Re: Mystery CDN

[niels=nanog () bakker net]

* clinton () scripty com (Clinton Work) [Wed 17 Jun 2020, 17:31 CEST]:
> I'm struggling to determine which CDN owns the servers in 
> CenturyLink prefix 8.240.0.0/12.  During the Call of Duty Season 4 
> update on June 11th from 06:00 UTC until 08:30 UTC, we had 240 Gbps 
> of traffic steaming into our network from CenturyLink prefix 
> 8.240.0.0/12.  We originally thought it was Akamai, but they swear 
> up and down that the servers don't belong to them.

Akamai:

% curl -sv http://95.100.96.208/ |& fgrep Server:
< Server: AkamaiGHost


> Here are some of the HTTP/HTTPS servers in 8.240.0.0/12:
> 8.253.151.248
> 8.251.135.126
> 8.240.167.126
> 8.240.228.126
> 8.240.168.126
> 8.240.126.254
> 8.240.191.254

Not Akamai:

% curl -sv http://8.240.191.254/ |& fgrep Server:
< Server: FP6.1.1866.55

Have you tried a Shodan search for this fingerprint?

HTH,


        -- Niels.