INTERNETBOLAGET-SE = No More

internetvikings.com

[blend27]

There is a new something something on a chopping block: internetvikings.

Don't know if their network is being exploited, or such, but here are the ranges:

192.121.122.0/24
192.121.123.0/24
192.121.124.0/24
192.121.125.0/24
192.121.126.0/24
192.121.134.0/24
192.121.135.0/24
192.121.136.0/24
192.121.146.0/24
192.121.147.0/24
192.121.148.0/24
192.121.149.0/24
192.121.152.0/24
192.121.155.0/24
192.121.156.0/22
192.121.169.0/24
192.121.184.0/24
192.121.185.0/24
192.121.186.0/24
192.121.191.0/24
192.121.220.0/24
192.121.225.0/24
192.121.251.0/24
192.121.31.0/24
192.121.35.0/24
192.121.38.0/24
192.121.71.0/24
192.165.113.0/24
192.165.121.0/24
192.165.123.0/24
192.165.45.0/24
192.165.48.0/24
192.165.85.0/24
192.176.127.0/24
192.176.174.0/24
192.176.24.0/24
192.176.249.0/24
192.176.26.0/24
192.176.27.0/24
192.176.28.0/24
192.36.109.0/24
192.36.110.0/24
192.36.119.0/24
192.36.121.0/24
192.36.136.0/23
192.36.154.0/24
192.36.166.0/24
192.36.172.0/23
192.36.177.0/24
192.36.178.0/24
192.36.198.0/24
192.36.207.0/24
192.36.217.0/24
192.36.226.0/24
192.36.23.0/24
192.36.233.0/24
192.36.234.0/24
192.36.24.0/24
192.36.241.0/24
192.36.248.0/24
192.36.52.0/23
192.36.70.0/23
192.71.10.0/24
192.71.103.0/24
192.71.12.0/24
192.71.126.0/24
192.71.142.0/24
192.71.15.0/24
192.71.153.0/24
192.71.17.0/24
192.71.18.0/24
192.71.2.0/23
192.71.224.0/23
192.71.23.0/24
192.71.25.0/24
192.71.30.0/24
192.71.32.0/24
192.71.34.0/24
192.71.36.0/24
192.71.38.0/24
192.71.42.0/24
192.71.44.0/24
192.71.46.0/24
192.71.48.0/24
192.71.50.0/24
192.71.52.0/24
192.71.54.0/23
192.71.57.0/24
192.71.59.0/24
192.71.61.0/24
192.71.62.0/23
192.71.64.0/23
192.71.70.0/23
192.71.74.0/24
192.71.8.0/24
192.71.81.0/24
192.71.86.0/23
192.71.88.0/23
192.71.93.0/24
192.71.95.0/24
193.180.123.0/24
193.180.166.0/24
193.180.220.0/22
193.181.13.0/24
193.181.16.0/22
193.181.178.0/23
193.181.234.0/24
193.181.255.0/24
193.182.112.0/24
193.182.189.0/24
193.182.19.0/24
193.182.22.0/23
193.182.4.0/23
193.183.100.0/24
193.183.101.0/24
193.183.102.0/24
193.183.103.0/24
193.183.106.0/23
193.183.108.0/22
193.183.120.0/22
193.183.124.0/23
193.183.170.0/23
193.183.172.0/23
193.183.186.0/24
193.183.187.0/24
193.183.6.0/24
193.183.64.0/22
193.183.72.0/23
193.183.76.0/23
193.183.82.0/23
193.183.84.0/24
193.183.86.0/23
193.183.88.0/23
193.183.90.0/24
193.183.95.0/24
193.234.165.0/24
193.234.222.0/24
193.234.223.0/24
193.234.232.0/24
193.234.254.0/24
193.235.117.0/24
193.235.141.0/24
193.235.200.0/23
193.235.202.0/24
193.235.22.0/23
193.235.238.0/23
194.103.11.0/24
194.103.136.0/22
194.103.141.0/24
194.103.2.0/24
194.103.207.0/24
194.103.211.0/24
194.103.212.0/23
194.103.222.0/24
194.103.33.0/24
194.103.51.0/24
194.103.6.0/24
194.103.9.0/24
194.103.92.0/24
194.132.11.0/24
194.132.110.0/23
194.132.112.0/24
194.132.115.0/24
194.132.138.0/23
194.132.200.0/22
194.132.31.0/24
194.132.49.0/24
194.132.50.0/23
194.132.61.0/24
194.132.62.0/23
194.14.222.0/23
194.14.239.0/24
194.14.254.0/23
194.14.28.0/23
194.14.74.0/23
194.14.85.0/24
194.14.87.0/24
194.68.112.0/23
194.68.16.0/22
194.68.84.0/24
194.68.96.0/24
194.71.100.0/22
194.71.202.0/23
194.71.208.0/22
194.71.22.0/23
194.71.228.0/22
194.71.246.0/23
83.140.95.0/24
93.158.95.0/24

Everything from guestbook trap, blank UA looking for .env and /jenkins/login, self referrers, Headless Chrome - to missing 'Connection' header, +++ a ton of rubbish requests in a past 4 month.

Boom, for now....

[blend27]

The ranges could be compacted to 23s and 22s, way too much work for now....

[jmccormac]

If you are using Linux, there's a handy program called 'aggregate' which aggregates the IP ranges down to a more manageable size.

Have seen that jenkins string popping up in the last few weeks or so.

Regards...jmcc

[blend27]

--If you are using Linux -- called 'aggregate'--Cool!

Juicy, Nice, Thanks JMCC, will look into it for sure!

I used request fingerprinting: same set of headers sent to server from diff IPs over specific timeline. Works wonders.

I did use the same 'tequila mix' with M247 before, seems like it it sinking in.

Blend27

[lucy24]

there's a handy program called 'aggregate'

... and then there's the part where you change
\b(\d\d?)\b
to
0$1
(twice)
before sorting, and then change back
\b0+(\d)
to
$1
so 32 ends up before 123 and so on.
;)

"internetbolaget" sounds much more respectable than "internetvikings". Are they aiming for a wide range of clients?

[blend27]

... and then...

Hi Lucy24 :)!

Ok, Ok, that is Regular Expressions using a text editor?

Left?

If so, which editor and how to fly over the 'nest'...?

When you get a chance, Pretty Please?

[lucy24]

I use SubEthaEdit, except that I changed \1 to $1 for posting because people are more likely to recognize that form. (TextWrangler also uses the \1 notation, fwiw.) Everything in there is vanilla-standard RegEx--allowing for the \1 vs. $1 variant--so it should work in any text editor you like.

[not2easy]

They were reported here earlier this month: [webmasterworld.com...] - not nearly so many as you've listed here though. Thanks @blend27.

I see I had some from Dec.2020 too:
Internet Vikings
130.255.160.128 - 130.255.160.191
130.255.160.0/21
AS12552

with the alternate net name: SE-KORTEA-HOSTING