Lots of inaccuracies

[erikdubbelboer]

I just started checking this list to see how accurate it is. But only in the first couple of lines I already see a lot of wrong data.

12.54.126.240 - 12.54.126.247 is not godaddy anymore according to https://www.ip2location.com/demo/12.54.126.240 or https://ipinfo.io/12.54.126.240
12.68.118.64 - 12.68.118.95 is not mediatemple anymore.
12.177.232.232 - 12.177.232.239 is not Peak10 anymore.

These are all entries from 6 years ago so based on this quick look I'm afraid a lot entries from 6 years ago will be wrong now. Is it maybe an idea to remove these old entries?

[shawnps]

@erikdubbelboer yeah, it's probably a good idea to go through the old data. Since there are so many entries from 2011, updating manually isn't going to be easy. I could possibly write a script that goes through all of the old entries, checks WHOIS, and output a list if there's no mention of the company name in the WHOIS. If that list is short enough, doing a manual check could be feasible.

For now, I checked all of the entries you posted above and it seems you're right, so I can go ahead and remove those.

[erikdubbelboer]

@shawnps I checked the list against our own datacenter list and there are only 226 ranges that we don't see as datacenter: https://pastebin.com/raw/dj770WF5 The last column in this file is the first IP in the range that we didn't see as datacenter. Maybe this is useful for you to clean the list. I can imagine some are wrong in our list and some are wrong in yours.

[shawnps]

Thanks @erikdubbelboer, I'll take a look.

[MikeRich88]

I think it's useless to list the really short IP ranges, especially if it's just a subset of Level 3 or AT&T or something. I am posting as a comment here because I noticed these short ranges in the commit.

-12.54.126.240,12.54.126.247,GoDaddy.com Inc,http://www.godaddy.com/
-12.68.118.64,12.68.118.95,Media Temple,http://www.mediatemple.net/
etc. etc. (those are carved out of the 12.0.0.0/8 AT&T block)

The reason is because, those short ranges (at another ISP) are almost assuredly the office internet connection. There are several good reasons for keeping the office ISP separate from the mix of providers used for the datacenter. (You can't really diagnose a potential connection problem to the server when you are testing from the LAN...)

The ranges are too small to be at all useful for any kind of large scale hosting operation. Not to mention that no self respecting hosting company would use a tiny IP address block such as that for customer servers, you can't even announce a block smaller than a /24, so any servers on those IPs would be single homed to an ISP which is just asking for trouble. (Any web host with only one ISP is a lousy web host and deserves to go out of business)

The list of datacenter IP address ranges is extremely useful, but I strongly recommend removing anything smaller than a /24. That will take care of a great deal of stale records.

I have been categorizing IP ranges for over 12 years now for a private company as part of their efforts to reduce fraud on their platform.

[MikeRich88]

Also, I think 199.192.152.0/21 is no longer hosting. It appears to be a Wireless ISP of some kind now. It appears to have been reassigned late last year. (That's incredible luck for that WISP given the current circumstances at ARIN)

NetRange: 199.192.152.0 - 199.192.159.255
CIDR: 199.192.152.0/21
NetName: NVCCLIENTS
NetHandle: NET-199-192-152-0-1
Parent: NET199 (NET-199-0-0-0-0)
NetType: Direct Allocation
OriginAS:
Organization: Net Vision Communications, LLC (NVCL-4)
RegDate: 2017-02-16
Updated: 2017-12-28
Ref: https://whois.arin.net/rest/net/NET-199-192-152-0-1

OrgName: Net Vision Communications, LLC
OrgId: NVCL-4
Address: 2135 W Vista
City: Springfield
StateProv: MO
PostalCode: 65807
Country: US
RegDate: 2015-02-11
Updated: 2017-02-21
Ref: https://whois.arin.net/rest/org/NVCL-4

OrgAbuseHandle: ADMIN5591-ARIN
OrgAbuseName: Admin
OrgAbusePhone: +1-417-851-1700
OrgAbuseEmail: [email protected]
OrgAbuseRef: https://whois.arin.net/rest/poc/ADMIN5591-ARIN

[MikeRich88]

Also just for the record, I don't use any of this data with the aforementioned private company, because I don't know if that would cause the entire project to inadvertently become GPL, due to the way we perform blocking.

Also, "COPYING" does not exist.

[ported-pw]

178.86.0.0;178.87.255.255;hosting.ua this entry is also incorrect.
The range is actually part of AS39891 - Saudi Telecom Company JSC which is definitely a broadband provider.
https://stat.ripe.net/178.86.0.0
Its also mentioned in @erikdubbelboer post and not changed yet. Thanks for your work.