Amazon IP Ranges

distributed cloud computing

[not2easy]

Does anyone have information on these Amazon ranges ?
Amazon Technologies Inc. AT-88-Z (NET-35-152-0-0-1) 35.152.0.0 - 35.183.255.255
Amazon.com, Inc. AMAZO-ZPDX9 (NET-35-160-0-0-1) 35.160.0.0 - 35.167.255.255

I ask because I am seeing some unwanted non-humanoid activity from 35.160.0.0 - 35.167.255.255 in particular from 35.167.cc.dd and don't have much data on 35. anything to determine whether this is mixed/good bad/whatever.


- - -

[edited by: keyplyr at 8:49 pm (utc) on Jan 12, 2017]
[edit reason] clean-up [/edit]

[keyplyr]

They are Amazon Tech, and could really be anything. I allow a few mobile UAs through 35.152.0.0/13. I also allow a dozen+ bots through both:

35.152.0.0/13
35.152.0.0 - 35.183.255.255

35.160.0.0/12
35.176.0.0/13
35.152.0.0 - 35.183.255.255

What's difficult with Cloud computing is it is distributed over various server nodes within the range(s) which could have been registered at different times, then assigned or moved to different servers, so I've seen some of the same UAs come from AWS, Tech & Inc.

I categorically block all Amazon ranges, allowing exceptions for beneficial UAs. But if they are pretending to be desktop human, I block them. If they are flying a mobile UA, I research to see if there is a mobile app, mobile ISP or gateway (tunnel) assigned to that sub-range and if so, allow an exception but sometimes it's difficult to determine this.

[not2easy]

Thanks, keyplyr. I will need to keep an eye on this to have a better picture of what's coming though there.

[not2easy]

Great. Now it's worse:
34.192.0.0/10
34.192.0.0 - 34.255.255.255
Amazon Technologies Inc. (AT-88-Z)

[keyplyr]

Yes not2easy. dstiles reported that range last week [webmasterworld.com...]

As mentioned above, with cloud computing, often times the same UA may come from various ranges controlled by the same server farm.

[keyplyr]

Here's my current IP list* of Amazon (Tech, Inc & AWS) properties:

23.20.0.0/14
23.20.0.0 - 23.23.255.255

34.192.0.0/10
34.192.0.0 - 34.255.255.255

35.152.0.0/13
35.152.0.0 - 35.183.255.255

35.160.0.0/12, 35.176.0.0/13
35.152.0.0 - 35.183.255.255

46.51.128.0/17
46.51.128.0-46.51.255.255

46.137.0.0/16
46.137.0.0 - 46.137.255.255

50.16.0.0/14
50.16.0.0 - 50.19.255.255

50.112.0.0/16
50.112.0.0 - 50.112.255.255

52.32.0.0/11
52.32.0.0 - 52.63.255.255

52.64.0.0/11
52.64.0.0 - 52.95.255.255

52.192.0.0/11
52.192.0.0 - 52.223.255.255

54.72.0.0/13
54.72.0.0 - 54.95.255.255

54.80.0.0/12
54.72.0.0 - 54.95.255.255

54.144.0.0/12
54.144.0.0 - 54.159.255.255

54.160.0.0/11
54.160.0.0 - 54.191.255.255

54.192.0.0/10
54.192.0.0 - 54.255.255.255

54.210.0.0/15
54.210.0.0 - 54.211.255.255

54.212.0.0/15
54.212.0.0 - 54.213.255.255

54.221.0.0/16
54.221.0.0 - 54.221.255.255

54.224.0.0/12
54.224.0.0 - 54.239.255.255

54.253.0.0/16
54.253.0.0 - 54.253.255.255

67.202.0.0/18
67.202.0.0 - 67.202.63.255

72.21.192.0/19
72.21.192.0 - 72.21.223.255

72.44.32.0/19
72.44.32.0 - 72.44.63.255

75.101.128.0/17
75.101.128.0 - 75.101.255.255

79.125.0.0/18
79.125.0.0 - 79.125.63.255

87.238.80.0/21
87.238.80.0 - 87.238.81.255

87.238.84.0/23
87.238.84.0 - 87.238.85.255

103.4.8.0/21
103.4.8.0 - 103.4.15.255

107.20.0.0/14
107.20.0.0 - 107.23.255.255

122.248.192.0/18
122.248.192.0 - 122.248.223.255

156.154.64.0/22
156.154.64.0- 156.154.67.255

156.154.68.0/23
156.154.68.0- 156.154.69.255

174.129.0.0/16
174.129.0.0 - 174.129.255.255

175.41.128.0/18
175.41.128.0 - 175.41.159.255

175.41.192.0/18
175.41.192.0 - 175.41.223.255

175.41.224.0/19
175.41.224.0 - 175.41.255.255

176.32.64.0/19
176.32.64.0 - 176.32.95.255

176.34.0.0/16
176.34.0.0 - 176.34.255.255

178.236.0.0/20
178.236.0.0 - 178.236.15.255

184.72.0.0/15
184.72.0.0 - 184.73.255.255

184.169.128.0/17
184.169.128.0 - 184.169.255.255

185.48.120.0/22
185.48.120.0 - 185.48.123.255

204.236.128.0/17
204.236.128.0 - 204.236.255.255

216.182.224.0/20
216.182.224.0 - 216.182.239.255

* There may be a few I missed. I didn't have access to my master list.

[dstiles]

I would disagree with the ranges 156.154.64.0/22 and 156.154.68.0/23 which I have as part of NeuStar range 156.154.0.0 - 156.154.255.255 (banned).

I currently have 41 Amazon ranges, all banned but with loopholes for...

http/1.1_silk
FlipboardProxy
(iPhone;
(iPad;
Mobicip/

I make no distinction between the different "classes" of Amazon ranges.

8.18.144.0 - 8.18.145.255
23.20.0.0 - 23.23.255.255
27.0.0.0 - 27.0.3.255
34.192.0.0 - 34.255.255.255
35.152.0.0 - 35.183.255.255
46.51.128.0 - 46.51.255.255
46.137.0.0 - 46.137.255.255
50.16.0.0 - 50.19.255.255
50.112.0.0 - 50.112.255.255
52.0.0.0 - 52.31.255.255
52.32.0.0 - 52.63.255.255
52.64.0.0 - 52.95.255.255
52.192.0.0 - 52.223.255.255
54.64.0.0 - 54.95.255.255
54.144.0.0 - 54.221.255.255
54.224.0.0 - 54.255.255.255
67.202.0.0 - 67.202.63.255
72.21.192.0 - 72.21.223.255
72.44.32.0 - 72.44.63.255
75.101.128.0 - 75.101.255.255
79.125.0.0 - 79.125.127.255
87.238.80.0 - 87.238.87.255
96.127.0.0 - 96.127.127.255
103.4.8.0 - 103.4.15.255
103.21.240.0 - 103.21.243.255
107.20.0.0 - 107.23.255.255
122.248.192.0 - 122.248.255.255
174.129.0.0 - 174.129.255.255
175.41.128.0 - 175.41.255.255
176.32.64.0 - 176.32.127.255
176.34.0.0 - 176.34.255.255
177.71.128.0 - 177.71.255.255
178.236.0.0 - 178.236.15.255
184.72.0.0 - 184.73.255.255
184.169.128.0 - 184.169.255.255
185.48.120.0 - 185.48.123.255
199.255.192.0 - 199.255.195.255
204.236.128.0 - 204.236.255.255
205.251.192.0 - 205.251.255.255
207.171.160.0 - 207.171.191.255
216.182.224.0 - 216.182.239.255

[keyplyr]

I would disagree with the ranges 156.154.64.0/22 and 156.154.68.0/23 which I have as part of NeuStar range.

Thanks for the update.

neustar.biz
156.154.0.0 - 156.154.255.255
156.154.0.0/16

[keyplyr]

About a year ago, daily blank UA hits started from 52.64//11, so many that I complained to AWS.

In their jaded perspective, they replied "so what's problem?"

I attached a log snippet of a couple hundred hits from my logs, saying "besides the fact I block Amazon, they are using a blank UA. In order to gain access to my server, there needs to be something in the UA string."

Yup, you guessed it... they now continue to hit my server using "something" as the UA.

[dstiles]

Another AMAZON range hit me today, claims to be Japanese...

13.112.0.0 - 13.115.255.255
13.112.0.0/14

[keyplyr]

Amazon has been offering 1 year free EC2 tier plus software for new customers so activity from AWS ranges is likely to increase.

[aristotle]

From keyplyr 's list:
54.210.0.0/15
54.210.0.0 - 54.211.255.255

Is that the location of the cloud storage for the Firefox "Pocket" ?

[keyplyr]

Dunno, can't remember. I rarely see it anymore. I looked and it hasn't been in my logs this year.

[smilie]

Just like @dstiles, I make no distinction , all Amazon crap IPs go to blocked bin.

Including Amazon internals. Which , a funny thing, Amazon devs called me about, as it turned out I was blocking their products checking bot.

Dudes, your AWS is causing a havock and destroying a business. AWS spambots at one point nearly brought down the server. You want your specific bot hit my server for legitimate reasons? Don't use your own cloud, it's a cesspool.

Startups should really reconsider their business plan if it relies on a bot from Amazon's cloud.

[keyplyr]

@smilie - just because we list Amazon and other server ranges in these forums does not in itself indicate these ranges be blocked. We are only identifying ranges, not making judgements.

There are dozens of beneficial bots coming from Amazon ranges. Each site owner makes that distinction and allows these exceptions in their blocking schema.

There are also humans coming from Amazon ranges. There is also app traffic (humans) coming from several Amazon ranges.

If you do choose to block an Amazon server range without prejudice, it is highly recommended to maintain a diligent watch on your server logs to see just what/who is really being blocked.

[keyplyr]

From keyplyr 's list:
54.210.0.0/15
54.210.0.0 - 54.211.255.255

Is that the location of the cloud storage for the Firefox "Pocket" ?

@aristotle - Don't know if this is the "Firefox" version, but this is the first time I've seen any "pocket" this year...

54.145.189.216 - - [24/Feb/2017:23:05:03 -0800] "GET /example.html HTTP/1.1" 403 4773 "-" "PocketParser/2.0 (+https://getpocket.com/pocketparser_ua)" 

So the AWS range would be:
54.144.0.0 - 54.159.255.255
54.144.0.0/12

However, clouds being clouds, I wouldn't be too surprised if this UA came from more AWS nodes.