jhassine / server-ip-addresses Goto Github PK

Hi!

We've started with a Python implementation of a similar task, and noticed that these CIDR blocks reported by the cloud provider include lots of overlapping CIDRs. In particular, Azure reports that it has 32k addresses (17k unique), when it only really has 1800 if you don't care about all the specific region information. After deduplicating, all of Google, Azure, and AWS together only need 3k total CIDRs because 90% of the reported CIDRs are subnets but not duplicates of others.

If Python is an okay dependency for you, the ipaddress.collapse_addresses utility handily returns a list of only the CIDRs you need. I'm sure there are similar utilities in other languages, but it might be tricky in bash.

Hi,
I was trying to implement blocking of IP addresses of cloud providers on one of my services to avoid any requests from them.
So, I parsed all the CIDRs listed in server-ip-addresses/data/datacenters.txt. But to my surprise, requests from my local machine(laptop) and few of my colleagues machines also got blocked. Not sure why this happened. Any help is appreciated

My site was recently attacked by: 193.57.40.xxx (snipped). whois says:

organisation:   ORG-AHL11-RIPE
org-name:       Alviva Holding Limited

This appears to be a holding company, and here's their portfolio: https://www.alvivaholdings.com/group-companies/. Some of these brands are hosting brands. They all are worth investigating and recognizing their existence on your list of fame.

I stumbled upon cloudyr/cloudcidrs, which has a bunch of additional cloud providers. Unfortunately it's in R, but I think it should be possible to integrate some of it.

They have DigitalOcean (ASN-based), Linode (ASN-based), OVH (ASN-based), Softlayer (ASN- or list-based), Rackspace (ASN-based), Google (DNS-based), in addition to AWS and Azure, with the same methodology as yours.