a French company

[keyplyr]

maxihost.com.br
189.1.168.0/21
189.1.168.0 - 189.1.175.255

[keyplyr]

ehostidc.co.kr
103.249.28.0/22
103.249.28.0 - 103.249.31.255

[keyplyr]

Hosting Services
67.213.208.0/20
67.213.208.0 - 67.213.223.255

TulsaConnect
67.214.96.0/20
67.214.96.0 - 67.214.111.255

Colostore.com
67.214.160.0/19
7.214.160.0 - 67.214.191.255

[keyplyr]

This log-spam yielded some interesting info:

89.207.130.*** - - [10/May/2015:03:16:05 -0700] "HEAD /file_name.jpg HTTP/1.1" 403 323 "http://namecheap.com/blah/" "wordpress/2.1.1"
5.104.226.* - - [10/May/2015:03:18:57 -0700] "HEAD /file_namet.jpg HTTP/1.1" 403 323 "http://namecheap.com/blah/" "wordpress/2.1.1"

(blocked because of mal-formed header & UA attribute)

1.) The IPs both belong to :

Snel.com (hosting)
5.104.224.0/21
5.104.224.0 - 5.104.231.255
89.207.128.0/21
89.207.128.0 - 89.207.135.255


2.) The log-spam "namecheap.com" (hosting) but they're a reseller for:

blacklotus.net (hosting)
199.59.160.0/21
199.59.160.0 - 199.59.167.255

Nothing like giving away the store :)

[lucy24]

blacklotus.net (hosting)
199.59.160.0/21
199.59.160.0 - 199.59.167.255

At this point I got curious and did some spot-checking, because 199.59 seems to have an awful lot of almost-185-sized hosting slivers and I was hoping to find an upstream sublet, or at least a generally unsavory neighborhood. No joy, though:

199.59.56.0/21 Hostwinds
but
199.59.48.0/22 and 199.59.52.0/22 not hosting

199.59.88.0/21 MojoHost
but
199.59.80.0/22 and 199.59.84.0/22 not hosting

199.59.148.0/22 Twitter (that's why I recognized 199.59)
but
199.59.144.0/22 not hosting

199.59.160.0/21 blacklotus
but
199.59.168.0/21 not hosting

Darn it.

[keyplyr]

danhost.dk (not a German company)
31.193.237.128/25
31.193.237.128 - 31.193.237.255

SMSHosting.bg
79.98.104.0/21
79.98.104.0 - 79.98.111.255

delta.bg (parent is evolink.com, which I'm not blocking *yet*)
89.252.247.0/24
89.252.247.0 - 89.252.247.255

[mrtonyg]

Google Cloud IPv4:

8.34.208.0/20
8.35.192.0/21
8.35.200.0/23
23.236.48.0/20
23.251.128.0/19
104.154.0.0/15
104.196.0.0/14
107.167.160.0/19
107.178.192.0/18
108.170.192.0/20
108.170.208.0/21
108.170.216.0/22
108.170.220.0/23
108.170.222.0/24
108.59.80.0/20
130.211.128.0/17
130.211.16.0/20
130.211.32.0/19
130.211.4.0/22
130.211.64.0/18
130.211.8.0/21
146.148.16.0/20
146.148.2.0/23
146.148.32.0/19
146.148.4.0/22
146.148.64.0/18
146.148.8.0/21
162.216.148.0/22
162.222.176.0/21
173.255.112.0/20
192.158.28.0/22
199.192.112.0/22
199.223.232.0/22
199.223.236.0/23

[keyplyr]

Google Cloud IPv4:

?

[mrtonyg]

Don't understand the question...please expand.

[keyplyr]

Why are you posting the Google Cloud CIDRs?

[mrtonyg]

I must be missing something, but isn't the whole point of this thread to list IP ranges for server farms?