Server Farms - Jan 2018

Continuing discussion of hosting company IP ranges

[keyplyr]

Continuation of the Server Farm threads.

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Jan 2017 [webmasterworld.com...]
  
  
• June 2016 [webmasterworld.com...]
  
  
• Jan 2016 [webmasterworld.com...]
  
  
• Nov 2015 [webmasterworld.com...]
  
  
• Jul 2015 [webmasterworld.com...]
  
  
• Feb 2015 [webmasterworld.com...]
  
  
• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[keyplyr]

Omeuhost.com.br (formerly netrouting.net)

199.71.232.0/22
199.71.232.0 - 199.71.235.255

- - -

netrouting.net Cloud Hosting

208.76.52.0 - 208.76.55.255
208.76.52.0/22

[keyplyr]

online.net dedi servers & cloud hosting
51.15.0.0 - 51.15.255.255
51.15.0.0/16

[keyplyr]

servebyte.com
185.104.216.0 - 185.104.219.255
185.104.216.0/22

[keyplyr]

a2hosting.com

66.198.240.0 - 66.198.255.255
66.198.240.0/20

75.98.160.0 - 75.98.175.255
75.98.160.0/20

[thetrasher]

Amazon Technologies
3.0.0.0 - 3.63.255.255
3.0.0.0/10

[keyplyr]

Good find thetrasher.

Very recently registered: 2017-12-20

[keyplyr]

nine.ch

5.148.160.0 - 5.148.191.255
5.148.160.0/19

178.209.32.0 - 178.209.63.255
178.209.32.0/19

[keyplyr]

multacom.com
173.82.0.0 - 173.82.255.255
173.82.0.0/16

[keyplyr]

IT One, Thailand
202.183.207.0 - 202.183.207.255
202.183.207.0/24

Not specifically a server farm, but the source of several bot runners.

[blend27]

SzerverPlex.hu KFT - Hungary
37.17.172.0 - 37.17.172.255
37.17.172.0/24

scrape attempts

added: they have more ranges as it seems(sorry gotta run):

79.172.210.0/24
79.172.212.0/24
87.229.77.0/24

[keyplyr]

Thanks blend27, here's what I have...

37.17.172.0/23 #szerverplex.hu 37.17.172.0 - 37.17.173.255 *
79.172.192.0/18 #deninet.hu 79.172.192.0 - 79.172.255.255 **
87.229.64.0/20 #deninet.hu 87.229.64.0 - 87.229.79.255 **

* combined an additional szerverplex.hu /24 range
** deninet.hu (a larger server farm) leases a couple of those above ranges to szerverplex.hu

[blend27]

Avguro Technologies - .RU
81.177.135.0 - 81.177.135.255
81.177.135.0/24

....part of a larger .RU range - 81.177.128.0/19 which I just got Spammed from.

[keyplyr]

Thanks for Avguro

I don't block rtcomm.ru...
81.176.0.0 - 81.177.255.255
81.176.0.0/15

...because of a couple residential ISPs (example: Sochitelecom)

[blend27]

rtcomm also acts as an ISP for businesses, so no, not the entire /15, just the bad actors on some sites. On other sites entire RIPE is nuked, but the request data is still collected :).

[keyplyr]

InternetBolaget Hosting (internetvikings.com)
80.248.224.0 - 80.248.239.255
80.248.224.0/20

[blend27]

TERRAHOST NO
185.125.168.0 - 185.125.169.255
185.125.168.0/22

185.181.60.0 - 185.181.63.255
185.181.60.0/22


Don't they have enough Gold Medals already? :).

Now they need Thumbnails - request came and got blocked from the first 22 above - server-18.thumbnail.ws..

[blend27]

New to me:

SERVERIUS/3NT
37.252.14.0 - 37.252.15.255
37.252.14.0/23

Bunch of requests from 37.252.14.nnn with a plain vanilla Googlebot UA.

[blend27]

New OVH range (for me)

54.36.0.0 - 54.38.255.255
54.37.0.0/16

[not2easy]

New for me as well, thanks blend27! but that CIDR only covers 54.37.0.0 - 54.38.255.255 - is the 54.36.0.0 - 54.38.255.255 range a typo?

[keyplyr]

@not2easy - the entire /16 is indeed OVH

Some look-up tools are better than others... some better for some regions... or some may not update their info often enough... and ranges get expanded, sold, repurposed, etc.

If you see only a partial range listed, often you can discover the full range by testing one or two sub-levels up or down. Sometimes the way these ranges are listed are because of the way they were leased or expanded.

My current favorite online look-up tool is: DomainDossier [centralops.net]

[not2easy]

I can see that the entire 54.37.0.0/16 range is OVH, my question was about the listing of 54.36.0.0 as the beginning of it with only a /16 to go from 54.36.0.0 o 54.38.255.255

I did a lookup on the range excluded from that CIDR and it seems that is also OVH but not included in that 54.37.0.0/16 CIDR - it would need a separate 54.36.0.0/16 to go with 54.37.0.0/16

My quick choice is the Network Tools built in to OSX. Occasionally I need an outside check for sub-ranges.

[keyplyr]

Ahh.. I see, sorry not2easy.

So when I looked, I saw even a broader OVH net block of:

54.36.0.0 - 54.36.255.255
54.36.0.0/16
54.37.0.0 - 54.37.255.255
54.37.0.0/16
54.38.0.0 - 54.38.255.255
54.38.0.0/16
54.39.0.0 - 54.39.255.255
54.39.0.0/16

which can be reduced to:
54.36.0.0 - 54.39.255.255
54.36.0.0/14

Note: there are hundreds of private customer accounts, small companies, and who knows what else in there so if blocking without prejudice, keep a close watch of what exactly gets blocked.

[blend27]

@not2easy, yep - a typo, thanks for catching it.

here we go, something new!

DEDFIBERCO (on top of a boogie-down ColoCrossing)
104.237.224.0 - 104.237.255.255
104.237.224.0/19

2 requests from 2 separate /24s within, hours a part. Both claimed to be Firefox 27. That's an Old Fox, I mean the tail would probably be fur-less at that point and with one eye blindness. e.g - short on headers.

[blend27]

DATACLUB(LV)
46.183.216.0 - 46.183.218.255
46.183.216.0/21

also:
84.38.130.0 - 84.38.135.255

[blend27]

Another new OVH Range for me:

217.182.0.0 - 217.182.255.255
217.182.0.0/16

[keyplyr]

I have that dataclub.me as:
84.38.128.0 - 84.38.135.255
84.38.128.0/21

Thanks for the new OVH

[blend27]

JUST FYI
One note on that OVH range above: 217.182.0.0/16

I had 2 hits from the same IP from that range. One with

Mozilla/5.0 (Windows NT 6.1; Win64; x64; +https://www.ubtsupport.com/legal/Streamline3Bot.php) Streamline3Bot/1.0

and about 3 minutes later with:

M

That is it, just M.

I took a look at some other things and it looks like it was a valid request from Streamline3Bot. RDNS pointed to crawler.classify.ubtsupport.com.

UBT provides a classification service for public websites based on their content. To classify your website, we use the Streamline3Bot to crawl the web on a daily basis.

Seems like a classification service/site-content filtering for Home and Businesses.

The bot info could be found at URL in UA. The IP listed on that page is the same IP that accessed(well, they tried ;)) on of my sites. and NO they did not for robots.txt

[blend27]

VPS.net Cloud Services
185.225.208.0 - 185.225.211.255
185.225.208.0/22

'A=0 - sql injection attempts/probing from 185.225.208.xx.

I have been blocking these for over a decade now on a single site. Not sure at this point why it is singled out. Way back when REAL BingBot was attempting to crawl similar URLs it was a nuisance. But for whatever gives it has been a reminder that deep-down dark web there is a list of URIs to crawl.

-------------------------------------------------------
and the I did a search for 'A=0 on Goog for WebmasterWorld site because I've been talikg about this issue forever and one thread popped-up(totally OT btw but those were the days): [webmasterworld.com...]

[keyplyr]

VPS.net Cloud Services belongs to uk2group.com

Here's what I have for uk2group.com:

67.213.208.0/20
67.213.208.0 - 67.213.223.255

68.169.32.0/20
68.169.32.0 - 68.169.47.255

91.109.240.0/21
91.109.240.0 - 91.109.247.255

185.225.208.0/22
185.225.208.0 - 185.225.211.255