Wednesday, July 2, 2025

IPv6 ranges of newsservers

Based on the overview on https://www.appelboor.com/newsservers/newsservers-with-SSL-TLS-OK.html with about 300 newsservers, I did resolving, and some sorting to find IPv6 ranges of newsservers:


$ lynx --dump https://www.appelboor.com/newsservers/newsservers-with-SSL-TLS-OK.html | grep -E ".*\..*\."  | awk '{ print "host " $1 " > " $1 ".txt"  }' | sh


and only using the left 4x4-octet parts (what's the official name?):


$ cat *.txt | grep "has IPv6 address"   | awk '{ print $NF }'   | awk -F\: '{ print $1 ":" $2 ":" $3 ":" $4 "::" }'   | sort | uniq -c | sort -rn

     59 2001:4de0:3:119::

     40 2a01:788:4:100::

     36 2001:4de0:1:::

     26 2001:67c:174:101::

     16 2a07:8080:119:1fe::

     12 2607:bc40:2:119::

      9 2a07:8080:119:fe::

      8 2a00:1d38:fa:1001::

      5 2a07:8085:119:fe::

      4 2a13:d6c0:1:16::

      4 2607:bc40:0:119::

      2 2a02:d28:10:1b::

      1 2a01:4f9:c012:f55a::

      1 2a01:4f9:4b:44c2::

      1 2a01:4f8:c010:63b5::

      1 2a01:4f8:1c17:f346::

      1 2607:bc40:102:::

      1 2607:bc40:101:::

      1 2607:bc40:100:::

      1 2001:49f0:d086:1000::

      1 1:67c:174:101::



So 2001:4de0:3:119:: is the most occuring IPv6 range (note the funny 119 ... port 119 of NNTP). Which is Eweka. 

Let's see which newsserver point to this range:




$ grep 2001:4de0:3:119 *.txt | awk -F\: '{ print $1 }'   | sort -u | sed -e 's/.txt//'

ams2.sslusenet.com

de.sslusenet.com

news3.snelnl.com

news6.easynews.com

news6.eu.easynews.com

news6.eu.usenetserver.com

news6.fr7.newshosting.com

news6.fr7.usenetserver.com

news6.newshosting.com

news6.pureusenet.nl

news6.sunnyusenet.com

news6.tweaknews.eu

news6.tweaknews.nl

news6.usenetserver.com

news6.xlned.com

news-de6.newshosting.com

news-de.newsgroup.ninja

news-eu6.usenetserver.com

news.extremeusenet.nl

news.newsgroup.ninja

news.premium-news.de

news.shemes.com

news.sslusenet.com

news.usenetbucket.com

pro.sslusenet.com

reader.extremeusenet.nl

reader.snelnl.com

reader.usenetbucket.com

secure6.news.easynews.com

secure6.news.eu.easynews.com

test-eu-ipv6.news.easynews.com

test-eu.news.easynews.com

test-secure-eu-ipv6.news.easynews.com

test-secure-eu.news.easynews.com


Ah: Eweka itself is in another range


$ host news6.eweka.nl

news6.eweka.nl has IPv6 address 2001:4de0:1::219

news6.eweka.nl has IPv6 address 2001:4de0:1::205

news6.eweka.nl has IPv6 address 2001:4de0:1::233


So let's use less octets from the IPv6 addresses: just 2x4octets:


$ cat *.txt | grep "has IPv6 address"   | awk '{ print $NF }'   | awk -F\: '{ print $1 ":" $2 "::" }'   | sort | uniq -c | sort -rn

     95 2001:4de0::

     40 2a01:788::

     26 2001:67c::

     25 2a07:8080::

     19 2607:bc40::

      8 2a00:1d38::

      5 2a07:8085::

      4 2a13:d6c0::

      2 2a02:d28::

      2 2a01:4f9::

      2 2a01:4f8::

      1 2001:49f0::

      1 1:67c::


Eweka number one!


And now the interesting part: which newsservers have IPv4, but have not configured the corresponding IPv6 address in their DNS / name resolving. Bad, bad, bad!!!



No comments: