Server Farms - January 2016

Continuation of the discussion of hosting company IP ranges

[incrediBILL]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Nov 2015 [webmasterworld.com...]
  
  
• Jul 2015 [webmasterworld.com...]
  
  
• Feb 2015 [webmasterworld.com...]
  
  
• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[blend27]

MyServerPlanet ltd
United Kingdom

185.120.12.0/24
185.120.12.0 - 185.120.12.255 - just registered, already got a scraper on it

There are more here: [bgp.he.net...]

[keyplyr]

vads.com hosting
202.75.32.0 - 202.75.63.255
202.75.32.0/19

[keyplyr]

positive-internet.com
80.87.128.0 - 80.87.143.255
80.87.128.0/20

[keyplyr]

Seodedic
46.161.9.0 - 46.161.9.255
46.161.9.0/24

They do have other ranges, some registered outside Russia

[blend27]

Zenlayer
107.151.128.0 - 107.151.191.255
107.151.128.0/22

[blend27]

BIZNES-HOST.PL
91.196.48.0 - 91.196.51.255
91.196.48.0/22 -- rolls under EURONET which is an ISP.

[keyplyr]

And on the other side of Zenlayer...


VpsQuan
07.151.192.0 - 107.151.255.255
107.151.192.0/18

[keyplyr]

Correction: 107.151.192.0 - 107.151.255.255

[wilderness]

VpsQuan
VpsQuan L.L.C. VPSQUAN-3 23.251.32.0 - 23.251.63.255
kangguohua VPSQUAN-3-742 23.251.55.16 - 23.251.55.23
107.151.192.0 - 107.151.255.255 VPSQUAN-4 107.151.192.0/18
198.44.160.0 - 198.44.191.255 VPSQUAN-2 198.44.160.0/19
23.251.32.0 - 23.251.63.255 VPSQUAN-3 23.251.32.0/19
69.165.64.0 - 69.165.79.255 VPSQUAN-LA1 69.165.64.0/22

ZenLayer (just a month ago was named C3Network
Zenlayer Inc (CN-51) C3-TTT-001 107.151.128.0 - 107.151.191.255
C3-CSC-001 107.150.96.0 - 107.150.127.255 107.150.96.0/19
C3-TTT-001 107.151.128.0 - 107.151.191.255 107.151.128.0/18
C3NET-4 107.155.0.0 - 107.155.63.255 107.155.0.0/18
C3-CSC-001 162.221.192.0 - 162.221.199.255 162.221.192.0/21
C3-CSC-001 162.221.4.0 - 162.221.7.255 162.221.4.0/22
C3NET 192.254.80.0 - 192.254.95.255 192.254.80.0/20
CC-005 199.190.44.0 - 199.190.47.255 199.190.44.0/22
C3-CSC-001 199.245.56.0 - 199.245.63.255 199.245.56.0/21
CC-004 199.91.72.0 - 199.91.75.255 199.91.72.0/22
C3-IMG-001 208.81.200.0 - 208.81.203.255 208.81.200.0/22
CC-003 209.177.80.0 - 209.177.95.255 209.177.80.0/20
C3-CSC-001 23.236.96.0 - 23.236.111.255 23.236.96.0/20
C3NET-2 23.236.112.0 - 23.236.127.255 23.236.112.0/20
C3-TTT-002 23.248.160.0 - 23.248.191.255 23.248.160.0/19
ZL-ECN-001 23.251.96.0 - 23.251.127.255 23.251.96.0/19
C3-TTT-003 23.91.96.0 - 23.91.111.255 23.91.96.0/20
CC-002 65.255.32.0 - 65.255.47.255 65.255.32.0/20
CC-001 69.28.48.0 - 69.28.63.255 69.28.48.0/20
C3-TTT-00V6 2602:FFE4:: - 2602:FFE4:FFF:FFFF:FFFF:FFFF:FFFF:FFFF
C3-CSC-IPV6 2604:980:: - 2604:980:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
CC-V6-006 2607:A400:: - 2607:A400:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF

[blend27]

XT GLOBAL NETWORKS LTD.
86.106.16.0 - 86.106.19.255
86.106.16.0/22

[keyplyr]

RE: xtglobal.vg - funny, photos they use on their home page are stock images used at other server farms.

[blend27]

I think Lucy is much funnier than xtglobal, IMHO. There was another range mentioned here: [webmasterworld.com...]

[keyplyr]

Lucy is much funnier than xtglobal

I've always believed that.

[System]

The following 6 messages were cut out to new thread by keyplyr. New thread at: search_engine_spiders/4794903.htm [webmasterworld.com]
5:05 pm on Mar 7, 2016 (UTC -8)

[keyplyr]

ignum.cz (Serverhosting farm in Prague)
217.31.48.0 - 217.31.63.255
217.31.48.0/20

[blend27]

This range is new to my records:

OVH Hosting, Inc.
149.56.0.0 - 149.56.255.255
149.56.0.0/16

[dstiles]

Nice catch! Thanks. :)

[blend27]

Chuck Norris does not sleep, he waits!

[keyplyr]

RE: 149.56/16 Looks like a lot of it is allocated to private customers (DSL) at least the upper ranges so be prepared to poke holes :)

[dstiles]

Another OVH found today - last modified DNS last December. Used to be Italian infostrada DSL.

164.132.0.0 - 164.132.255.255
164.132.0.0/16

Activity so far: 6 hits, yesterday/today, on 164.132.161.0/24 from AhrefsBot...

Mozilla/5.0 (compatible; AhrefsBot/5.0; +http:[//]ahrefs.com/robot/)
([] inserted by me)

keyplyr: Random samples on rDNS show (eg) dns10.ovh.ca which is indicative of hosted IPs; plus the DNS lookup shows OrgName: OVH Hosting, Inc. You may be right but for now I for one am blocking the evil (fill in epithet).

[keyplyr]

@dstles- I think there can be discrepancies between look-up services. Some just don't give the complete picture.

While all of 149.56/16 is OVH, 149.56/28 is a private residential DSL customer of OVH (I had a few hits and they validate as human.) There are lots of these in the upper end of 149.56/16. So while I do block 149.56/16, I allow conditions. Of course you may never see anyone from there :)

Thanks for the 164.132/16

[keyplyr]

Has anyone seen bad activity coming from?
gogrid.com
164.40.128.0 - 164.40.159.255
164.40.128.0/19

(And yes, I realize they have about 20 ranges around the globe)

[dstiles]

I've had the range blocked since 2012 so someone probably annoyed me. In whois as NL but with a San Francisco address.

[dstiles]

Another Amazon and 2 Microsofts...

52.192.0.0 - 52.223.255.255
52.192.0.0/11
AT-88-Z

52.145.0.0 - 52.191.255.255
52.160.0.0/11, 52.145.0.0/16, 52.152.0.0/13, 52.146.0.0/15, 52.148.0.0/14
MSFT

52.224.0.0 - 52.255.255.255
52.224.0.0/11
MSFT

[lucy24]

52.145.0.0 - 52.191.255.255

This seemed so improbable that I went and looked it up. In fact it's even improbabler. Starting from 52.96-255 which I'd previously had marked as DuPont (the original owners of the whole /8):

52.96-115 Microsoft
52.96.0.0/12
52.112.0.0/14

52.116-118 SoftLayer
52.116.0.0/15
52.118.0.0/16

52.119 (still) DuPont

52.120-123 Microsoft
52.120.0.0/14

52.124.0-59 mixed
52.124.60-255 DuPont

52.125-127 Microsoft
52.125.0.0/16
52.126.0.0/15

52.128.0-127 various
52.128.128-255 DuPont

52.129.0-37 various smaller entities, some of which may be human
52.129.38-255 DuPont

52.130-144 (still) DuPont

.. and that's where we came in.

[dstiles]

Thanks for the extras, Lucy. I've added the MS and Softlayer ones but left the others until they "attack" me. :)

[blend27]

GleSYS Internet Services AB
109.74.0.0 - 109.74.15.255
109.74.0.0/20

There is more: [bgp.he.net...]

[blend27]

OPENFACE Inc
207.115.96.0 - 207.115.111.255
207.115.96.0/20

207.115.107.7 is part of a "CHANGELOG.txt & readme.html" botnet that is sending IP:80 as a host header.

[blend27]

HostHatch-Inc.

A lot of these ranges are maintained by PORTLANE, which has other smaller /24 assigned to other hosting "companies"

31.220.4.0 - 31.220.7.0
31.220.4.0/24,31.220.5.0/24,31.220.6.0/24,31.220.7.0/24

31.220.42.0 - 31.220.44.0
31.220.42.0/24,31.220.43.0/24,31.220.44.0/24

31.220.30.0 - 31.220.31.255
31.220.30.0/24,31.220.31.0/24

31.220.15.0 - 31.220.15.255
31.220.15.0/24

31.187.76.0 - 31.187.76.255
31.187.76.0/24

31.187.64.0 - 31.187.64.255
31.187.64.0/24

176.126.84.0 - 176.126.85.0
176.126.84.0/24,176.126.85.0/24

176.126.68.0 - 176.126.72.0
176.126.72.0/24,176.126.71.0/24,176.126.70.0/24,176.126.69.0/24

176.126.65.0 - 176.126.65.255
176.126.65.0/24

[keyplyr]

Thanks blend27 I didn't have a couple of those ranges, however some need correction.

HostHatch should be:
31.220.4.0 - 31.220.7.255
31.220.4.0/22

HostHatch should be:
31.220.40.0 - 31.220.43.255
31.220.40.0/22

HostHatch should be:
31.220.44.0 - 31.220.45.255
31.220.44.0/23

HostHatch should be:
31.220.30.0 - 31.220.31.255
31.220.30.0/23

HostHatch should be:
176.126.84.0 - 176.126.85.255
176.126.84.0/23

HostHatch should be:
176.126.68.0 - 176.126.72.255
176.126.68.0/22, 176.126.72.0/24