[#1] PURE RAT v4 // BEST HVNC RAT ◆ Spoof Call and Spoof SMS set any caller ◆ Private Crypter - Unique Private Stubs ◆ 🛒 View HF's Premium Marketplace ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Botnets and Botting › Ranges to avoid when scanning

New Reply 

Ranges to avoid when scanning
PLT ‌
Guest
 
Oct 12, 2015 01:39 PM
I figured I'd create this thread for anyone who uses internet wide scanning for whatever exploit they're using, includes scanning for amp lists.

I will be releasing it in CIDR format which is perfect for creating a blacklist text file for zmap scans.

These ranges include high risk ranges and private ranges which can result in faster internet scan speeds and less abuse reports.

An extra note: Hetzner have honeypots in a lot of their IP ranges which auto report any scan or hack attempt, I'd take this into consideration when choosing which blacklist you want to use.

Code
10.0.0.0/8  # Private
127.0.0.0/8 # Loopback
224.0.0.0/8 # Multicast
225.0.0.0/8 # Multicast
226.0.0.0/8 # Multicast
227.0.0.0/8 # Multicast
228.0.0.0/8 # Multicast
239.0.0.0/8 # Multicast
240.0.0.0/8 # Reserved
255.0.0.0/8 # Reserved
6.0.0.0/8 # Department of Defense
7.0.0.0/8 # DoD
11.0.0.0/8 # DoD
21.0.0.0/8 # DoD
22.0.0.0/8 # DoD
26.0.0.0/8 # DoD
28.0.0.0/8 # DoD
29.0.0.0/8 # DoD
30.0.0.0/8 # DoD
33.0.0.0/8 # DoD
55.0.0.0/8 # Department of Defense
214.0.0.0/8 # DoD
215.0.0.0/8 # DoD
18.0.0.0/8 # Massachusetts Institute of Technology
100.64.0.0/10 # Private
169.254.0.0/16 # Private
172.16.0.0/12 # Private
192.168.0.0/16 # Private
128.236.0.0/16 # USAF
128.217.0.0/16 # NASA
128.216.0.0/16 # AFB
128.202.0.0/16 # USAF
128.190.0.0/16 # Department of Defense
128.183.0.0/16 # NASA
128.161.0.0/16 # NASA
128.160.0.0/16 # Navy
128.159.0.0/16 # NASA
128.158.0.0/16 # NASA
128.157.0.0/16 # NASA
128.156.0.0/16 # NASA
128.102.0.0/16 # NASA
128.149.0.0/16 # NASA
128.154.0.0/16 # NASA
128.155.0.0/16 # NASA

Will continue to update this. Feel free to suggest ranges I've forgotten.

Some help with using your own blacklisted ranges.

https://en.wikipedia.org/wiki/Reserved_IP_addresses
http://bgp.he.net/ - Search by ASN, IP, or provider name to find the ranges of providers you might want blocked.
hhhhhhhhhhhhhhhhhh
hhhhhhhhhhhhhhhhhh Away
[closed@HF:]
Posts:
453
Threads:
11
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Oct 12, 2015 02:41 PM
Nice thread pretty useful, helped me while scanning and also great to avoid honeypots
PLT ‌
Guest
 
Oct 12, 2015 02:50 PM
(Oct 12, 2015 02:48 PM)Mettra Wrote:  Very nice thread.

This should be stickied as this will help a lot people.


Personally, I never bothered to do any blacklists because I couldn't be bothered to lookup ranges that I shouldn't scan.
I think I'll start using it though.

Lol, the amount of times I've had servers banned from getting like 5-6 reports just from Hetzner in less than 10 minutes is ridiculous.

Going to update this thread later with Hetzner ranges aswell.
Jаson
Jаson Offline
lonely stoner
****
HF Ub3r
Posts:
9,328
Threads:
101
Credibility:
100
Popularity:
314
βytes:
β 412
Game XP:
2
Oct 12, 2015 03:36 PM (This post was last modified: Oct 12, 2015 03:37 PM by Jаson.)
http://pastebin.com/raw.php?i=swfDADqi

Cheerio, chaps. 👹
[Image: RIP7FkV.gif]
Rory Guidry
Rory Guidry Offline
[n00b@HF:]
*
Registered
Posts:
16
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Oct 12, 2015 03:39 PM
(Oct 12, 2015 02:55 PM)Mettra Wrote:  I may be using OVH for the scanning :/

Although I have other servers for the scanning, I still use one of my OVH servers (always the same one) for scanning.

I'm surprised I haven't had the Feds at my door yet, lol.

Scanning isn't exactly illegal and nobody cares about you anyway.
PLT ‌
Guest
 
Oct 12, 2015 03:44 PM
(Oct 12, 2015 03:36 PM)Jаson Wrote:  http://pastebin.com/raw.php?i=swfDADqi

Cheerio, chaps. 👹

Will add some of them to the OP.
Victini
Victini Offline
Going on Vacation! Be Back Soon!
***
HF Ub3r
Posts:
855
Threads:
110
Credibility:
000
Popularity:
3
βytes:
β 0
Game XP:
0
Oct 13, 2015 12:36 AM
(Oct 12, 2015 03:36 PM)Jаson Wrote:  http://pastebin.com/raw.php?i=swfDADqi

Cheerio, chaps. 👹

oh niceee! thanks man! although i wont get banned for that scanning, i'll just block em anyways in case :) Thanks man and thanks PLT!
Enter DowN
Enter DowN Away
<3 Youtube !
***
HF l33t
Posts:
959
Threads:
68
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Oct 13, 2015 03:09 AM
Thank you for sharing, i'm agree hetnez very fast respond abuse
Hoodie+
Hoodie+ Offline
Security and Intelligence Agency
***
HF Ub3r
Posts:
3,058
Threads:
201
Credibility:
200
Popularity:
254
βytes:
β 1,307.08
Game XP:
128
Oct 13, 2015 05:03 AM
Nice thread, good job OP!
reverend
Guest
 
Oct 15, 2015 03:29 AM
thanks for sharing ,this will reallly help a lot of people just like me though and am hoping for more ranges
SOULDRK
SOULDRK Offline
since 2010...
**
HF Ub3r
Posts:
391
Threads:
50
Credibility:
000
Popularity:
37
βytes:
β 0
Game XP:
0
Dec 8, 2015 05:26 AM
(Oct 12, 2015 01:39 PM)PLT ‌ Wrote:  I figured I'd create this thread for anyone who uses internet wide scanning for whatever exploit they're using, includes scanning for amp lists.

I will be releasing it in CIDR format which is perfect for creating a blacklist text file for zmap scans.

These ranges include high risk ranges and private ranges which can result in faster internet scan speeds and less abuse reports.

An extra note: Hetzner have honeypots in a lot of their IP ranges which auto report any scan or hack attempt, I'd take this into consideration when choosing which blacklist you want to use.

Code
10.0.0.0/8  # Private
127.0.0.0/8 # Loopback
224.0.0.0/8 # Multicast
225.0.0.0/8 # Multicast
226.0.0.0/8 # Multicast
227.0.0.0/8 # Multicast
228.0.0.0/8 # Multicast
239.0.0.0/8 # Multicast
240.0.0.0/8 # Reserved
255.0.0.0/8 # Reserved
6.0.0.0/8 # Department of Defense
7.0.0.0/8 # DoD
11.0.0.0/8 # DoD
21.0.0.0/8 # DoD
22.0.0.0/8 # DoD
26.0.0.0/8 # DoD
28.0.0.0/8 # DoD
29.0.0.0/8 # DoD
30.0.0.0/8 # DoD
33.0.0.0/8 # DoD
55.0.0.0/8 # Department of Defense
214.0.0.0/8 # DoD
215.0.0.0/8 # DoD
18.0.0.0/8 # Massachusetts Institute of Technology
100.64.0.0/10 # Private
169.254.0.0/16 # Private
172.16.0.0/12 # Private
192.168.0.0/16 # Private
128.236.0.0/16 # USAF
128.217.0.0/16 # NASA
128.216.0.0/16 # AFB
128.202.0.0/16 # USAF
128.190.0.0/16 # Department of Defense
128.183.0.0/16 # NASA
128.161.0.0/16 # NASA
128.160.0.0/16 # Navy
128.159.0.0/16 # NASA
128.158.0.0/16 # NASA
128.157.0.0/16 # NASA
128.156.0.0/16 # NASA
128.102.0.0/16 # NASA
128.149.0.0/16 # NASA
128.154.0.0/16 # NASA
128.155.0.0/16 # NASA

Will continue to update this. Feel free to suggest ranges I've forgotten.

Some help with using your own blacklisted ranges.

https://en.wikipedia.org/wiki/Reserved_IP_addresses
http://bgp.he.net/ - Search by ASN, IP, or provider name to find the ranges of providers you might want blocked.

Also 236.33.0.0/8
Protocol666
Guest
 
Dec 8, 2015 03:49 PM
can I know please how to insert the blacklist? thanks u
extasy7
extasy7 Offline
[n00b@HF:]
*
Registered
Posts:
39
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Dec 8, 2015 06:13 PM
Thank you for sharing.pretty useful
plat.
Guest
 
Dec 8, 2015 09:49 PM
Wow great post very HQ and helpful! Thinking about incorporating this into the qBot telnet scanner to avoid these ranges if i change up the ipStates a little
PLT ‌
Guest
 
Dec 8, 2015 10:23 PM
(Dec 8, 2015 09:49 PM)plat. Wrote:  Wow great post very HQ and helpful! Thinking about incorporating this into the qBot telnet scanner to avoid these ranges if i change up the ipStates a little

Pretty good idea actually. Enjoy.

Might start updating this again since it got bumped.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by ZyklonFeb 26, 2026 10:49 AM 5 513 Feb 26, 2026 10:49 AM
Last Post: C00Lssh
by ClumsyJul 10, 2025 05:21 AM 1 154 Jul 10, 2025 05:21 AM
Last Post: DramaKing
by ClumsyOct 10, 2024 09:41 AM 2 226 Oct 10, 2024 09:41 AM
Last Post: Clumsy