Server Farms June 2020

Continuing discussion of hosting company IP ranges

[not2easy]

This is where we report data center IP ranges as they are discovered or change in the rapidly evolving assigned IP landscape.

Past server farm threads:

• Jan 2020 [webmasterworld.com...]
  
  
• Jul 2018 [webmasterworld.com...]
  
  
• Jan 2018 [webmasterworld.com...]
  
  
• Jan 2017 [webmasterworld.com...]
  
  
• June 2016 [webmasterworld.com...]
  
  
• Jan 2016 [webmasterworld.com...]
  
  
• Nov 2015 [webmasterworld.com...]
  
  
• Jul 2015 [webmasterworld.com...]
  
  
• Feb 2015 [webmasterworld.com...]
  
  
• Aug 2014 [webmasterworld.com...]
  
  
• Apr 2014 [webmasterworld.com...]
  
  
• Feb 2014 [webmasterworld.com...]
  
  
• Sep 2013 [webmasterworld.com...]
  
  
• May 2013 [webmasterworld.com...]
  
  
• Mar 2013 [webmasterworld.com...]
  
  
• May 2012 [webmasterworld.com...]
  

[not2easy]

Starting off with VELIANET-FR-GUANGZHOU
134.119.207.104 - 134.119.207.105
134.119.192.0/19
AS29066

Velia.net has been posted previously from other ranges: [webmasterworld.com...]
and [webmasterworld.com...]

[blend27]

large range here:
ONLINESAS - SCALEWAY
51.158.0.0 - 51.158.255.255
51.158.0.0/15

[not2easy]

New today, another Dreamhost range:
173.236.128.0 - 173.236.255.255
173.236.128.0/17

In the past Dreamhost shows up rarely but I have 3 new (various humanoid scrapers or scripts) bots so far this year. Some of these have been posted here in the past, some not. This is my list, the first one is from 2017:
64.111.96.0 - 64.111.127.255
64.111.96.0/19

208.113.128.0 - 208.113.255.255
208.113.128.0/17

67.205.0.0 - 67.205.63.255
67.205.0.0/18

69.163.128.0 - 69.163.255.255
69.163.128.0/17

64.90.32.0 - 64.90.63.255
64.90.32.0/19

173.236.128.0 - 173.236.255.255
173.236.128.0/17

[blend27]

My List, but there might be more...

DREAMHOST-BLK10
64.90.32.0 - 64.90.63.255
64.90.32.0/19

DREAMHOST-BLK4
64.111.96.0 - 64.111.127.255
64.111.96.0/19

DREAMHOST-BLK1
66.33.192.0 - 66.33.223.255
66.33.192.0/19

DREAMHOST-BLK7
67.205.0.0 - 67.205.63.255
67.205.0.0/18

DREAMHOST-BLK9 - this one is from 2007-03-23 at 19:23:03
69.163.128.0 - 69.163.255.255
69.163.128.0/17

DREAMHOST-BLK8
75.119.192.0 - 75.119.223.255
75.119.192.0/19

DREAMHOST-BLK9
107.180.224.0 - 107.180.255.255
107.180.224.0/19

DREAMHOST-BLK10
173.236.128.0 - 173.236.255.255
173.236.128.0/17

DREAMHOST-BLK3
205.196.208.0 - 205.196.223.255
205.196.208.0/20

DREAMHOST-BLK5
208.97.128.0 - 208.97.191.255
208.97.128.0/18

DREAMHOST-BLK6
208.113.128.0 - 208.113.255.255
208.113.128.0/17

[not2easy]

A DIGITALOCEAN server I did not have reason to block before today:
134.122.0.0 - 134.122.127.255
134.122.0.0/17

AS14061

[not2easy]

And another:
DIGITALOCEAN Simple Cloud Hosting (Direct Allocation)
174.138.0.0 - 174.138.127.255
174.138.0.0/17

AS14061
This was a scripted bot trying out WP exploits, UA: "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0" and what made it stand out was a sequence of exploits from various IPs (including Amazon: 52.64.0.0/11 and OVH: 94.23.0.0/16)

[not2easy]

New UCE supplier range(s): B2NETSOLUTIONS 209.127.0.0 - 209.127.138.255
for inconvenience, broken into bitty pieces..

209.127.0.0 - 209.127.127.255
209.127.0.0/17

209.127.128.0 - 209.127.135.255
209.127.128.0/21

209.127.136.0 - 209.127.137.255
209.127.136.0/23

209.127.138.0 - 209.127.138.255
209.127.138.0/24

[blend27]

trabia network, MD(they have some really excellent grapes there)

178.175.128.0/19
178.175.128.0 - 178.175.191.255

there are more ranges out there, first dirty one so far.

makes sense to include AS43289 ah...

[blend27]

Liteserver Holding B.V.

150.129.8.0 - 150.129.11.255
150.129.8.0/22

Single hit with UA: Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

For realzz? Firefox/1.0.3?

[blend27]

ITL-Bulgaria Ltd.
45.90.58.0 - 45.90.59.255
45.90.58.0/23

Check out this UA:

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; Gas-Oil Network; MRSPUTNIK 2, 4, 0, 463; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; Gas-Oil Network; Gas-Oil Network)

I've done a simple query on Goog, I am a second one out there to get a hit for that UA.... I get the Oil part, but Gas, 3 times, from MRSPUTNIK?

[not2easy]

I've seen them recently, but without the petroleum products:

"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; MRSPUTNIK 2, 4, 0, 463; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)"

from 66.42.64.0/18 (Vultr Holdings /Choopa)
BTW- with HTTP/1.0

[blend27]

re: with HTTP/1.0

I started dropping ALL requests on Server-IIS Level with HTTP/1.0 a few month back on several sites.

I believe that I have learned so far enough about devices that are trying to connect to e-com sites using HTTP/1.0 trying to get our phone # but never actually contact us.

So not even a 'levent og' generated:

<action type="AbortRequest" />

Bunch of honey-pot forum sites are full of those none the less.

[not2easy]

The list continues:

Server Farms January 2021 [webmasterworld.com]

_{For those who may wonder why, I'm trying to stick to a shorter page length so searching is not so maddening.}