Mystery CDN

Wed Jun 17 15:54:06 UTC 2020

* clinton at scripty.com (Clinton Work) [Wed 17 Jun 2020, 17:31 CEST]:
>I'm struggling to determine which CDN owns the servers in 
>CenturyLink prefix 8.240.0.0/12.  During the Call of Duty Season 4 
>update on June 11th from 06:00 UTC until 08:30 UTC, we had 240 Gbps 
>of traffic steaming into our network from CenturyLink prefix 
>8.240.0.0/12.  We originally thought it was Akamai, but they swear 
>up and down that the servers don't belong to them.

Akamai:

% curl -sv http://95.100.96.208/ |& fgrep Server:
< Server: AkamaiGHost

>Here are some of the HTTP/HTTPS servers in 8.240.0.0/12:
>8.253.151.248
>8.251.135.126
>8.240.167.126
>8.240.228.126
>8.240.168.126
>8.240.126.254
>8.240.191.254

Not Akamai:

% curl -sv http://8.240.191.254/ |& fgrep Server:
< Server: FP6.1.1866.55

Have you tried a Shodan search for this fingerprint?

HTH,

	-- Niels.