rangerinc.com, cyveillance.com, and mediaforce.com
 

If you don't know who these companies are, they are the ones harvesting IP addresses of people on p2p networks (and elsewhere) and sending C&D letters to their ISPs.

I recently read somewhere that they correspond to the following chunks of the net:

rangerinc.com: 216.122.0.0 - 216.122.255.255
cyveillance.com: 63.64.0.0 - 63.127.255.255
mediaforce.com: 65.192.0.0 - 65.223.255.255

Every since I've been keeping an eye on how they interact with my computers. My Apache web server logs filled with hits from addresses in these ranges connecting to the GWebCache script the Gnucleus uses to find new hosts. So I decided to block and log them at a firewall level and the logs just keep on growing.

Can someone confirm that noone that is not affiliated with these companies is within these ranges? I've noticed that PayPal buttons aren't showing up and I'm not getting as many third party cookies as I did before blocking them, but I'd hate to be shutting out "legit" :p file sharers.

Media force has these ranges registered:
65.217.219.192 - 65.217.219.223
4.43.96.0 - 4.43.96.255

Cyveillance
65.118.41.192 - 65.118.41.223
63.148.99.224 - 63.148.99.255

As far as I can tell rangerinc does not
have any registered ips. The ones you have
listed are registered to a hosting company
which probably hosts their site.

those can't be the limit of addresses under their control considering the cyveillance website is at 63.100.163.127

thanks for the tip on the other addresses

Umm, your web site can be at a different host/location than your corporate SPY headquarters.

True, so can other computers networked under your control.

Anyone know of any other ranges that should be looked out for? Or any kosher addresses within the given ranges that should not be blocked?

Most likely their website is hosted or colo'd at a hosting center and the other ranges are a T1 in their office. UUNet (worldcom) has the 63.0.0.0 - 63.127.255.255 range. From past experience with them, if you have a leased line with them they register the ip's in your name.

If you block your original ip ranges you will block over 6,000,000 ips which is really not a good idea.

Thanks for the info. Due to the current climate on the p2p front I may be being going a little overboard, but I still think it's a good idea for people to keep an eye on who they're connecting to.