Blocking Web Hosting Centers

**Will.Spencer** · 17 May, 2011, 15:19 PM

I am trying something new. My sites are constantly being scraped and attacked. Usually this is from web hosts, not from home and business user IP addresses.

So I am thinking "Why not block those IP address ranges at the firewall?" I am trying to think of what I lose by not letting these scripts crawl my web sites.

The first thing I broke was email. It's important not to block that. I am now only blocking these IP's on port 80. I might change that in the future and only allow them on port 25.

What else might I break? What do you think?

Here's the list of wen host IP's I'm blocking today:

Code:

# Amazon EC2
50.16.0.0/14
67.202.0.0/18
75.101.128.0/17
79.125.0.0/17
174.129.0.0/16
184.72.0.0/15
204.236.128.0/17
# Bulletproof Web (Chinese Hosting)
91.201.64.0/22
# Staminus Communications (http://staminus.net/)
72.20.0.0/18
# Limestone Networks (http://www.limestonenetworks.com/)
74.63.192.0/18
# Dedibox (http://www.dedibox.fr/)
88.191.3.0/24
88.191.4.0/22
88.191.8.0/21
88.191.16.0/20
88.191.32.0/18
88.191.64.0/17
88.191.128.0/18
88.191.192.0/19
88.191.224.0/20
88.191.240.0/21
88.191.248.0/24
# Rackspace
69.20.0.0/17
173.203.0.0/16
174.143.0.0/16
184.106.0.0/16
# Nobis Technology Group, LLC (http://www.nobistech.net)
64.120.0.0/17
69.147.224.0/19
108.62.0.0/16
173.208.0.0/17
173.234.0.0/16
174.34.128.0/18
# CentralHost
98.158.16.0/20
# Softlayer
67.228.0.0/16
174.36.0.0/23
# Q9 Networks (q9.com)
67.210.208.0/20
# Krypt Technologies (http://www.vpls.net)
98.126.0.0/16
# Steadfast Networks (steadfast.net)
208.100.0.0/18
# FortressITX
208.116.0.0/18
# Fortress Colocation Centers (fortresscolo.com)
173.225.16.0/20 
# GigeNET (http://www.gigenet.com)
209.212.144.0/20
# dimenoc.com
66.7.192.0/19
# ThePlanet
67.18.0.0/15
70.84.0.0/14
74.52.0.0/14
174.120.0.0/14
174.132.0.0/15
# GoDaddy
72.167.0.0/16
97.74.0.0/16
# GoDaddy Singapore
182.50.128.0/19
# Singlehop
184.154.0.0/16
# HostNOC
64.120.128.0/17
184.82.0.0/16
# Atomic Data Centers LLC (Tier 2 host at XOXO)
64.244.48.0/20
71.5.104.0/21
# Infolink (http://www.infolink.com)
64.251.0.0/19
# fdcservers.net
76.73.0.0/17
204.45.0.0/16
# calpop.com
208.70.72.0/21
# CWIE (http://www.cwie.com)
64.38.192.0/17
# KeyWeb AG
84.19.160.0/19
87.118.64.0/18
# galaxyvisions.com
209.104.192.0/19
# Peer1 Dedicated Hosting
216.157.0.0/18
216.157.64.0/19
216.157.96.0/20
# Evolution Online Ltd. (http://www.evolution.co.il/)
195.190.23.0/24
# Netelligent (http://netelligent.ca/)
209.44.96.0/19
# Hurricane Electric
65.49.0.0/15
# dcsmanage.com
66.79.160.0/19
205.209.128.0/18
# BlueHost
67.20.64.0/18
74.220.192.0/19
# LiquidWeb
67.225.128.0/17
67.227.128.0/17
69.167.128.0/18
# Turnkey Internet (http://www.turnkeyinternet.net/)
67.231.240.0/20
# InterServer (http://www.interserver.net)
69.10.32.0/19
# LunarPages.com
74.50.0.0/19
# Iomart Hosting
78.129.128.0/17
109.169.64.0/19
# OVH Hosting
87.98.128.0/18
91.121.64.0/18
94.23.0.0/18
188.165.192.0/18
# oc3networks.com
96.44.128.0/18
# InMotion Hosting
74.124.210.0/23
# Net2EZ (http://www.net2ez.com)
64.93.64.0/19
# steadfast.net
69.162.128.0/18
# MediaTemple (http://mediatemple.net/)
205.186.128.0/18
# xsserver.eu
109.230.208.0/20
109.230.240.0/20
# 1&1 Internet AG (http://oneandone.net)
87.106.0.0/16
# Eltel (http://www.eltel.net)
81.222.192.0/18
# giga-hosting.biz
79.143.176.0/20
# register.it
81.88.48.0/20
# Servage Hosting (http://www.servage.net)
77.232.68.0/23
92.61.144.0/20
# hosteurope.de
178.77.64.0/18
# noc4hosts.com
66.232.96.0/19
96.31.64.0/19
# iweb.com
67.205.64.0/18
184.107.0.0/16
# netdirekt
89.149.192.0/18
188.72.192.0/18
217.20.112.0/20
# VolumeDrive
173.242.112.0/20
# dotnetdotcom.org
208.115.111.240/28
# leaseweb.com
85.17.0.0/16
# Melbourne Network Solutions (http://melbourne.co.uk)
87.237.56.0/21
# nthost.ru
217.147.29.0/24
64.13.192.108
# SoftLayer
50.22.0.0/15
67.228.0.0/16
173.192.0.0/15
208.43.0.0/16
# Savvis
64.41.128.0/17
66.119.32.0/19
165.193.0.0/16
# jumpline.com
64.6.224.0/19
# Cyberverse
66.172.0.0/18
# Layered Technologies (layertech.com)
72.232.0.0/16
72.233.0.0/17
# Colo4Dallas
72.249.0.0/17
72.249.128.0/18
# westhost.com
209.236.64.0/20
# Bergdorf Group (http://bergdorf-group.com/)
91.224.160.0/23
# Hetzner Online AG (http://www.hetzner.de/)
46.4.0.0/16
88.198.0.0/16
188.40.0.0/16
213.133.96.0/19
# fasthosts.co.uk
213.171.192.0/19
# ukrtelecom.ua Utel DataCenter, Ukraine
213.186.112.0/20
# altushost.com
213.5.64.0/21
# completeweb.net
216.226.128.0/19
# Hot Networking
65.120.238.0/24
# Global Network Access (gnax.net)
64.22.64.0/18
72.9.224.0/19
# Psychz Networks
173.224.208.0/20
199.71.212.0/22
216.24.192.0/20
# Dreamhost
173.236.128.0/17
# sagonet.com
207.150.160.0/19
# Trustica Housed Servers (http://www.trustica.cz)
81.0.246.0/26
# Mojohost
99.192.128.0/17
# BITEC Hosting
178.33.2.156/30
# SERVER.UA Ukraine Dedicated Service (http://www.server.ua)
195.189.226.0/23
# Daily Internet Services VPS (http://www.daily.co.uk/)
195.234.10.0/23
# Flexiant (http://www.flexiant.com/)
109.231.64.0/18
# eNET XLHost (http://www.xlhost.com/)
209.190.0.0/16
# Slicehost
209.20.64.0/19
# Fantastic VPS (http://fantastic-vps.com/)
212.124.116.0/24

**Mike-XS** · 17 May, 2011, 23:39 PM

Sounds like a good test.

To me the Amazon cloud seems to be just one gigantic neverending flow of traffic from useless bots and scrapers.

Here's a good & recent list of amazon botnet ranges [updated dec 2011]:

Code:

https://forums.aws.amazon.com/ann.jspa?annID=1252

I don't think there's much harm in blocking most server hosts especially all the cheapest vps/dedicated server hosts like OVH, server.lu, leaseweb, ubiquity servers etc , yeah there's tons of them. It's probably only ever going to be bot related traffic, spammers and proxies coming from those kinds of networks.

Couple more IP's to consider:

#server.lu
195.26.4.0/23
212.117.160.0/19
#ubiquityservers.com
173.234.176.0/22

This site has some good sources too:
Block Website Harvesters | Proxies | Scrapers | Server Exploiters | With Apache Web Server .htaccess IP Blocklist

What else might I break? What do you think?

Just in general, this type of blocking could possibly affect other sites that check if their backlinks still exist on your pages, such as with proxy lists etc. You might not have that problem though since most people would be linking back to your lists.

**Will.Spencer** · 22 May, 2011, 15:18 PM

Originally Posted by Mike-XS

Just in general, this type of blocking could possibly affect other sites that check if their backlinks still exist on your pages, such as with proxy lists etc. You might not have that problem though since most people would be linking back to your lists.

The only thing I've noticed broken from blocking port 80 is ping.lo.gs.

Here's the current list:

Code:

# altushost.com
213.5.64.0/21
# Amazon EC2 - US East (Northern Virginia)
216.182.224.0/20
72.44.32.0/19
67.202.0.0/18
75.101.128.0/17
174.129.0.0/16
204.236.192.0/18
184.73.0.0/16
184.72.128.0/17
184.72.64.0/18
50.16.0.0/15
50.19.0.0/16
# Amazon EC2 - US West (Northern California)
204.236.128.0/18
184.72.0.0/18
50.18.0.0/17
# Amazon EC2 - EU (Ireland)
79.125.0.0/17
46.51.128.0/18
46.51.192.0/20
46.137.0.0/17
# Amazon EC2 - Asia Pacific (Singapore)
175.41.128.0/18
122.248.192.0/18
# Amazon EC2 - Asia Pacific (Tokyo)
175.41.192.0/18
46.51.224.0/19
# Atomic Data Centers LLC (Tier 2 host at XOXO)
64.244.48.0/20
71.5.104.0/21
# Bergdorf Group (http://bergdorf-group.com/)
91.224.160.0/23
# BITEC Hosting
178.33.2.156/30
# BlueHost
67.20.64.0/18
74.220.192.0/19
# Bulletproof Web (Chinese Hosting)
91.201.64.0/22
# calpop.com
208.70.72.0/21
# Colo4Dallas
72.249.0.0/17
72.249.128.0/18
# completeweb.net
216.226.128.0/19
# CentralHost
98.158.16.0/20
# CWIE (http://www.cwie.com)
64.38.192.0/17
# Cyberverse
66.172.0.0/18
# Daily Internet Services VPS (http://www.daily.co.uk/)
195.234.10.0/23
# dcsmanage.com
66.79.160.0/19
205.209.128.0/18
# Dedibox (http://www.dedibox.fr/)
88.191.3.0/24
88.191.4.0/22
88.191.8.0/21
88.191.16.0/20
88.191.32.0/18
88.191.64.0/17
88.191.128.0/18
88.191.192.0/19
88.191.224.0/20
88.191.240.0/21
88.191.248.0/24
# dimenoc.com
66.7.192.0/19
# dotnetdotcom.org
208.115.111.240/28
# Dreamhost
173.236.128.0/17
# Eltel (http://www.eltel.net)
81.222.192.0/18
# eNET XLHost (http://www.xlhost.com/)
209.190.0.0/16
# Evolution Online Ltd. (http://www.evolution.co.il/)
195.190.23.0/24
# Fantastic VPS (http://fantastic-vps.com/)
212.124.116.0/24
# fasthosts.co.uk
213.171.192.0/19
# fdcservers.net
76.73.0.0/17
204.45.0.0/16
# Flexiant (http://www.flexiant.com/)
109.231.64.0/18
# Fortress Colocation Centers (fortresscolo.com)
173.225.16.0/20 
# FortressITX
208.116.0.0/18
# galaxyvisions.com
209.104.192.0/19
# giga-hosting.biz
79.143.176.0/20
# GigeNET (http://www.gigenet.com)
209.212.144.0/20
# Global Network Access (gnax.net)
64.22.64.0/18
72.9.224.0/19
# GoDaddy
72.167.0.0/16
97.74.0.0/16
# GoDaddy Singapore
182.50.128.0/19
# Hetzner Online AG (http://www.hetzner.de/)
46.4.0.0/16
88.198.0.0/16
188.40.0.0/16
213.133.96.0/19
# hosteurope.de
178.77.64.0/18
# HostNOC
64.120.128.0/17
184.82.0.0/16
# Hot Networking
65.120.238.0/24
# Hurricane Electric
65.49.0.0/15
# Infolink (http://www.infolink.com)
64.251.0.0/19
# InMotion Hosting
74.124.210.0/23
# InterServer (http://www.interserver.net)
69.10.32.0/19
# Iomart Hosting
78.129.128.0/17
109.169.64.0/19
# iweb.com
67.205.64.0/18
184.107.0.0/16
# jumpline.com
64.6.224.0/19
# KeyWeb AG
84.19.160.0/19
87.118.64.0/18
# Krypt Technologies (http://www.vpls.net)
98.126.0.0/16
# Layered Technologies (layertech.com)
72.232.0.0/16
72.233.0.0/17
# leaseweb.com
85.17.0.0/16
# Limestone Networks (http://www.limestonenetworks.com/)
74.63.192.0/18
# LiquidWeb
67.225.128.0/17
67.227.128.0/17
69.167.128.0/18
# LunarPages.com
74.50.0.0/19
# MediaTemple (http://mediatemple.net/)
205.186.128.0/18
# Melbourne Network Solutions (http://melbourne.co.uk)
87.237.56.0/21
# Mojohost
99.192.128.0/17
# Net2EZ (http://www.net2ez.com)
64.93.64.0/19
# netdirekt
89.149.192.0/18
188.72.192.0/18
217.20.112.0/20
# Netelligent (http://netelligent.ca/)
209.44.96.0/19
# Nobis Technology Group, LLC (http://www.nobistech.net)
64.120.0.0/17
69.147.224.0/19
108.62.0.0/16
173.208.0.0/17
173.234.0.0/16
174.34.128.0/18
# noc4hosts.com
66.232.96.0/19
96.31.64.0/19
# nthost.ru
217.147.29.0/24
64.13.192.108
# oc3networks.com
96.44.128.0/18
# 1&1 Internet AG (http://oneandone.net)
87.106.0.0/16
# OVH Hosting
87.98.128.0/18
91.121.64.0/18
94.23.0.0/18
188.165.192.0/18
# Peer1 Dedicated Hosting
216.157.0.0/18
216.157.64.0/19
216.157.96.0/20
# Psychz Networks
173.224.208.0/20
199.71.212.0/22
216.24.192.0/20
# Q9 Networks (q9.com)
67.210.208.0/20
# Rackspace
69.20.0.0/17
173.203.0.0/16
174.143.0.0/16
184.106.0.0/16
# register.it
81.88.48.0/20
# sagonet.com
207.150.160.0/19
# Savvis
64.41.128.0/17
66.119.32.0/19
165.193.0.0/16
# Servage Hosting (http://www.servage.net)
77.232.68.0/23
92.61.144.0/20
# server.lu
195.26.4.0/23
212.117.160.0/19
# Server.ua Ukraine Dedicated Service (http://www.server.ua)
195.189.226.0/23
# Singlehop
184.154.0.0/16
# Slicehost
209.20.64.0/19
# Softlayer
50.22.0.0/15
67.228.0.0/16
173.192.0.0/15
174.36.0.0/23
208.43.0.0/16
# Staminus Communications (http://staminus.net/)
72.20.0.0/18
# Steadfast Networks (steadfast.net)
69.162.128.0/18
208.100.0.0/18
# ThePlanet
67.18.0.0/15
70.84.0.0/14
74.52.0.0/14
174.120.0.0/14
174.132.0.0/15
# Trustica Housed Servers (http://www.trustica.cz)
81.0.246.0/26
# Turnkey Internet (http://www.turnkeyinternet.net/)
67.231.240.0/20
# ubiquityservers.com
173.234.176.0/22
# ukrtelecom.ua Utel DataCenter, Ukraine
213.186.112.0/20
# VolumeDrive
173.242.112.0/20
# westhost.com
209.236.64.0/20
# xsserver.eu
109.230.208.0/20
109.230.240.0/20