Server Farms - January 2016

Continuation of the discussion of hosting company IP ranges

[incrediBILL]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Nov 2015 [webmasterworld.com...]
  
  
• Jul 2015 [webmasterworld.com...]
  
  
• Feb 2015 [webmasterworld.com...]
  
  
• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[keyplyr]

ihsystem.com
66.235.214.0/24
66.235.214.0 - 66.235.214.255
72.22.68.0/24
72.22.68.0 - 72.22.68.255

[keyplyr]

Zitcom
94.231.96.0/20
94.231.96.0 - 94.231.111.255

[keyplyr]

ht-systems.ru (AKA JSC Hosting Telesystems)
78.110.48.0/20
78.110.48.0 - 78.110.55.255

[keyplyr]

vultr.com
104.207.144.0/23
104.207.144.0 - 104.207.145.255

[keyplyr]

myLoc.de
5.199.128.0 - 5.199.142.255
5.199.128.0/20
81.30.144.0 - 81.30.159.255
81.30.144.0/20
89.163.224.0 - 89.163.255.255
89.163.224.0/19
193.111.136.0 - 193.111.143.255
193.111.136.0/21

[lucy24]

New to me, though it may have cropped up earlier.
37.16.0.0/19
mijndomein.nl *
Snippet says "de grootste hoster van Nederland!" which is all we need to know. (Truth or untruth is happily irrelevant.)

Elsewhere:
185.86.76.0/22
I do believe this is that rarity, a Ukrainian server farm.


* Go ahead. TRY typing that in without having to go back and fix the spelling of "domein" thanks to your English-biased fingers on autopilot.

[lucy24]

And further elsewhere, time having elapsed:
185.84.108.0/22
Russia, Majordomo. Free lookup says "948 websites use this address".

[keyplyr]

Up from 947?

[Martin Ice Web]

Does someone knows something about 38.96 range?

It is calling it self as iphone, Mozilla, safari aso.

[keyplyr]

RE: 38.96

Difficult to get info on cogentco.com
38.0.0.0 - 38.255.255.255
38.0.0.0/8

Takes up a huge chunk of the North Eastern seaboard of the US. Could be anything from a valid ISP to a server farm. You'd probably need to consider more info like Header and behavior.

[Martin Ice Web]

@ keyplyr,

thanx, yes behaviour seems like human but a closer look makes it look as a server bot farm.
So it gets one page on 38.96.251.* and the next referring page frompage 1 from 38.96.255.*
It comes form no refferer. Just one or two hits for 10 minutes.
We are located in germany. So users shouldn´t come from US?!

I blocked the whole range now.

[wilderness]

The entire Class A (38) is PSI-Net (formerly Cogent, and formerly Performance Systems International).

I've had to make one exception (single Class C) for a valid user/acquaintance, which is a network his employer uses.

[Martin Ice Web]

@wilderness, it does not seem to be a classic telecommunication provider?! You know something about them?

[keyplyr]

Lots of broadband in there. IMO it's not a good move to block by IP for the Cogentco ranges. Use other methods to block the bots.

[wilderness]

@wilderness, it does not seem to be a classic telecommunication provider?! You know something about them?

Martin,
My sites have more denies than most sites. My topics are highly focused and non-profit.
Almost nobody should duplicate my master-plan (for lack of another word).

We are located in germany. So users shouldn´t come from US?!

My sites are just the opposite and deny most non-US visitors (have for more than a decade), however I've even heavy restrictions for US IP's.

[lucy24]

So it gets one page on 38.96.251.* and the next referring page from page 1 from 38.96.255.*
It comes form no referer. Just one or two hits for 10 minutes.

Although rare, you do get legitimate human visitors where not just the ddd (1.2.3.d) but the ccc (1.2.c.d) changes from one request to the next. Plays havoc with my own log-wrangling ;) If they get all supporting files including the favicon, you kinda have to assume they're human.

And there are many ways not to send a referer.

[dstiles]

Microsoft Brazil has recently begun sending around msnbot. I ran a DNS scan ot the IP range the first couple of bots came in on and was surprised at the extent of the bot's IPs. The following covers ranges where I found at least several msnbots; I think all /24 ranges in those ranges had at least a few missing. The gaps between the noted ranges may be reserved for future use by msnbot. I have enabled the full /16 for the bots, though blocking them for other use. It's possible there are other bot ranges within the 191.232.0.0/13 range - I haven't checked.

191.232.40.0 - 191.232.42.255
191.232.44.0 - 191.232.79.255
191.232.128.0 - 191.232.139.255
191.232.144.0 - 191.232.199.255

[lucy24]

Microsoft Brazil has recently begun sending around msnbot.

Where the bingbot goes, the msnbot will follow.

[webmasterworld.com...]

Now, if only someone could figure out why they need to crawl from Brazil...

[dstiles]

Bingbot, of course, if you're checking UAs. Msnbot for DNS. :)

[keyplyr]

if only someone could figure out why they need to crawl from Brazil...

Like Ireland in the Eastern hemisphere, Brazil in the West offers low taxes & cheap bandwidth to attract business investments.

[dstiles]

New hetzner range:

138.201.0.0/16
created: 1970-01-01 (which I do not believe!)
last-modified: 2015-05-05

[lucy24]

created: 1970-01-01 (which I do not believe!)

Isn't the default when-the-database-breaks-and-we-have-to-make-something-up date 1969/12/31?

I got curious and checked my computer. Buncha stuff claims to have been created on various dates in 1990, meaning that I've been dutifully moving them from one Mac to another ever since. Fonts, mostly, no surprise.

[keyplyr]

created: 1970-01-01

That's pre Al Gore!

[keyplyr]

Combined...
74.63.0.0 - 74.63.255.255
74.63.0.0/16

LightPoint
74.63.0.0 - 74.63.15.255
74.63.0.0/20
WoodyNet
74.63.16.0 - 74.63.31.255
74.63.16.0/20
Voxel
74.63.32.0 - 74.63.63.255
74.63.32.0/19
FDCservers
74.63.64.0 - 74.63.127.255
74.63.64.0/18
Viawest
74.63.128.0 - 74.63.191.255
74.63.128.0/18
Limestone
74.63.192.0 - 74.63.255.255
74.63.192.0/18

[blend27]

Netinternet - Turkey
95.173.160.0 - 95.173.191.255 (combined - many 24s within)

95.173.184.66 - 66uugv8t.ni.net.tr.
2 hits - 2 UAs:
UA1: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
UA2: PHP/5.4.45

When will the learn?

[lucy24]

New to me, though not new in the broader scale of things:
72.22.192.0/20
Vazio Network Services, LLC
Google snippet says, quote, “Vazio Network Services provides web hosting solutions for the basic user, enterprise business, and everyone in between.” Said hosting includes repeated snuffling around a recent ebook with a highly plausible Opera/9.80 UA. (IP is not in Russia.)

Y'know, robots, all you have to do is ask. It makes all the difference.

[keyplyr]

Caught this "whale" doing mischeif:

version-next.com
199.191.58.196/30
199.191.58.196 - 199.191.58.199

[keyplyr]

virtela.net
64.254.96.0 - 64.254.127.255
64.254.96.0/19

Enterprise cloud services but could possibly bring employee traffic

[keyplyr]

privatesystems.net
207.7.80.0/21
207.7.80.0 - 207.7.87.255