Private networks from outside local network accessible?

[JB701]

Hello everyone,

So I was port scanning 10.0.0.0/8 block to see what my ISP has got using Masscan and I found something strange.
I ran the following command:

masscan 10.0.0.0/8 -p80 --rate 5000

Essentially scanning 16 million private IPs on port 80. I was expecting to see ISP infrastructure but I found something that I shouldn't be able to access.
Here is a part of the result, with 35% scan done there were already >8000 open hosts:

Discovered open port 80/tcp on 10.138.39.38
Discovered open port 80/tcp on 10.190.150.83
Discovered open port 80/tcp on 10.229.32.4
Discovered open port 80/tcp on 10.189.196.7
Discovered open port 80/tcp on 10.162.138.110
Discovered open port 80/tcp on 10.192.163.10
Discovered open port 80/tcp on 10.189.196.10
Discovered open port 80/tcp on 10.189.180.36
Discovered open port 80/tcp on 10.192.211.15
Discovered open port 80/tcp on 10.169.32.6
Discovered open port 80/tcp on 10.173.188.4

Accessing an IP lets say on browser gives me this:

I censored the MAC Address and stuff but look at the site name, it appears to be in Mumbai.
Doing a traceroute shows that it is outside ISP network:

Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev
1. router.lan                        0.0%     5    0.2   0.2   0.2   0.2   0.0
2. 10.50.50.1                        0.0%     5    1.3   1.3   1.0   1.9   0.4
3. 103.99.196.29                    80.0%     5    2.2   2.2   2.2   2.2   0.0
4. 14.143.30.149.static-delhi.vsnl.  0.0%     4    1.9   1.7   1.2   1.9   0.3
5. 172.23.183.161                    0.0%     4   22.0  21.8  21.5  22.0   0.2
6. 172.31.29.194                     0.0%     4   37.5  37.4  24.1  45.0   9.4
7. 10.169.32.6                       0.0%     4   24.0  23.8  23.5  24.1   0.3

Here is another IP 10.227.105.24

This ones in Vijayawada. I have seen these IPs with locations in Kerala, Bihar, Karnataka, Maharashtra pretty much all over India. Most of these are in Banks/Financial Corps.

NONE OF THESE REQUIRE ANY AUTHENTICATION THOUGH IT DOES HAVE AUTH FOR HIGHER LEVEL ACCESS

Here is the traceroute to this IP:

Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev
1. router.lan                        0.0%     4    0.2   0.2   0.2   0.2   0.0
2. 10.50.50.1                        0.0%     3    1.3   1.7   1.0   2.7   0.9
3. 103.99.196.29                    50.0%     3    2.7   2.7   2.7   2.7   0.0
4. 14.143.30.149.static-delhi.vsnl.  0.0%     3    1.9   1.8   1.7   1.9   0.1
5. 172.23.193.245                    0.0%     3   24.2  26.4  24.2  28.0   1.9
6. 172.31.235.6                      0.0%     3   32.0  32.2  32.0  32.3   0.2
7. 10.227.105.24                     0.0%     3   32.7  34.7  32.7  36.7   2.8

Anyone here know why these IPs are accessible?

 

[vignesh_venkatesan]

It seems like wireless cpe for corporate customers.
So devices skip authentication when accesed locally.

 

[JB701]

Looks like it, some other IPs have these. Most of them have the OFDM thingy.

 

[JB701]

So I traceroute scanned all the IPs that are responding to pings (~32000 hosts) and exported it to XML, then put it in ZenMap for topology map. Went about as well as expected.