Onion Routing Report

3380-1 (CFNOC/DND CIRT) 09 Jul 06 NOS O (via CoC) I&W ANALYSIS - ONION ROUTING AND "TOR" INTRODUCTION 1. (U) As of late, there has been much discussion in both the internet and hacking communities regarding "Onion Routing" (hereafter referred to as "OR") and an open source OR implementation designated "TOR". 2.

(U) Both OR and TOR are specifically designed to: a. provide anonymous internet connections (obfuscation of communication end points, resistance to eavesdropping/packet sniffing and traffic analysis prevention); and b. provide a facility for "hidden servers".1

Anonymous Internet Connections 3. (U) Users of the TOR network run an "Onion Proxy" on their machine; this proxy connects to the TOR network, periodically negotiating a virtual circuit through which the data will be forwarded; this proxy can either be implemented using software or a shim in the OS' network stack. 4. (U) TOR employs public key cryptography in a layered manner (hence the 'onion' analogy), ensuring perfect forward secrecy (PFS)2 between routers. At the same time, the Onion Proxy software presents a SOCKS3 interface to its clients; SOCKS-aware applications may then be pointed at TOR, which then multiplexes the traffic through a TOR virtual circuit. 5. (U) Once inside the TOR network, the traffic is sent from router to router, ultimately reaching an exit node at which point the unencrypted packet is forwarded on to its original destination. Viewed from the destination, the traffic appears to originate at the TOR exit node. 6. (U) In addition to anonymous routing, TOR is often coupled with Privoxy (a filtering proxy server) when browsing the web; use of Privoxy provides additional anonymization at the Application Layer.

1

2

3

A hidden server is one that is hosted on a machine that also acts as an active onion router; the nature of OR is such that clients can connect to the server without actually knowing its location. A key-establishment facility used to secure private network communications; with PFS, if one encryption key is compromised only data encrypted by that specific key is compromised. For PFS to exist, the key used to protect transmission of data must not be used to derive any additional keys. A protocol for handling TCP traffic through a proxy server. SOCKS can be used with virtually any TCP application; the protocol is documented in RFC 1928, RFC 1929 and RFC 1961.

1

Hidden Servers 7. (U) Although TOR's most popular feature is its provision of anonymity to clients, it can also provide anonymity to servers. Using the TOR network, it is possible to host servers in such a way that their network location is unknown. 8. (U) Hidden servers are accessed through the TOR-specific ".onion" top level domain (TLD). The TOR network understands this TLD and provides an anonymous route to the hidden server; the hidden server then hands client requests over to standard server software. The TOR Menace 9. (U) As demonstrated in Annex A, interest in TOR has risen significantly in recent months; this has seen roughly a 154% increase in the available TOR nodes since November 2005; TOR is receiving considerable media attention, particularly in network security/hacking circles. 10. (U) Considering the open source nature of TOR, the sudden upswing in its popularity, the fact that TOR can be used for any TCP based application and the discussions taking place on various hacking websites/IRC channels, it is only a matter of time before hostile entities begin to use the technology for directed network reconnaissance and attacks. AIM 11.

(U) The purpose of this report is three fold: a. to convey information regarding OR and TOR in order that the reader may understand the concepts involved with the technology; b. to convey information regarding the potential threat TOR poses to the organization's network assets; and c. provide recommendations to defend our network assets from hostile entities that may make use the TOR network to conduct network reconnaissance and attack.

DISCUSSION OR Concepts & Technologies 12. (U) Prior to explaining OR and TOR, one must be aware of the three basic concepts/technologies used in its design; these are: a. traffic proxies; b. public key cryptography; and c. Chaum Mixes.

2

Traffic Proxy 13. (U) A traffic proxy is a host that is placed between a client and another server and intercepts the network session. The proxy handles the traffic exchanged to and from the client, making the connection to the server on the client's behalf. As demonstrated in Annex C, the client never touches the remote server directly and remains anonymous. 14. (U) Although the traffic proxies are easily implemented, there are several weaknesses that render its anonymization useless to a determined adversary. These include: a. the proxy provides a single point of failure, compromise and/or attack; b. link encryption is not inherent - traffic being passed between the client and the proxy is subject to intercept and/or analysis; and c. routing information is conveyed unencrypted - the proxy is always aware of the source and destination of the connection request. Public Key Cryptography 15. (U) Public Key Cryptography is a cryptographic system invented in 1976 by Whitfield Diffie and Martin Hellman that utilizes two types of keys: a. a public key known to everyone - the recipient's public key is used to encrypt the message; and b. a secret key known only to the recipient of the message - the recipient uses the private key to decrypt the message. 16. (U) The public and private keys are related in such a way that only the public key can be utilized for encryption and only the corresponding private key can be used for decryption; in addition, it is virtually impossible to derive the private key even if an one possesses the public key. 17. (U) Public Key Cryptography is used in both Chaum Mixes and OR in order to provide a level of anonymity by encrypting data and/or routing information. The Chaum Mix 18. (U) The spark that led to the development of the OR's initial concept can be found in a whitepaper regarding anonymous e-mail transmission authored by Dr. David Chaum in 1981. 19. (U) In his paper, Dr. Chaum presented a system for anonymous E-mail communication using public key cryptography and an network consisting of a large number of what he called "Mix Nodes" (basically a special e-mail proxy); a simplified diagram of a Chaum Mix Network is demonstrated in Annex D.

3

20. (U) Mix Nodes accept e-mails encrypted with the node's public key, decrypts them, places them into a transmission queue for an arbitrary period of time and then forwards them to the next Mix Node in the circuit. When the final Mix Node is reached, the final layer of encryption is removed and the e-mail is forwarded to the recipient. 21. (U) The OR technique builds upon Dr. Chaum's initial work in the anonymization of e-mail traffic and expands the concept, allowing for the anonymization of virtually any TCP based application. OR 101 - An Introduction to Onion Routing



22. (U) Contrary to popular belief, use of a switched communication network does not preclude anonymity. The OR technique, developed by the U.S. military in the late 1990s, allows for anonymous communications over packet switched networks such as the Internet. 23. (U) OR was originally developed to serve as a flexible switched communications infrastructure that would be resistant to both packet sniffing and traffic analysis; this was accomplished by separating the packet's identification information from its routing information and the use of encryption. 24. (U) OR uses generic networking/proxy techniques and a variation of the Chaum Mix to protect both the privacy and anonymity of communication channels. Using OR technology, connections are always anonymous; any information being conveyed may also be rendered anonymous by purging identifying information from the data stream. 25. (U) Though originally designed to run on Solaris 2.5/2.6, the current version (TOR) is easily implemented in a variety of operating systems and can be employed in a wide variety of TCP based Internet applications (e.g. web browsing/publishing, FTP, IRC, IM, etc.); TOR will be discussed further below. 26. (U) When the initiator endpoint wishes to establish an anonymous connection to a host, it first connects to a SOCKS proxy; the SOCKS proxy accepts protocolspecific connections from applications and converts them into a generic routable protocol. 27. (U) Once this is done, the packets are forwarded to an "Onion Proxy". The Onion Proxy then creates a route over the "onion network" and constructs a special data structure known as the "initial onion". Once the onion is constructed, it is passed to the TOR overlay network. 28. (U) When an onion router receives an onion, the outer layer is decrypted, revealing a layer containing information about the next hop in the route; this layer is then discarded and the onion forwarded on to this next hop in the circuit. 29. (U) Eventually the onion will reach the final hop on the overlay network, known as an "Exit Node". The final layer of the onion will then be decrypted revealing the original data packet; this packet will then be forwarded to the recipient endpoint. 30. (U) A simplified diagram of the onion decode and forward process can be found in Annex E.

4

OR 201 - Enter TOR



31. (U) TOR, the latest incarnation of OR, is easily implemented on a plethora of platforms (Windows, *nix, BSD, etc.). In addition, virtually any unmodified SOCKS compatible TCP/IP based application can use TOR either by means of a proxy or by shimming the network protocol stack of the host. 32. (U) In order to create a private network pathway with TOR, a circuit of encrypted connections is built incrementally, extending the circuit one node at a time as demonstrated in Annex F. 33. (U) Each node in the TOR circuit knows only which node forwarded it data and to which node it is forwarding data - no individual node knows the complete path that a data packet has taken. The onion proxy negotiates a separate set of encryption keys for each hop along the circuit to ensure that the routing information remains anonymous along each hop. 34. (U) Once a TOR circuit has been established, any SOCKS compliant TCP based communication can be transmitted over the circuit. As each server sees no more than a single hop in the circuit, neither sniffing nor the compromise of an individual onion router will reveal the endpoints of the connection. 35. (U) In order to prevent abuse, each TOR node's "exit-policy" (a form of ACL4 An example of the default TOR exit policy is demonstrated in Annex H) can be configured to selectively deny or allow access to external addresses and services. Despite this feature, it is worth noting that there are potentially hundreds of "open exit nodes"5 that allow full connectivity to any resource using any service. 36.

(U) The advantages of using TOR over other anonymizing solutions include but are not limited to: a. anonymity is further enhanced as single anonymous circuits are shared with multiple TCP streams; b. TOR is compatible with all SOCKS compliant applications; c. flexible "Exit Policies" allow each node to choose what applications can use the node and where the node can reach; d. "Hidden Servers" are easily implemented; e. TOR provides "Perfect Forward Secrecy"; f. traffic replay attacks are rendered impotent; and g. TOR implements robust communications circuits; unlike normal "single hop" proxies, no single point of failure exists. 4

Most network security systems operate by allowing selective use of services. An Access Control List (ACL) is the usual means by which access to, and denial of, services is controlled; it is simply a list of the services available, each with a list of the hosts permitted to use the service.

5

On an Onion Network, the node at which point the cleartext packet is available and is forwarded on to its final destination; viewed from the destination, the traffic appears to originate at the Tor exit node's IP address.

5

37. (U) The potential threat of Onion Routing lies in its ability to allow attackers to conduct completely anonymous reconnaissance and attacks directed at remote networks. 38. (U) TOR is specifically designed to stymie analysis attempts; considering this, anonymous reconnaissance and attacks could conceivably be directed network assets at the whim of an attacker while at the same time hindering the victim's incident analysis and response efforts. CONCLUSIONS & RECOMMENDATIONS A "Clear and Present Danger" 39. (U) TOR, with its increasing popularity and recent exposure in various hacking/computer security media, poses a clear and present danger to the organization's network assets. 40. (U) In addition to its increased public exposure, hundreds of unverified TOR nodes have appeared since November 2005; the appearance of these nodes be an indicator of increased untoward activity. 41. (U) As the TOR network is a public and the software is open source, belligerent nations could conceivably utilize TOR or deploy hidden servers that could be used specifically to conduct anonymous attacks/reconnaissance against the organization's network assets. 42. (U) In addition to the anonymity provided by the TOR network, any attacks routed through it that would be resistant to most analysis techniques, greatly hindering both analysis and incident response. 43.

(U) Considering the above, it is hereby recommended that: a. primary TOR nodes be immediately blocked at the network perimeter (a partial list of primary TOR nodes can be found in annex X); b. "rogue" TOR nodes be blocked at the network perimeter as they are identified; and c. online monitoring of the appropriate online resources (e.g. http://serifos.eecs.harvard.edu/cgi-bin/exit.pl) be undertaken to block new primary TOR nodes as they come online.

6

44. (U) Any questions regarding this report may be addressed to the undersigned. //signed// E.L. Mac Daibhidh, CD Cpl Special Operations Analyst DND CIRT IH&AA Team Special Operations Cell 945-7747 Attachments: References Annexes A-H

7

8

References: Chaum, Dr. David. Communications of the ACM, Volume 24 Number 2. "Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms". Febuary 1981. Accessed on 1 July 2006. www.freehaven.net/anonbib/cache/chaum-mix.pdf. Darknet Administrator. "Anonymity - Hiding Your Identity in 2006". 16 May 2006. Accessed on 17 May 2006. http://www.darknet.org.uk/2006/05/anonymity-hidingyour-identity-in-2006/. Danezis, George. "Anonymous Communications I". Date unknown. Accessed on 17 June 2006. www.ccc.de/congress/2004/fahrplan/ files/355-anonymous-communication-slides.pdf.

Dhanjani, Nitesh. "Launching Attacks via Tor". 10 July 2005. Accessed on 02 June 2006. http://www.oreillynet.com/pub/wlg/7333. Dhanjani, Nitesh. "Tor: An Anonymous Internet Communication System". 20 January 2005. Accessed on 02 June 2006. http://www.oreillynet.com/onlamp/blog/2005/01 /tor_an_anonymous_internet_comm.html. Dingledine et al. "Tor: The Second Generaton Onion Router". August 2005. Accessed on 25 May 2006. http://www.onion-router.net/Publications/tor-design.pdf. Harrison, Ann. "Onion Routing Averts Prying Eyes". 05 August 2004. Accessed on 03 Mar 2005. http://www.wired.com/news/privacy/0,1848,64464,00.html.

Hasuo, Ichiro. "Provable Anonymity". 27 May 2005. Accessed on 30 June 2006. www.cs.ru.nl/~ichiro/talks/spanWorkshop.pdf. Holer, Vlastimil. "Practical Onion Routing". Date unknown. Accessed on 20 June 2006. www.fi.muni.cz/~xholer/content/school/tor/poster.pdf. Infosecninja Administrator. "Anonymizing network traffic using TOR". 28 Jun 2005. Accessed on 31 May 2006. http://www.infosecninja.org/content/view/16/28/. Leech et al. "RFC1928 - 'SOCKS Protocol Version 5'". March 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1928.txt. Leech, M. "RFC1929 - 'Username/Password Authentication for SOCKS V5'". March 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1929.txt. McMahon, P. "RFC1961 - 'GSS-API Authentication Method for SOCKS Version 5'". June 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1961.txt. Noreply Wiki. "TheOnionRouter/TorFAQ" (sic). Last edited on 04 June 2006. Accessed on 05 June 2006. http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ.  O'Morain et al. "Onion Routing for Anonymous Communications". Date unknown. Accessed on 01 June 2006. http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group10/index.html. Permeo Technologies, Inc. "SOCKS Overview". 2005. Accessed on 31 May 2006. http://www.socks.permeo.com/AboutSOCKS/SOCKSOverview.asp.

i

Reed et al. "Anonymous Connections and Onion Routing". 1998. Accessed on 25 May 2006. http://www.onion-router.net/Publications/JSAC-1998.pdf. Security Focus. In Focus "Pen-Test" Forum. "Pen-Testing via TOR". Last reply on 22 July 2005. Accessed on 30 May 2006. http://www.securityfocus.com/archive/101 /406003/30/0/threaded. Stanford et al. "TheOnionRouter - NoreplyWiki" (sic). Last edited on 19 May 2006. Accessed on 26 May 2006. http://wiki.noreply.org/noreply/TheOnionRouter. U.S. Naval Research Laboratory. "Onion Routing - Executive Summary". November 2003. Accessed on 02 May 2006. http://www.onion-router.net/Summary.html. "Weasel". "Anonymous Remailer Stats, Meta-Stats and other Information". 16 May 2006. Accessed on 16 May 2006. http://www.noreply.org/tor-runningrouters/totalLong.html. Wikipedia.org. "Onion Routing". Last edited on 10 May 2006. Accessed on 11 May 2006. http://en.wikipedia.org/wiki/Onion_routing.

 Wikipedia.org. "Tor (anonymity network)" (sic). Last edited on 30 May 2006. Accessed on 08 May 2006. http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29.

ii

(U) ANNEX A - Available TOR Routers (May 2004 - May 2006) This graph, obtained from the Noreply website, clearly demonstrates the increase in available TOR nodes since May 2004.

A-1

(U) ANNEX B - TOR Network Data Throughput (May 2004 - May 2006) This graph, obtained from the Noreply website, clearly demonstrates the increase in TOR traffic that has been directly proportional to the increase in TOR nodes.

A-2

(U) ANNEX C - Rudimentary Anonymizing Proxy The diagram below demonstrates a rudimentary anonymizing proxy. Connections routed through the proxy appear to originate from the proxy and not from the endpoint host.

Advantages: • •

Simple implementation. Focuses traffic to enhance anonymity.

Disadvantages: • •

Single point of failure, compromise and attack. Link encryption is not inherent, proxy is always aware of the source and destination of the connection request.

A-3

(U) ANNEX D - Simplified Chaum Mix-Net Initiator Endpoint

Internet Cloud MIX 1

C(1) C(2)

Message

MIX 2

Proxies the traffic from the initiating endpoint to obfuscate its identity.

Proxies the traffic from MIX 1 to obfuscate its identity.

Decrypts C(1) with its secret key.

Decrypts C(2) with its secret key.

Changes identifying information within the e-mail header (FROM, TO, etc.).

Changes identifying information within the e-mail header (FROM, TO, etc.).

Message is placed in a transmission queue to add a random delay to the next hop.

Message is placed in a transmission queue to add a random delay to the next hop.

The message, still encrypted with C(2) is forwarded to the next mix.

The unencrupted message is forwarded to the destination endpoint. .

Destination Endpoint

A simplified diagram of a simple Chaum Mix-Net is demonstrated above. The initiating endpoint first encrypts the email with the public key for the last Mix in the circuit and then encrypts it again with the public key for the first hop in the circuit. The e-mail is then sent to the first Mix on the Mix-Net, which proxies the email on behalf of the sender, thereby obfuscating the location of the initiator. The email is then decrypted with the Mix's secret key and any identifying information is stripped from the e-mail headers. The e-mail, still encrypted with C(2) is then placed in an arbitrary transmission queue where it is held for a random amount of time then forwarded to the last Mix in the circuit. On arrival at the final Mix, this process is repeated and the original e-mail, now stripped of all identifying information, is forwarded to the destination endpoint.

A-4

(U) ANNEX E - The Onion Decrypt and Forward Process

Onion forwarded to second hop.

Initial Onion forwarded to hop one. The first router decrypts the C[1] layer using its private key in order to find the IP address of the next router in the circuit and encrypted data.

The router located at the second hop will decrypt the C[2] layer using its private key in order to find the IP address of the final router in the circuit and encrypted data.

Data forwarded from final hop to recipient endpoint.

Onion forwarded to final hop. The router located at the final hop will decrypt the C[3] layer using its private key in order to find the unencrypted data packet.

The router located at the final hop forwards the unencrypted data packet to the recipient endpoint outside the OR cloud.

The diagram above demonstrates the initial onion generated for a two-hop trip through the OR cloud and the actions taken as the onion travels along each hop. After the Onion Proxy determines the route the data will take through the OR cloud, it constructs an initial onion which consists of a payload and routing information surrounded by layers of encryption. At each hop along the circuit, another layer of the onion is decrypted, revealing the next destination in the communications link; once the final l hop of the circuit is completed, the last onion router decrypts the final layer of routing information and forwards the data to the recipient endpoint.

A-5

(U) ANNEX F - Onion Routing Circuit Configuration

The simplified diagram above demonstrates the basic configuration of an OR circuit through multiple Onion Routers from the initiator endpoint to the recipient endpoint. The SOCKS proxy accepts protocol-specific connections from applications on behalf of the client (the initiator endpoint), and converts them into a generic protocol (such as a stripped down SOCKS protocol); the data packets are then forwarded to the onion proxy. The onion proxy is aware of the OR network topography and determines the path the data will take through the cloud and constructs a the initial onion.

A-6

(U) ANNEX G - TOR Telescoping Circuit

Onion routers form a telescoping "overlay" network and combine the use of proxies and mixes in order to ensure the anonymity of the communication link; note that this does not involve the anonymization of the underlying information. The diagram below demonstrates a simplified version of OR's telescoping circuit setup process.

A-7

(U) ANNEX H - Default TOR Exit Policy TOR's default exit policy is demonstrated below. The syntax of each policy rule is "accept|reject ADDR[/MASK]:PORT". An asterisk is used as the policy wildcard; if "/MASK" is omitted then the rule applies solely to the IP address in the rule.

Default TOR Exit Policy: reject 0.0.0.0/8 reject 169.254.0.0/16 reject 127.0.0.0/8 reject 192.168.0.0/16 reject 10.0.0.0/8 reject 172.16.0.0/12 accept *:20-22 accept *:53 accept *:79-81 accept *:110 accept *:143 accept *:443 accept *:706 accept *:873 accept *:993 accept *:995 reject *:1214 reject *:4661-4666 reject *:6346-6429 reject *:6881-6999 accept *:1024-65535 reject *:*

A-8

(U) ANNEX I - Known Primary TOR Nodes (02 Jun 2006) Country Node Designation Code AT AT attnjupiter AT euripides AT kronegger AT linzfrank AT mundl AT nickthephreak AT no0borders AT scgghjtywbtzda9yzi AT tor26 AU AU nexus AU psion AU wokwaixtor BE BE blueaqua BE justatorserver BG BG thunder BR BR poderosotor CA CA biffhenderson CA citlabwin32 CA comfortablynumb CA computer CA deuxpi CA gatekeeper CA gingkobiloba CA kgn9yct9 CA leafs CA lionstooth CA lostwizard CA mick CA mozgotor CA mytor654321 CA nachocheese CA necroscop CA paliandroid CA scooby CA sod CA telostor CA testamentpantera CA tortorcan65 CA turdburglar CA vedant

Node IP Address

Node Net Name

80.120.3.32 62.178.28.11 83.65.91.110 140.78.95.135 195.230.168.95 86.56.195.211 83.64.135.124 217.196.64.205 86.59.21.38

TZA-HWY-AT VIE-11-CUSTOMERS-DOCSIS Dieter-Kronegger JKU-LAN ICB-NET AT-LIWEST-HEADEND-86-56-19 Textdesign-GmbH FUNKNETZ-DSL-CUST-1 SIL-ALFIE

202.173.141.155 220.233.6.198 203.59.165.124

WestNet EXETEL IINET-AU

213.219.164.163 81.11.162.171

BE-EDP-20000830 PI-BELGIUM

217.79.72.59

D-D-SOFTSYSTEM-VARNA-BG-NE

200.222.114.90

AS7738

65.92.65.203 128.100.171.34 216.194.67.53 70.27.181.246 66.11.179.38 66.130.125.131 216.239.83.223 69.194.143.65 70.53.93.156 64.26.169.184 198.161.91.196 69.70.104.213 142.167.19.244 72.0.207.216 24.80.166.229 24.36.207.144 64.230.24.153 72.60.167.5 24.36.129.106 70.68.168.93 65.38.64.204 24.42.92.42 69.156.56.175 65.49.223.229

NEXHSE6-CA TORONTO TERA-BYTE-3 DOC-4-8-1-1-WLFDLE-3 PEER1-DONCASTER-BLK1 VL-D-MT-42827D00 VIF-BLK-1 DOC-1-8-1-2-WLFDLE-3 SYMF20051102-CA MAGMA-BLK3 LEXICOM-AB VL-D-SC-45466800 ALIANT-TEL-142-167 EBOX-24207072-CA SHAW-COMM CGOC-OAWH5 NEX100704-CA DOC-2-7-1-2-ETOB-2 CGOC-SACO3 SHAW-COMM GLOBALE-1 DOC-1-5-0-2-BLOOR-2 SYMV0129-CA DOC-4-8-0-0-MTNK-2

A-9

CA CA CA CH CH CH CH CH CH CH CH CH CH CN CN CN CN CN CN CN CN CN CN CN CN CN CN CN CN CN CN CN `CN CN CN CN CN CZ CZ CZ CZ CZ DE DE DE DE DE DE DE DE

yoda zenten zz9plural9zalpha

24.68.0.201 70.27.5.5 70.82.218.182

SHAW-COMM DOC-3-7-0-0-SLNT-2 VL-D-MU-4652DA00

b17a21c8 crayzzytor fno42rd makemefree milkya64 mjollnir *n37gu3r1lla obrii tigerlaptop

80.74.144.159 83.228.142.189 217.14.64.70 80.242.195.68 84.72.104.77 84.227.224.47 85.0.173.159 62.2.174.20 85.218.24.143

METANET VTX-ADSL-ACCESS BBI-WMC GLATTNET-NET CABLECOMMAIN-NET SUNRISE-ADSL BLUEWINNET CABLECOMMAIN-NET SIMA-NET-1

chenkeikari dayqz dee deepin *distro fgsinternet flyingboy glrum2970 hj jlkjl lebut lori mlogictor monkey moonese oldwatch prism terminal2000 welcometothejungle2 whocaresfreedom2 wysiwyg yass zen

222.212.61.48 61.177.200.173 221.5.239.212 221.5.239.161 61.242.102.18 211.94.188.225 166.111.249.39 222.94.8.209 222.94.174.148 222.33.219.5 221.137.6.171 60.63.126.72 218.58.83.164 58.33.130.199 218.0.209.97 218.242.93.172 221.0.32.66 218.9.121.242 159.226.169.121 222.212.225.29 222.28.80.131 222.94.224.22 218.20.159.95

CHINANET-SC CHINANET-JS CNCGROUP-CQ CNCGROUP-CQ UNICOM CNNIC TUNET CHINANET-JS CHINANET-JS CRTC COLNET COLNET CNCGROUP-SD CHINANET-SH-BBAD-190 CHINANET-ZJ-HZ COLNET CNCGROUP-SD CNCGROUP-HL NCFC CHINANET-SC BLCUB-CN CHINANET-JS CHINANET-GD

fitor1 iraq nikon2704 redemptor

147.251.52.140 81.0.225.179 83.208.14.29 213.220.233.15

MUNI HYPERREAL-CZ NEXTEL-XDSL UPC-BROADBAND-XIII

1898 1984jhb 23foobar42 686e aaf9200ab4053a5d19c ai48373 amnesty

85.178.203.21 84.58.249.136 80.143.147.175 80.190.241.118 88.217.34.146 80.86.191.107 81.169.130.130

HANSENET-ADSL ARCOR-DSL-NET13 DTAG-DIAL16 IPX-Server-NET DE-MNET-20051123 LNC-AIHS-NET-GMBH2 STRATO-RZG-DED

A-10

DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE

andromeda anon579401375 anonymousbalsercc anpnym antiterrorkrieg b0red b9ivvwkf774ff2n7cvk babylon5 baphomet beershakes bellum bembelgott biafra bigbadbertfw bigwormhole bitnatter biz18 bmwanon calypso camperquake carryitcrossthesea ccc2 cce12eb07e2d92a7 chaba chaoscomputerclub charon chimaera chrism commodore64 corelogics cptnem0 cromacserver cweiske d2921 daedalus dasflinkewiesel dastorzurwelt datenhalde datentrampelpfad deepquest devilproxytor df37134371e64eb diegedankensindfrei dl3daz dogfy dreckskind dtick einfallstor eingangstor emzy

82.149.72.85 84.61.54.237 62.75.129.201 217.160.177.118 85.214.29.61 80.190.250.83 81.169.183.70 217.172.187.46 81.169.136.161 213.239.202.232 62.75.222.205 81.169.166.136 84.16.234.153 84.154.193.106 212.12.60.181 212.202.53.91 84.167.14.205 85.25.132.119 217.190.230.122 212.51.10.6 84.60.99.253 85.214.59.14 213.133.99.185 84.169.124.87 80.237.206.93 195.158.168.91 212.112.241.137 217.160.135.169 137.226.59.249 217.20.118.156 194.97.49.42 81.169.171.90 80.237.146.62 84.142.176.142 84.157.147.155 217.187.159.113 87.123.75.227 212.112.235.83 81.169.177.134 80.130.140.13 213.39.155.121 62.158.45.235 85.177.235.33 217.160.167.28 212.114.250.252 217.160.220.28 217.20.117.240 212.112.241.159 217.224.189.216 212.112.242.21

A-11

IPX-SMK-NETWORKS-NET-DE ARCOR-DSL-NET13 BALSER1 SCHLUND-CUSTOMERS DE-TECT-20050224 IPX-Server-NET STRATO-RZG-DED SERVER4YOU-1 STRATO-RZG-DED HETZNER-RZ-NBG-NET2 SERVER4YOU-1 STRATO-RZG-DED NETDIRECT-NET DTAG-DIAL20 AGALTENBERGER-NET HOME-DYNAMIC-NET DTAG-DIAL20 SERVER4YOU-1 TEDE-UNIFIED ADDIX-CUST1-KIEL-NET ARCOR-DSL-NET13 DE-TECT-20050224 HETZNER-RZ-NBG-NET DTAG-DIAL20 HE-DEDIC-CGN-206 HOME-DYNAMIC-NET IPX-Server-NET SCHLUND-CUSTOMERS ACHSES NETDIRECT-NET ROESENER-NET STRATO-RZG-DED DDS-NET DTAG-DIAL20 DTAG-DIAL20 DE-MEDIAWAYS-20010314 VT-DYNAMICPOOL IPX-Server-NET STRATO-RZG-DED DTAG-DIAL16 HANSENET DTAG-DIAL8 HANSENET-ADSL SCHLUND-CUSTOMERS NEFKOM-DSL2 SCHLUND-CUSTOMERS NETDIRECT-NET IPX-Server-NET DTAG-DIAL15 IPX-Server-NET

DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE

enterprise fastfashion feh fengor foebud freedomandprivacy frell2 fs2lsk220 fsd13d24bge g3power georglutz glouklack good2bking gumba8786server gwaihir h5922 heaven helios hendi1 historserver hoppelgaloppel iapetus ididnoteditheconfig ihackforfood iku impersonator infodn itlnettor1 jap jnz juchadcod8 karotte keenmind kiu112 koehntopp2 kolrabi kozmix krypton lanroamer lincserv lostpackets lowhome01 lunkwillstor lysander maconion26 marvin maximatornew michik morefreedom morgentau

193.201.52.136 212.112.228.2 217.160.108.109 81.169.176.178 85.31.186.86 62.75.184.254 85.10.240.250 217.189.246.169 84.141.182.215 84.56.132.211 85.214.18.185 85.31.187.90 84.146.144.89 213.239.217.146 84.16.236.83 81.169.176.135 193.239.165.73 212.202.202.39 81.169.168.38 212.202.233.2 84.61.155.3 134.130.58.205 89.54.109.214 131.220.141.131 212.88.142.147 84.56.184.214 212.168.190.8 62.75.218.130 141.76.46.90 85.31.187.84 213.239.212.133 88.198.253.18 84.19.181.66 62.75.241.48 85.214.44.126 217.160.95.117 85.10.195.106 212.37.39.59 85.14.217.228 62.224.62.226 81.169.180.180 62.75.162.252 84.57.64.143 85.14.216.20 62.141.39.14 80.190.242.122 212.112.242.159 84.16.235.143 212.202.78.170 83.171.190.170

A-12

FIRSTHOP-NET IPX-Server-NET SCHLUND-CUSTOMERS STRATO-RZG-DED ISPPRO-RZJ1-NET VSERVER-1 Lampe-Net DE-MEDIAWAYS-20010314 DTAG-DIAL20 ARCOR-DSL-NET12 DE-TECT-20050224 ISPPRO-RZJ1-NET DTAG-DIAL20 HETZNER-RZ-NBG-NET NETDIREKT-STAR-HOSTING STRATO-RZG-DED FKSIP-NET HOME-DYNAMIC-NET STRATO-RZG-DED QSC-CUSTOMER-548140-280988 ARCOR-DSL-NET14 ACHSE STRATO-POOL-NET UNI-BONN IKU-NET1 ARCOR-DSL-NET12 VIADE-DSL-NET DE-INTERGENIA-20010727 TUDINF-LAN ISPPRO-RZJ1-NET HETZNER-RZ-NBG-NET DE-HETZNER-20051227 DE-KEYWEB-II VSERVER-1 DE-TECT-20050224 SCHLUND-CUSTOMERS HETZNER-RZ-NBG-NET HAMCOM-GMBH UNITEDCOLO DTAG-DIAL1 STRATO-RZG-DED VSERVER-1 ARCOR-DSL-NET12 UNITEDCOLO FASTIT-DE-DUS1-COLO1 IPX-Server-NET IPX-Server-NET NETDIRECT-NET HOME-DYNAMIC-NET MNET-DSL

DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE

mxo mysecretserv mystiqx nanobot narnia nebulawikia ned neskaya netzhure newtoruser nobodyeditedaconfig nocabal noctednachos nt oas1 ohnetoreinthor ouagadougou partytool pax pegasus peterp1701 prescher pw quousquetandem r4g3 rainbow raptor2 ratte ravenslaptop redgene reversed rootkit roundabout s02 sanders saturn schmaller schnarpf2nd sechole seniorix serverbox sharktooth sic4gh sikamikanico siliconverl snoopy so19charsismax somebody sparced squirrel

81.169.171.105 213.202.217.164 217.84.1.6 88.73.15.46 85.119.156.72 80.134.253.148 80.190.251.24 81.169.181.10 80.244.242.127 87.122.14.230 85.10.194.117 212.227.20.86 131.246.89.15 84.165.162.55 213.200.90.122 84.160.124.51 213.239.212.45 84.145.172.206 217.172.183.219 137.226.181.149 212.227.108.114 85.16.0.4 88.84.139.250 85.178.70.48 80.130.228.153 80.243.60.137 85.14.220.126 212.202.193.62 84.184.119.159 85.31.186.61 217.172.49.89 213.203.214.130 81.169.178.215 84.16.233.47 217.172.50.130 85.214.49.175 217.80.83.203 195.37.132.28 85.14.220.165 62.141.42.179 213.39.128.232 213.239.194.175 84.172.106.156 82.82.69.203 195.71.99.214 80.143.156.153 85.214.29.9 80.135.50.29 217.160.170.132 213.146.114.96

A-13

STRATO-RZG-DED UNITEDCOLO DTAG-DIAL14 ARCOR-DSL-NET15 INTERNETUNIVERSUM-VPS-NET DTAG-DIAL16 IPX-Server-NET STRATO-RZG-DED moritz-augsburger-de-net VT-DYNAMICPOOL HETZNER-RZ-NBG-NET SCHLUND-CUSTOMERS RHRK-LAN DTAG-DIAL20 OLE-TINET DTAG-DIAL20 HETZNER-RZ-NBG-NET DTAG-DIAL20 SERVER4YOU-1 ACHSES SCHLUND-CUSTOMERS EWETEL-DYNDSL-POOL6 IXEUROPE-1BLU-2 HANSENET-ADSL DTAG-DIAL16 DE-ENVIA-TEL-20011029 UNITEDCOLO HOME-DYNAMIC-NET DTAG-DIAL20 ISPPRO-RZJ1-NET GIGAHOSTING-NET DE-CEITSYSTEMS STRATO-RZG-DED NETDIRECT-NET GIGAHOSTING-NET DE-TECT-20050224 DTAG-DIAL14 IN-FRANKEN-III UNITEDCOLO FASTIT-DE-DUS1-COLO1 HANSENET HETZNER-RZ-NBG-NET2 DTAG-DIAL20 ARCOR-DSL-NET2 MWAYS-HEADQUARTER DTAG-DIAL16 DE-TECT-20050224 DTAG-DIAL16 SCHLUND-CUSTOMERS KAMP-DSL-NET

DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DE DK DK DK DK EE EE EE ES ES ES ES FI

stasiserver stnv stop1984 stop1984now surfingsamurai theeternalpowerami tilde0ne tokra tomaslander toratcdtmde torpaulianer torproxyblnger2 tortortor torwart torxunixguxru trooper tunnelreality turing2006 universi8d3c39 unterwachung vidalia visnator waabbeel waerternet wannabe wirsindhaftbar wlmxwalnueb6s6z5gyw wor workshop2 wormhole wuschelpuschel xsteadfastx yaap yetanothertorserver zbvis ztor2 ztor3 zwiebelfissh

81.169.174.124 84.16.236.173 141.76.7.58 88.73.74.148 212.112.231.99 217.160.219.14 84.58.9.222 80.139.152.94 89.49.169.65 129.187.150.131 89.110.144.180 85.178.86.28 84.19.187.11 217.160.134.33 85.31.186.26 84.152.125.104 84.169.105.217 217.84.162.106 141.35.122.98 213.239.212.206 84.60.132.2 85.10.226.188 85.25.141.60 217.160.109.40 195.137.213.113 80.190.243.158 88.84.130.170 85.182.31.75 134.169.164.172 84.19.182.23 212.112.235.78 85.25.66.203 62.75.185.15 193.201.54.32 80.145.153.46 81.169.158.102 217.160.203.26 217.160.176.49

STRATO-RZG-DED NETDIREKT-STAR-HOSTING TUDINF-LAN ARCOR-DSL-NET15 IPX-Server-NET SCHLUND-CUSTOMERS ARCOR-DSL-NET13 DTAG-DIAL16 FREENET-POOL-NET LRZ-MUNICH-NET NCL-NET HANSENET-ADSL DE-KEYWEB-II SCHLUND-CUSTOMERS ISPPRO-RZJ1-NET DTAG-DIAL20 DTAG-DIAL20 DTAG-DIAL14 UNI-JENANET HETZNER-RZ-NBG-NET ARCOR-DSL-NET13 DE-HETZNER-20050223 SERVER4YOU-1 SCHLUND-CUSTOMERS MBBG-NET IPX-Server-NET IXEUROPE-1BLU-2 HANSENET-ADSL TU-BS DE-KEYWEB-II IPX-Server-NET NETFABRIK VSERVER-1 FIRSTHOP-NET DTAG-DIAL16 STRATO-RZG-DED SCHLUND-CUSTOMERS SCHLUND-CUSTOMERS

notexitnodedenmark protofaust raz0r

62.243.85.164 193.88.185.116 212.10.91.141

KABELTV TDC-HOSTING STOFANET-9

borism kuratkull

82.131.5.34 212.7.12.43

EE-STARMAN-CLIENTS INFONET-CABLE-MODEM-POOL3-

ddfdfdf hazel torero

83.39.161.116 85.57.129.159 84.77.48.196

RIMA UNI2-NET YACOMNET

A-14

FI FI FI FI FI FI FI FI FI FI FI FI FI FI FI FI FI FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR FR GB GB GB GB GB GB GB GB

anonrouter beaver djhasis erkkimatix esko huoneisto jyketorserver42 luthien middleguy nemeinfigw paraziteorg randomghost salottisipuli sivusto9022 spongebob vapaus2006 xtl

88.112.63.167 80.223.105.208 80.222.227.120 82.141.91.230 80.186.67.109 62.183.213.178 85.76.189.225 193.184.9.66 84.249.213.94 84.34.133.217 88.113.36.247 212.246.66.120 88.112.243.180 80.222.75.74 62.241.240.86 217.119.47.6 82.128.209.49

ELISA-ADSL SONERA-PLAZA-NET SONERA-PLAZA-NET PPO-ADSL7 ELISA-ADSL LANNENPUHELIN-NET SCIFI-DYNAMIC-ADSL MediaosakeyhtioFrantic SONERA-FINLAND-BBNET TMVVISION-NET FI-ELISA-20050824 FI-ELISA-980508 ELISA-ADSL SONERA-PLAZA-NET LOHJANPUHELIN-6 SUOMICOM-CUST-29 OPOY-NET18

bartfa24279fa4 caboulot casa chaorules charliebrown583 eyilobdabifu frenchserver ghuiol golfleme herminio hydre idontwantanickname irulanshands jiji kuanckik5 latortue marouen natmakaone rumsfeldd sbs23 titmerde tortest ubuntor user

81.251.26.110 82.244.152.77 82.230.146.52 82.238.188.44 213.41.242.132 81.56.123.123 88.136.16.177 82.66.155.32 82.67.37.163 82.233.182.73 82.225.251.113 82.227.67.108 81.56.27.175 82.216.189.240 86.214.220.139 82.231.59.44 82.235.154.172 82.235.7.49 62.212.121.77 82.238.225.133 82.225.238.47 82.233.97.149 81.57.158.21 82.254.177.202

IP2000-ADSL-BAS FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-NERIM-20020705 FR-PROXAD-ADSL CEGETEL-INTERNET-RESIDENTI FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL NUMERICABLE IP2000-ADSL-BAS FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL NERIM-ADSL-LDCOM-20020611 FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL FR-PROXAD-ADSL

atl4ntysserver buzzcoil colds7ream computer conchis crackedactor dementia

86.14.146.162 85.234.130.43 86.128.217.112 84.13.43.183 84.9.189.25 83.245.82.184 81.5.172.97

NTL PH-NETWORK-LON1 BT-CENTRAL-PLUS OPAL-DSL BULLDOG-BSH Euro1net-Net1 UK-ECLIPSE-ADSL-STATIC

A-15

GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GB GR GR GR GR HK HK HK HK HK HR HR HU HU HU HU HU IS IS IT IT IT IT IT IT IT IT IT IT IT IT

doormouse ephemer gizmoguy k lancsdesk miller mrslippery myacer penfold peregrinedontmooo pod159 prezebs prospero quaker5567 scyphtor sphere torserver8tlsk41 xtor123 xx z0rb

62.197.40.155 128.232.110.15 217.155.230.230 85.8.136.101 148.88.224.185 193.110.91.7 81.159.48.153 62.17.252.166 195.137.53.121 217.147.80.73 80.87.131.159 62.121.31.116 83.223.108.108 87.80.96.52 84.9.61.90 213.228.241.143 82.24.161.140 82.109.81.98 85.210.1.124 86.139.184.75

LNC-TH-NET CL-CAM-AC-UK ZEN000007354 NET-SERVELOCITY LANCS YOYO-NETWORKS BT-CENTRAL-PLUS MCIEIRE01 FREEDOM2SURF BLACKCAT-ADSL POSITIVE-DOLPHIN KEME-ADSL G-CUST-GS02-2 EASYNET-UKONLINE-DSL Bulldog PKXG-prodigy0 NTL MSM PIPEX-DSL-DYNAMIC BT-CENTRAL-PLUS

masquerade patra trap1

155.207.113.227 150.140.191.108 83.235.253.243

AUTH-NET PATRASNET OTENET

main nouser usethespork yt1n1rt

219.79.53.165 218.189.210.17 147.8.224.157 203.218.152.187

NETVIGATOR HGC HKUNET NETVIGATOR

apollo

195.245.255.11

OGLASNIK

0verture hutorfun naamtor spongyola

212.24.170.230 213.253.212.106 85.90.166.105 193.202.88.3

PANTEL Fofoto HU-OPTICON-20041110 CYBERSYSTEMS-NET

klaatubaradanikto

193.4.140.225

IS-SIBERIA

alessgio alverman arigatto bananajoe bestkevin enemy gege magisystem miminu molly nemesis0101

87.14.103.209 62.123.118.97 212.239.118.83 84.220.97.65 84.221.92.15 82.56.40.135 82.56.187.78 84.221.197.63 88.149.167.126 151.8.40.35 82.56.18.53

TELECOM-ADSL-7 ACEATELEFONICA RATTIADSL-NET TISCALINET TISCALINET TELECOM-ADSL-6 TELECOM-ADSL-6 TISCALINET NGI-INFR1 INFOSTRADA-CUSTOMERS-15184 TELECOM-ADSL-6

A-16

IT IT IT IT IT IT IT IT IT IT IT JP JP JP JP JP JP JP LV LV LV LV MY MY NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL NL

newnew obabakoak papinet t3xwi113r tetra4 torbis torserveritalyninf tortuga ulisse unixum xbox

151.38.93.96 194.21.56.6 80.180.110.110 151.38.231.174 159.149.57.14 83.184.179.221 88.39.72.170 62.48.34.110 83.184.189.34 84.221.65.117 84.221.204.193

IUNET-BNET38 GOLDNET TELECOM-ADSL IUNET-BNET38 UNIMINET IT-TELE2-NET2 INTERBUSINESS FLUG-NET IT-TELE2-NET2 TISCALINET TISCALINET

ddog monkeymagic nfgtor pingi plagw torjapan

59.134.15.153 60.36.181.86 219.121.56.122 219.196.60.124 60.42.135.249 219.105.111.74

KDDI-NET THEPPN ASAHI-NET BBTECH PLALA ADACHI-NET

clickety vic

4.52387E+13 83.243.88.133 62.63.190.100 86.63.172.156

Telenet TERABITS-TELIALV LV-CITYNET-20050628

gnikraf

60.48.185.41

XDSLSTREAMYX

1 aprogas arighttospeak arighttosurf ben bigwillem bloemkool ced dib0 digitalbrains dizum expander exquisite fioyaz3iuthaihiera flubber flyingdutchman freedom gompie gvg1 gvg2 isis lbeew leviathan miabonkers morgana

81.207.29.49 130.89.160.179 213.84.192.84 213.84.192.84 84.41.143.100 82.173.155.16 83.85.60.134 83.217.93.246 217.19.27.52 82.92.225.162 194.109.206.212 212.129.150.55 80.56.97.172 131.155.71.110 83.160.255.58 82.156.33.125 62.216.16.183 62.163.136.55 130.161.165.129 194.109.161.161 80.126.234.27 213.84.94.72 83.149.97.103 212.187.48.185 213.84.43.3

NL-PMG-ADSL UTNET XS4ALL XS4ALL SPEEDLINQ08 VERSATEL-CONSUMER-2 NL-CASEMA-20031128 BE-REALROOT-20040305 NL-CAMBRIUM XS4ALL NL-XS4ALL-960513 EURONET-ADSL-2 NL-CHELLO-20000509 TUENET1 NL-DEMON-20040303 WANADOO-CABLE XS4ALL AMSTERDAM-CUSTOMER-CABLE DUNET XS4ALL XS4ALL XS4ALL LEASEWEB LELYSTAD-CUSTOMER-CABLE XS4ALL

A-17

NL NL NL NL NL NL NL NL NL NL NL NL NL NL NO NO NO NO NO NO PE PE PL PL PL PL PL PL PL PL RO RO RO RO RO RU RU SE SE SE SE SE SE SE SE SE SE SE SE SE

nggrplz nightspear outerspace pristor rascalio rhw47 sabotage sec streamtime swampserver tawny tonga tornyet toronaise

194.109.109.109 193.16.154.187 131.155.141.98 80.57.244.213 145.99.247.70 212.64.16.77 195.85.225.145 192.42.113.248 195.169.149.213 80.127.66.162 80.126.44.214 82.94.251.206 137.120.180.65 137.120.180.50

amaze NL-ZYLON TUENET1 ZUTPHEN-CUSTOMER-CABLE SURFSNEL-ADSL WANADOO-CABLE-DT COLOCLUE SURFmirror WAAG XS4ALL XS4ALL colonah6 MAASNET MAASNET

ai anemonenemorosa rain slottet torzone2

85.165.49.148 84.48.64.142 129.177.234.39 80.203.211.14 128.39.141.245

NO-TELENOR-DSL-3 NEXTGENTEL-NO BERGEN-NET BJORG-METTE-H-ANTONSEN-NONTANET

cebolla43

200.121.55.151

200.121.55.151

bolanda gotodengo kriss pingwin q23bderty xau zazul

193.219.28.245 83.28.60.37 217.153.252.4 83.24.18.77 195.140.155.18 82.146.244.99 81.190.214.42

ICM-PL NEOSTRADA-ADSL MMJ-SIEMIANOWICE-PL NEOSTRADA-ADSL KOPNET-NET-PL PL-BYDMAN-20030627 MULTIMEDIA-POLSKA-8

dfdfasf elvis mikemckenzie wiseowl

86.124.64.168 86.127.228.193 88.158.182.193 82.76.242.24

RO-RDSNET-IS-IASI-CABLELIN RO-RDS-20050316 RO-EVONET RDSNET-82-76-242

neverland

85.15.185.38

TTKNET-COMINTEL-NET

3ieom3roqk7qlx boliviakopimi carcass che clomp dfghbfght545 earthbound elora eripax forantipiratbyran gnutten gogoli

80.252.209.6 83.226.210.104 85.8.4.206 81.226.218.204 87.251.197.210 87.96.132.191 85.227.10.132 84.217.70.153 83.227.72.118 85.230.154.105 213.113.166.243 217.208.47.127

BEARNET BB-BISP-STO2-SE SE-WASADATA-LKP1 TELIANET WEBTECHNORD-HELSINGBORG-NE SE-BLIXTVIK-1 SE-CYBER-20041217 GLOCALNET-SE-NET BB-BISP-DSL11-STO46-SE SE-CYBER-20041217 B2-CUSTOMERS TELIANET

A-18

SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SE SG SG SG SI SI SK SK TH TH TH TH TH TH US US US US US US US US US US US US US US US

helmetedwarrior ichbineinberliner landoonmillenium leeloo liveshere lurchtor maewdsa manetherendrelle mbop mrjones rzn scheelov serenity stordatorn t9viej3fba73fe1 tele3 tomandandy torebror torlla tux viking zatla

194.47.250.233 213.114.177.149 84.119.119.199 85.226.135.224 213.114.238.177 82.214.2.226 83.233.97.253 83.219.212.101 85.225.169.74 194.47.215.94 213.113.27.79 81.216.128.130 82.182.109.115 85.226.129.119 83.233.34.183 217.28.206.143 81.229.66.237 81.227.234.84 213.199.120.94 213.114.29.49 81.216.158.19 62.20.240.76

LUNET BB-BISP-STO21-SE AT-TELEKABEL-20040407 BB-BISP-dsl10-skv10-jkp1 BB-BISP-STO5-SE SE-TRANSIT-KABELTV BREDBAND2-NET-SE UMEA-BRF_NORNAN-NET BB-BISP-dsl11-hbg10 LUNET B2-CUSTOMERS AH-WHOLESALE SCREAM-BOSTREAM-NET BB-BISP-dsl10-skv10-jkp1 BREDBAND2-NET-SE SE-TRIPNET TELIANET TELIANET SKEKRAFT-NET BB-BISP-LKP1-SE AH-WHOLESALE TELIANET

qltor toranonx

202.166.24.240 219.74.197.116

MAGIX SINGNET-SG

alpha007org

84.255.254.174

SI-T-2

jhohnbalance

195.72.0.6

EWSK-DIAL-BB-1

bxddavidnetthailand censorbustor pen2 proview somjuk

124.121.173.236 124.120.242.178 125.24.68.94 202.149.122.98 202.29.6.56

ASIAINFONET ASIAINFONET TOTNET-AP WJG-TH THAINET-TH

44thprecinct 79c14cccec 8xspeed a2b90e6b35564bd991 aala ajjaxsafe ally2006 anarchy anduin anonettorserver anonisgood anonnntpandim2 anselcomputers anselmi

72.225.234.118 66.24.227.242 65.25.218.34 68.227.90.101 149.9.0.25 69.162.42.169 66.235.26.171 207.210.85.116 209.51.169.86 70.187.87.248 70.92.178.34 66.234.69.158 24.170.55.120 154.35.101.77

RRNY ROADRUNNER-NYS ROADRUNNER-CENTRAL NETBLK-OM-CBS-68-227-88-0 PSINET-B-9 69-162-0-0-Z8 JEFFCO-MILLENNIUM-DIGITALGNAXNET HURRICANE-DC0206-5A1 NETBLK-AT-RDC-70-187-80-0 RRWE INJU-2BLK ROAD-RUNNER-5 PSINET-B2-35

A-19

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

arg0 asano atticusf1nch banana bananaphone beehive bender bhmidc2 binarymixer bitcircle blackstripe blorchmonster blueneedle botswananpula bubbajoeblow buddhawouldbeproud bulldozer2003 bushytail caedescontego caethaver2 capacitor capiastor cau ceftorrd00 cgull chaoticsilence cherubim chimera china3 chromakey chunkysoup cipheralgo clanspum clarity clearbluetormonster codegnometor1 comeuppance cqas02 crenshaw crimsondestroyer cyberdynelabs d8cf6t d9p0ph71 dao darkelf109 darkridge datadotcdu dedication default deststorserver

64.246.50.101 68.35.123.187 68.167.210.203 72.21.33.202 68.49.1.86 72.36.146.118 207.150.167.67 68.41.182.107 71.133.227.217 216.55.190.201 67.180.83.36 68.40.192.5 12.222.100.156 24.206.212.55 216.39.146.25 64.142.74.86 67.162.109.41 24.21.201.102 70.134.225.109 69.113.27.92 68.113.150.180 63.85.194.6 216.130.255.201 146.201.211.64 24.18.9.231 67.15.128.17 18.78.1.92 67.190.100.183 129.186.194.102 70.84.114.153 208.40.218.144 64.122.12.107 82.165.180.112 65.196.226.32 71.246.25.54 71.83.118.3 69.230.52.16 129.21.228.86 70.110.70.238 69.139.100.168 68.207.136.55 66.92.188.226 69.136.16.247 216.12.165.46 68.98.18.98 64.90.164.74 82.165.253.73 208.99.207.139 12.76.173.57 68.192.208.164

A-20

EVRY-BLK-9 ALBUQUERQUE-1 NETBLK-COVAD-IP-4-NET LAYERED-TECH DC-3 LAYERED-TECHSAGO-207-150-167-60 MICHIGAN-2 SBC07113322721629050729023 ABAC1999A BAYAREA-16 MICHIGAN-2 INSIGHT-12-222-96-0-NOBLES BUCKHANNON-CEBRIDGE-CONNEC SENSE SONIC-BLK-3 ILLINOIS-1 OREGON-7 SBC07013422400023051028140 OOL-CPE-ISLPNY-69-113-16-0 MDS-WI-68-113-144 UU-63-85-194 VIS-64-BLK1 FSUFDDI WASHINGTON-9 EVRY-BLK-15 MIT COLORADO-18 CYCLONENET NETBLK-THEPLANET-BLK-13 APPSCOMM-NET1 INT-BLK-1 SCHLUND-CUSTOMERS UU-65-196-224-D1 VIS-BLOCK REN-NE-71-83-112 SBC06923004800020050107123 RIT FTTP E-TENNESSEE-4 RR-SOUTHEAST-BLK3 SPEK-SFO-BR-46 NAPLES-12 MERKATO-POWERED-NETWORK PH-RDC-68-98-0-0 NYIC-1BLK SCHLUND-CUSTOMERS FORONA-TECHNOLOGIES-LLC ATTSVC-12-76-0-0 OOL-CPE-RNDHNJ-68-192-208-

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

digitalrhapsody1 digitalrhapsody2 dmux01 donk3ypunch doppelganger dragon echelonalpha elysian elysium epoch ericspeaks erictor err extrapolator factormachine fartknocker fcmc fern findthecup floydian fluffycrypto freedaemontor freedomvoice froggy fry ftsiiwew90 furrywannabe gameover gamma gentoopenguins gewegsg ghettocluster ghewgill ghotiwork ginsberg gnunet gojimmers gold goldensun gondwanaland goocononion1 gotclue graze greybeard95a gtisc gusgate hackshaven hamaphry1 hamcavetor hanselwilson

204.15.133.171 64.5.53.220 71.117.235.93 149.9.25.222 64.175.67.76 72.177.87.57 71.117.236.5 68.4.226.53 68.5.114.127 72.226.235.186 66.219.161.166 71.112.165.46 128.2.141.33 207.210.101.242 24.238.57.137 64.95.64.86 216.105.150.8 64.5.53.76 216.237.143.47 68.57.216.138 70.132.32.156 66.210.104.251 63.149.255.18 24.255.8.175 192.83.249.30 66.93.134.53 71.210.181.168 24.8.67.2 216.55.149.21 72.9.242.90 169.237.136.170 70.92.81.85 69.41.174.196 12.44.215.27 65.28.30.197 131.179.224.133 144.126.75.68 24.118.78.189 69.200.81.164 64.5.53.33 74.129.166.67 216.32.80.75 71.116.80.146 66.93.170.242 199.77.130.14 67.40.233.130 64.81.100.208 68.116.85.27 66.92.13.212 71.112.223.105

A-21

NDCNETWORK-02 NETBLK-THEPLANET-BLK-5 VIS-71-96 PSINET-B-9 SBC06417506600023060423215 RRSW VIS-71-96 OC-RDC-68-4-0-0 OC-RDC-68-4-0-0 RRNY DTC-COM-CCIFALLS VIS-71-96 CMU-NET GNAXNET PENTEL-CABLE PNAP-BSN-ARDENN-DC-01 ACSINC-BLK-1 NETBLK-THEPLANET-BLK-5 XOXO-BLK-19 INDIANAPOLIS-2 SBC07013203200019051025142 NETBLK-OK-OHFC-66-210-104Q0113-63-149-255-0 NETBLK-PH-RDC-24-255-0-0 BUNGI SPEK-SFO-BR-7 QWEST-INET-118 COLORADO-10 ABAC1999A GNAXNET UCDAVIS2 RRWE 800-NET1 ACCESS2G19-215-0 RR-CENTRAL-2BLK UCLA-CS LOYOLA-IN-MD MINNESOTA-1 RRNY NETBLK-THEPLANET-BLK-5 INSIGHT-COMMUNCATIONS-CORP NET-216-32-64-0 VIS-71-96 SPEK-333585-0 LVLT-ORG-199-75 QWEST-INET-116 SPEK-DSL-BR22-0 TRLK-CA-68-116-80 SPEK-DSL-SFO-BR4-0 VIS-71-96

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

hbro hcpnet heilong heimdal hellohellomoomoo hgabertgoldmine hiball hologramtw holyfreakingcrap hpeterstorserver httpdnet hubbahubbahubba icarus ice idealworld ididediconfigtphhhh ieditedtheconfig illithid illithid2 inap1 intarweb inthekeyofv iris irishcitizensarmy irithimus janus3 jizbomb jms1 joeysa64 joiseytor juniormint knauerhase krumpet kumbaya landrover lantana leela lefkada lehighnet lemongrass lillemy linuxonthebrain livefreeordie loosemoose lostinthenoise m m00kie manning18 markoer martinscorsese

12.210.240.109 65.174.217.58 67.174.220.150 74.67.47.248 71.250.215.8 166.70.232.84 160.36.137.37 24.47.23.103 208.14.31.5 24.111.174.178 66.90.89.162 154.35.47.59 69.134.216.49 66.119.199.39 68.236.70.84 68.202.36.79 66.75.35.155 208.40.218.131 208.40.218.136 64.74.207.50 70.232.81.31 70.246.78.213 138.202.192.210 68.199.62.178 64.132.239.129 66.70.10.53 141.149.128.197 209.114.200.129 69.110.57.243 154.35.85.17 72.228.245.16 24.22.8.74 66.96.192.44 24.11.233.143 70.85.75.42 68.166.0.140 66.111.43.137 140.247.60.64 66.197.193.212 71.129.180.29 66.199.240.50 216.137.65.86 68.96.178.10 206.174.19.25 64.142.98.231 69.163.32.140 154.35.36.18 68.167.210.195 64.90.191.94 71.32.251.76

A-22

ATT FON-110197790494889 BAYAREA-15 RRNY VIS-BLOCK XMISSION-166-70-0-0 MED-NET OOL-CPE-STJMNY-24-47-16-0FON-349058457672565 MIDCO FDCSERVERS PSINET-B2-35 RRMA GCNETBLK-TERRA1 VZ-DLWRLD-1 RR-SOUTHEAST-BLK3 RR-WEST-2BLK APPSCOMM-NET1 APPSCOMM-NET1 PNAP-SEA-BLOCK4 SBC07023208000020051116153 SBC07024607800023050404194 USFCA OOL-CPE-NYX2NY-68-199-56-0 TWTC-COI-01 DATAPIPE-BLK3 VIS-141-149 FIBERPLUS SBC069110048000040218 PSINET-B2-35 RRNY OREGON-9 NOC SOUTHBEND-2 NETBLK-THEPLANET-BLK-13 NETBLK-COVAD-IP-4-NET SAGO-66-111-43-130 HARVARD-COLL HOSTNOC-2BLK SBC07112918000022050503214 NETBLK-EZZI AVALON-NETWORKS LV-RDC-68-96-160-0 GCI-ALASKA-5BLK SONIC-BLK-3 69-193-32-0-Z3 PSINET-B2-35 NETBLK-COVAD-IP-4-NET NYIC-1BLK QWEST-INET-119

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

mauger mc242 mercury merlin midator middleman minotor mmitor moria1 moria2 mp94564 mtrojnar multicstor mushin myrandomnode nao nbx neurohydra neuropunks neworleansla newtorserverofmine nicj nickname nopants nowhereman nurotek nycbug olden omgprivacy omgroflstfuthx omgwtf onionkicksass optimum p4killa palisade pansqopticon pappymcnasty paradox985 paulz paxprivoso phobos phoboslabs phuzzie pianarchist pizon planck pleasant pmw poptex privacyecosystem1

149.9.137.153 208.66.194.14 24.91.169.157 66.90.118.68 24.9.185.227 68.40.171.66 71.242.124.82 70.248.104.35 18.244.0.188 18.244.0.114 24.7.86.165 64.62.190.126 67.101.197.199 18.152.2.242 72.165.204.124 70.152.40.47 64.142.31.83 216.254.70.208 38.117.144.218 70.156.122.109 24.148.3.176 64.34.180.99 24.196.173.135 70.179.174.128 209.221.206.114 66.52.66.26 64.90.179.108 64.81.246.230 68.94.13.72 68.68.234.218 64.81.240.144 69.60.120.99 69.123.5.158 67.162.80.138 24.7.38.138 68.174.141.133 12.44.215.69 24.12.139.78 24.34.185.135 149.9.205.73 66.228.127.27 71.245.238.31 64.142.78.232 67.20.56.66 72.20.1.166 68.167.210.150 66.92.65.81 209.223.236.238 154.35.55.129 66.98.136.49

A-23

PSINET-B-9 MCCOLO BOSTON-7 FDCSERVERS COLORADO-10 MICHIGAN-2 VIS-BLOCK SBC07024810400022050102144 MIT MIT BAYAREA-11 HURRICANE-CE1301-9087 NETBLK-COVAD-IP-4-NET MIT Q0209-72-165-204-0 BELLSNET-BLK15 SONIC-BLK-3 SPEK-NYC-BR-103 COGENT-NB-0002 BELLSNET-BLK15 RCN-BLK-25 PEER1-SERVERBEACH-02 ASHE-NC-24-196-160 NETBLK-MA-RDC-70-179-128-0 QNET-0 PWT-SKTN-3817 NYIC-1BLK SPEK-DSL-SFO-BR3-0 SBC068094000000040102 68682240-Z7 SPEK-DSL-SFO-BR3-0 INMM-69-60-114-0 OOL-CPE-LYBRNY-69-123-0-0ILLINOIS-1 BAYAREA-11 ROADRUNNER-NYC-4 ACCESS2G19-215-0 ILLINOIS-14 BOSTON-5 PSINET-B-9 SOFTLAYER-NETBLOCK2 VIS-BLOCK SONIC-BLK-3 6720320-Z5 STAMINUS-COMMUNICATIONS NETBLK-COVAD-IP-4-NET SPEK-DSL-BOS-BR0-0 SAVV-T31436-3 PSINET-B2-35 EVRY-BLK-14

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

privacyecosystem2 privacyecosystem3 privbox pup qnetanonproxy qumquat randombox readmorebooks *redemmas richhomednsorg rndmodmdmtornnode robomasked rodos s3rv3runkn0wn sacredkowz sasquatch schtichenit2damon sdpeaecpe secretagenda serifos server334 seventreasures shadowroot shamborfosi shiggidy silenticey2 sipbtor sisyiphustwo sniper soprano1 sosayweall spanktacular sparky spoon spslosalamitos starling stinky stugsdotcom subsurfaces t800 talentperrine tapthisassholes tditor0 techfinesse tekgnome teleri tenacity thearistocrats thebigcheeseofall thegreatsantini

66.98.208.43 67.15.225.36 68.196.204.6 67.173.143.46 209.221.193.39 154.35.217.62 24.10.127.243 71.56.119.250 66.93.119.120 151.197.195.212 69.62.156.11 69.165.250.121 140.247.62.64 71.229.90.176 68.167.210.88 207.44.180.3 66.92.35.222 68.94.196.229 24.30.67.89 140.247.62.119 70.162.75.105 68.171.58.114 69.249.105.136 68.20.22.44 24.99.140.249 71.98.9.231 18.187.1.68 74.237.5.229 66.32.101.55 154.35.72.223 24.21.11.160 70.127.121.248 69.12.145.165 128.30.28.19 67.49.101.49 69.51.152.43 69.31.42.139 216.9.82.85 68.13.104.181 216.67.26.114 208.40.218.151 71.245.102.3 64.146.134.221 64.135.207.45 70.39.193.13 216.32.89.2 154.35.1.8 206.124.149.146 209.181.56.100 149.9.92.194

A-24

EVRY-BLK-14 EVRY-BLK-15 OOL-CPE-PRNYNJ-68-196-192ILLINOIS-11 QNET-0 PSINET-B2-35 SACRAMENTO-9 ATLANTA-13 SPEK-BLT-BR-4 VZ-DSLDIAL-PHLAPA-3 SUREWEST-BROADBAND 69-165-128-0-Z10 HARVARD-COLL MICHIGAN-G-8 NETBLK-COVAD-IP-4-NET EVRY-BLK-11 SPEK-DSL-LAX-BR4-0 SBC068094192000040115 ATLANTA-3 HARVARD-COLL NETBLK-PH-RDC-70-162-0-0 68171320-Z7 PA-28 SBC068020016000020514 ATLANTA-5 VIS-71-96 MIT BELLSNET-BLK18 EARTHLINKDSL-2BLK PSINET-B2-35 OREGON-7 RRSW SONIC MIT-NET RRWE JASNET-ONE NLYR-69-31-40-0-1 PINN-216 OMRDC-68-13-0-0 ACSG-1-NET-1 APPSCOMM-NET1 VIS-BLOCK NOANET-SBLK2-SAWNET1 FVI-NET 70-39-0-0-Z7 NET-216-32-64-0 PSINET-B2-35 BLARG-BLK QWEST-INET-112 PSINET-B-9

US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US US

thehackerfoundation themightytor theprocess theseed thisisnotajoke thruvu thundergododin ticktockclock tonealdon tor4781671 toratgmcto torhbg tornsd torrific torrigauci torro50 torserver123 torsvartvittorg torture toruser2867562 transistor troglomatix trustnone twosixsix ultraviolet ulwy75nt743 undef veronika viaov vietnamwitch vm voigner whatever whomthebelltolls whooodat wilderness wintools woden xtremenw xxserver3 xyzzyx *yargh yeatorfday yo yonkeltron yoshtor yxgdf09e7987sa6f97g zachsplaceorg zantars zymurgy

64.142.22.13 70.176.93.179 82.165.144.169 24.250.192.233 72.40.156.54 209.172.52.78 63.211.169.142 69.212.31.172 70.245.211.184 216.231.168.178 70.84.253.4 69.242.85.10 24.94.2.121 71.126.187.88 5.20.197.41 68.107.40.142 169.232.102.54 64.5.53.254 209.237.225.244 71.56.235.157 24.183.45.221 72.3.249.87 209.67.209.196 74.0.33.114 75.5.99.178 68.48.87.43 216.218.240.205 66.199.252.58 71.120.32.3 70.101.164.134 38.99.66.86 216.27.178.157 64.136.200.11 66.200.164.250 66.92.220.226 24.159.55.136 208.66.194.6 154.35.12.203 71.231.237.76 24.199.198.152 67.166.235.186 69.55.237.39 209.6.168.183 168.150.251.36 68.80.155.150 66.236.18.180 64.217.16.129 66.219.59.183 72.72.92.133 18.246.1.160

A-25

SONIC-BLK-3 NETBLK-PH-RDC-70-176-0-0 SCHLUND-CUSTOMERS NETBLK-AT-RDC-24-250-192-0 ERLK-TW-CENTRALFL02 IWEB-HD-T838CL-1 LEVEL4-CIDR SBC069212030000040224 SBC07024521000023050307192 MEBTEL-BLK-7 NETBLK-THEPLANET-BLK-13 PA-METRO-27 ROAD-RUNNER-3-A VIS-71-96 RESERVED-5 COX-ATLANTA-2 UCLANET4 NETBLK-THEPLANET-BLK-5 NET-BLK-TOADHALL COLORADO-16 MDS-WI-24-183-32 RSCP-NET-4 CW-209-67-208 NETBLK-COVAD-IP-6-NET SBC07500509917629060409013 DC-3 HURRICANE-CE0579-331 NETBLK-EZZI VIS-71-96 ELI-NETWORK-ELIX PSINETA SPEK-DSL-SFO-BR2-0 EVEREST-BLK3 DSL-NET-17 SPEK-NYC-BR-115 CLKSVL-TN-24-159-48 MCCOLO PSINET-B2-35 WASHINGTON-17 RR-COMM-MIDSOUTH TEXAS-5 JOHNCOMPANIES RCN-BLK-9 DCN-B1 PA-METRO-7 XOX1-BLK-2 SBC064217016000030615 CORENAP-NETBLOCK-01 VIS-72-64 MIT

ZA ZA

leftover

196.11.98.20

A-26

UWCNET3