IPBlocker Subnets

Paul_Don · Post by **Paul_Don** » 2003-06-27 08:06

ok i actually wrote htis in the wrong part of the forum so ill write it again

Ok i gathered a few bad ip subnets and implemented into aDes and butterflysouls IPBlocker

Would someone please have a look through it and tell me which ones are not applicable. There is currently 112 in there

www.undergroundfusion.co.uk/ipblocker.zip

ButterflySoul · Post by **ButterflySoul** » 2003-06-27 09:15

Would someone please have a look through it and tell me which ones are not applicable. There is currently 112 in there

You mean you'd like someone to review all 112 of them and cross-reference them on the Arin and Internic for you ? =p

I gave an eye to the 2 top ones in your list (the 2 first RIAA blocks) :

* 208.225.90.0 - 208.225.90.255

Eventhough UUNet owns all the IPs around this block, they have a dedicated CIDR to cover those 256 IPs, which means they rented it further down to someone else. Eventhough they kept the customer info as their own, the support addie for this block is help4u(at)mci.com , and the abuse/spam report addie is abuse-mail(at)mci.com
Mci is a pretty big phone company in the US, but doesn't seem particularly linked to the RIAA ?

----- -----

* 12.150.191.0 - 12.150.191.255

This one does belong to the RIAA, indeed. They are the end customer for that block; but they had it resold to them as a CIDR portion of a larger block owned by At&T (which means it's quite unlikely that they have some deals with Mci as the same time, since the 2 companies are serious competitors)

Paul_Don · Post by **Paul_Don** » 2003-06-27 10:34

well see i wasnt sure on which ones wouldnt be appropriate i just scoured round a few sites and took note of ip they tell people to ban on there firewalls i took out the very obviousones like U.S postal service
i just need someone wiht some knowledge to tell me which ones i should remove as they wouldnt be relavent to dc

ButterflySoul · Post by **ButterflySoul** » 2003-06-27 19:18

well see i wasnt sure on which ones wouldnt be appropriate i just scoured round a few sites and took note of ip they tell people to ban on there firewalls i took out the very obviousones like U.S postal service

I did just the same for my own list, and it's far from being exaustive but at least it's reliable. You'll find plenty of lists out there where most of the netblocks are obtained by pinging the company's website, then miraculously deciding that the company hosting the website is the lauch pad for search bots =p
I just meant to point out that the bulk of the work is not gathering the IPs, but precisely verifying them. Your list shows you already did it to some degree, because most of your netblocks are quite small, which is a good sign.

just need someone wiht some knowledge to tell me which ones i should remove as they wouldnt be relavent to dc

The arin & internic records are public; and in most cases, a check at the Arin will be enough. It doesn't require any particular technical skill; all you need to do is head over to http://www.arin.net/whois/ and get familiar with their database search engine. Might take a bit to get fancy advanced searches going, but if you simply type any IP all by itself in the search box, it will get you started =)

Paul_Don · Post by **Paul_Don** » 2003-06-27 21:59

OK thanx alot