4 ms·

This is everything I have for AS132203 (Tencent). It has your addresses plus others I have found and confirmed using ipinfo.io 43.131.0.0/18 43.129.32.0/20 101

This is everything I have for AS132203 (Tencent). It has your addresses plus others I have found and confirmed using ipinfo.io 43.131.0.0/18 43.129.32.0/20 101.32.0.0/20 101.32.102.0/23 101.32.104.0/21 101.32.112.0/23 101.32.112.0/24 101.32.114.0/23 101.32.116.0/23 101.32.118.0/23 101.32.120.0/23 101.32.122.0/23 101.32.124.0/23 101.32.126.0/23 101.32.128.0/23 101.32.130.0/23 101.32.13.0/24 101.32.132.0/22 101.32.132.0/24 101.32.136.0/21 101.32.140.0/24 101.32.144.0/20 101.32.160.0/20 101.32.16.0/20 101.32.17.0/24 101.32.176.0/20 101.32.192.0/20 101.32.208.0/20 101.32.224.0/22 101.32.228.0/22 101.32.232.0/22 101.32.236.0/23 101.32.238.0/23 101.32.240.0/20 101.32.32.0/20 101.32.48.0/20 101.32.64.0/20 101.32.78.0/23 101.32.80.0/20 101.32.84.0/24 101.32.85.0/24 101.32.86.0/24 101.32.87.0/24 101.32.88.0/24 101.32.89.0/24 101.32.90.0/24 101.32.91.0/24 101.32.94.0/23 101.32.96.0/20 101.33.0.0/23 101.33.100.0/22 101.33.10.0/23 101.33.10.0/24 101.33.104.0/21 101.33.11.0/24 101.33.112.0/22 101.33.116.0/22 101.33.120.0/21 101.33.128.0/22 101.33.132.0/22 101.33.136.0/22 101.33.140.0/22 101.33.14.0/24 101.33.144.0/22 101.33.148.0/22 101.33.15.0/24 101.33.152.0/22 101.33.156.0/22 101.33.160.0/22 101.33.164.0/22 101.33.168.0/22 101.33.17.0/24 101.33.172.0/22 101.33.176.0/22 101.33.180.0/22 101.33.18.0/23 101.33.184.0/22 101.33.188.0/22 101.33.24.0/24 101.33.25.0/24 101.33.26.0/23 101.33.30.0/23 101.33.32.0/21 101.33.40.0/24 101.33.4.0/23 101.33.41.0/24 101.33.42.0/23 101.33.44.0/22 101.33.48.0/22 101.33.52.0/22 101.33.56.0/22 101.33.60.0/22 101.33.64.0/19 101.33.64.0/23 101.33.96.0/22 103.52.216.0/22 103.52.216.0/23 103.52.218.0/23 103.7.28.0/24 103.7.29.0/24 103.7.30.0/24 103.7.31.0/24 43.130.0.0/18 43.130.64.0/18 43.130.128.0/19 43.130.160.0/19 43.132.192.0/18 43.133.64.0/19 43.134.128.0/18 43.135.0.0/18 43.135.64.0/18 43.135.192.0/19 43.153.0.0/18 43.153.192.0/18 43.154.64.0/18 43.154.128.0/18 43.154.192.0/18 43.155.0.0/18 43.155.128.0/18 43.156.192.0/18 43.157.0.0/18 43.157.64.0/18 43.157.128.0/18 43.159.128.0/19 43.163.64.0/18 43.164.192.0/18 43.165.128.0/18 43.166.128.0/18 43.166.224.0/19 49.51.132.0/23 49.51.140.0/23 49.51.166.0/23 119.28.64.0/19 119.28.128.0/20 129.226.160.0/19 150.109.32.0/19 150.109.96.0/19 170.106.32.0/19 170.106.176.0/20

bigiain 1y ago
For anyone wondering how to do this (like me from a month or two back). Here's a useful tool/site: https://bgp.tools https://bgp.tools You can feed it an ip address to get an AS ("Autonomous System"), then ask it for all prefixes associated with that AS. I fed it that first ip address from that list (43.131.0.0) and it showed my the same Tencent owned AS132203, and it gives back all the prefixes they have here: https://bgp.tools/as/132203#prefixes https://bgp.tools/as/132203#prefixes (Looks like roguebloodrage might have missed at least the 1.12.x.x and 1.201.x.x prefixes?) I started searching about how to do that after reading a RachelByTheBay post where she wrote: Enough bad behavior from a host -> filter the host. Enough bad hosts in a netblock -> filter the netblock. Enough bad netblocks in an AS -> filter the AS. Think of it as an "AS death penalty", if you like. (from the last part of https://rachelbythebay.com/w/2025/06/29/feedback/ https://rachelbythebay.com/w/2025/06/29/feedback/ )
- BLKNSLVR 1y ago
  This is what I've used to find ASs to block: https://hackertarget.com/as-ip-lookup/ https://hackertarget.com/as-ip-lookup/ eg. Chuck 'Tencent' into the text box and execute.
- roguebloodrage 1y ago
  I add re-actively. I figure there are "legitimate" IP's that companies use and I only look at IP addresses that are 'vandalizing' my servers with inappropriate scans and block them. If I saw the two you have identified, then they would have been added. I do play a balance between "might be a game CDN" or a "legit server" and an outright VPS that is being used to abuse other servers. But thanks, I will keep an eye on those two ranges.
speleding 1y ago
For the Thinkbot problem mentioned in the article, it's less maintenance work to simply block on the User Agent string.
- sim7c00 1y ago
  jep, good tip! for ppl that do this be sure to make it case insensitive and only capture few distinct parts, not too specific. especially if u only expect browsers this can mitigate a lot. u can also filter for allowing but this gives a risk of allowing the wrong thing as headers are easy to set, so its better to do it via blocking (sadly)
nubinetwork 1y ago
FWIW, I looked through my list of ~8000 IP addresses, there isn't as many hits for these ranges as I would have thought. It's possible that they're more focused on using known DNS names than simply connecting to 80/443 on random IPs. Edit: I also checked my Apache logs, I couldn't find any recent logs for "thinkbot".

bigiain 1y ago

For anyone wondering how to do this (like me from a month or two back). Here's a useful tool/site: https://bgp.tools https://bgp.tools You can feed it an ip address to get an AS ("Autonomous System"), then ask it for all prefixes associated with that AS. I fed it that first ip address from that list (43.131.0.0) and it showed my the same Tencent owned AS132203, and it gives back all the prefixes they have here: https://bgp.tools/as/132203#prefixes https://bgp.tools/as/132203#prefixes (Looks like roguebloodrage might have missed at least the 1.12.x.x and 1.201.x.x prefixes?) I started searching about how to do that after reading a RachelByTheBay post where she wrote: Enough bad behavior from a host -> filter the host. Enough bad hosts in a netblock -> filter the netblock. Enough bad netblocks in an AS -> filter the AS. Think of it as an "AS death penalty", if you like. (from the last part of https://rachelbythebay.com/w/2025/06/29/feedback/ https://rachelbythebay.com/w/2025/06/29/feedback/ )

BLKNSLVR 1y ago
This is what I've used to find ASs to block: https://hackertarget.com/as-ip-lookup/ https://hackertarget.com/as-ip-lookup/ eg. Chuck 'Tencent' into the text box and execute.
roguebloodrage 1y ago
I add re-actively. I figure there are "legitimate" IP's that companies use and I only look at IP addresses that are 'vandalizing' my servers with inappropriate scans and block them. If I saw the two you have identified, then they would have been added. I do play a balance between "might be a game CDN" or a "legit server" and an outright VPS that is being used to abuse other servers. But thanks, I will keep an eye on those two ranges.

speleding 1y ago

For the Thinkbot problem mentioned in the article, it's less maintenance work to simply block on the User Agent string.

sim7c00 1y ago
jep, good tip! for ppl that do this be sure to make it case insensitive and only capture few distinct parts, not too specific. especially if u only expect browsers this can mitigate a lot. u can also filter for allowing but this gives a risk of allowing the wrong thing as headers are easy to set, so its better to do it via blocking (sadly)

nubinetwork 1y ago

FWIW, I looked through my list of ~8000 IP addresses, there isn't as many hits for these ranges as I would have thought. It's possible that they're more focused on using known DNS names than simply connecting to 80/443 on random IPs. Edit: I also checked my Apache logs, I couldn't find any recent logs for "thinkbot".