217.41.223.x Range

We are seeing a lot of connections to the range 217.41.223.x

Connections are over TCP ports 80, 8080, 21, and 1935. It seems to
coincide with access to LimeLight Networks on range 95.140.226.x

We cannot configure what 217.41.223.x actually is. It appears to be some
kind of broadband connection on the 21CN, there's no contact details for
this address range other than an abuse contact, but I can't help but
thinking its some kind of Content Delivery Service like LimeLight
provided by BT.

Anybody got any information on this range?

Regards,
Simon Dean

On Fri, 16 Apr 2010 12:15:19 +0100, Simon Dean wrote:

> We are seeing a lot of connections to the range 217.41.223.x
>
> Connections are over TCP ports 80, 8080, 21, and 1935. It seems to
> coincide with access to LimeLight Networks on range 95.140.226.x
>
> We cannot configure what 217.41.223.x actually is. It appears to be some
> kind of broadband connection on the 21CN, there's no contact details for
> this address range other than an abuse contact, but I can't help but
> thinking its some kind of Content Delivery Service like LimeLight
> provided by BT.
>
> Anybody got any information on this range?
>
> Regards,
> Simon Dean

It's just another BT customer range full of shit infected windross.

On 16/04/2010 12:34, Vicktor Whieste wrote:
> On Fri, 16 Apr 2010 12:15:19 +0100, Simon Dean wrote:
>
>> We are seeing a lot of connections to the range 217.41.223.x
>>
>> Connections are over TCP ports 80, 8080, 21, and 1935. It seems to
>> coincide with access to LimeLight Networks on range 95.140.226.x
>>
>> We cannot configure what 217.41.223.x actually is. It appears to be some
>> kind of broadband connection on the 21CN, there's no contact details for
>> this address range other than an abuse contact, but I can't help but
>> thinking its some kind of Content Delivery Service like LimeLight
>> provided by BT.
>>
>> Anybody got any information on this range?
>>
>> Regards,
>> Simon Dean
>
> It's just another BT customer range full of shit infected windross.

But it seems to be our networks contacting them on ports 80, 8080, 21
and 1935.... Not the other way around.

On Fri, 16 Apr 2010 12:43:03 +0100, Simon Dean wrote:

> On 16/04/2010 12:34, Vicktor Whieste wrote:
>> On Fri, 16 Apr 2010 12:15:19 +0100, Simon Dean wrote:
>>
>>> We are seeing a lot of connections to the range 217.41.223.x
>>>
>>> Connections are over TCP ports 80, 8080, 21, and 1935. It seems to
>>> coincide with access to LimeLight Networks on range 95.140.226.x
>>>
>>> We cannot configure what 217.41.223.x actually is. It appears to be
>>> some kind of broadband connection on the 21CN, there's no contact
>>> details for this address range other than an abuse contact, but I
>>> can't help but thinking its some kind of Content Delivery Service like
>>> LimeLight provided by BT.
>>>
>>> Anybody got any information on this range?
>>>
>>> Regards,
>>> Simon Dean
>>
>> It's just another BT customer range full of shit infected windross.
>
> But it seems to be our networks contacting them on ports 80, 8080, 21
> and 1935.... Not the other way around.

TCPDump it and look at what it's doing.

Simon Dean wrote:
> We are seeing a lot of connections to the range 217.41.223.x
>
> Connections are over TCP ports 80, 8080, 21, and 1935. It seems to
> coincide with access to LimeLight Networks on range 95.140.226.x
>
> We cannot configure what 217.41.223.x actually is. It appears to be some
> kind of broadband connection on the 21CN, there's no contact details for
> this address range other than an abuse contact, but I can't help but
> thinking its some kind of Content Delivery Service like LimeLight
> provided by BT.
>
> Anybody got any information on this range?
>
> Regards,
> Simon Dean
whois 217.41.223.0
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
% To receive output for a database update, use the "-B" flag.

% Information related to '217.41.222.0 - 217.41.223.255'

inetnum: 217.41.222.0 - 217.41.223.255
netname: BT-21CN-TMAN
descr: infrastructure
country: GB
admin-c: KJH5-RIPE
tech-c: KJH5-RIPE
status: ASSIGNED PA
remarks: Please send abuse notification to (E-Mail Removed)
mnt-by: BTNET-MNT
mnt-lower: BTNET-MNT
mnt-routes: BTNET-MNT
source: RIPE # Filtered

person: Ken Hayes
remarks: *TECHNICAL CONTACT ONLY*
remarks: *DO NOT CONTACT IN CASES OF ABUSE*
remarks: *Please e-mail abuse notification to
remarks: (E-Mail Removed)*
address: Broadband Platform Team
address: UK
phone: +44 1922 706028
nic-hdl: KJH5-RIPE
mnt-by: BTNET-MNT
source: RIPE # Filtered

% Information related to '217.32.0.0/12AS2856'

route: 217.32.0.0/12
descr: BT Public Internet Service
origin: AS2856
mnt-by: BTNET-MNT
source: RIPE # Filtered


My guess is its a proxy service or something.

On Fri, 16 Apr 2010 12:43:03 +0100, Simon Dean <(E-Mail Removed)>
wrote:

> But it seems to be our networks contacting them on ports 80, 8080, 21
> and 1935.... Not the other way around.

Port 1935 is the default for the Flash Communications Server. Is someone
running Adobe Acrobat Connect Pro (was Macromedia Breeze) etc.?

Tony

> My guess is its a proxy service or something.
>

Access to this address range seems to occur whenever the we access ITV
Player, 4oD, Five Player. I think my initial suspicions were right, but
again it's another one of those things that doesn't seem to be
advertised, it has just happened.