3380-1 (CFNOC/DND CIRT)

09 Jul 06

NOS O (via CoC)

I&W ANALYSIS - ONION ROUTING AND "TOR"

INTRODUCTION

1. (U) As of late, there has been much discussion in both the internet and
hacking communities regarding "Onion Routing" (hereafter referred to as "OR") and
an open source OR implementation designated "TOR".

2. (U) Both OR and TOR are specifically designed to:

a. provide anonymous internet connections (obfuscation of

communication end points, resistance to eavesdropping/packet
sniffing and traffic analysis prevention); and

b. provide a facility for "hidden servers".1

Anonymous Internet Connections

3. (U) Users of the TOR network run an "Onion Proxy" on their machine; this
proxy connects to the TOR network, periodically negotiating a virtual circuit through
which the data will be forwarded; this proxy can either be implemented using
software or a shim in the OS' network stack.

4. (U) TOR employs public key cryptography in a layered manner (hence the
'onion' analogy), ensuring perfect forward secrecy (PFS)2 between routers. At the
same time, the Onion Proxy software presents a SOCKS3 interface to its clients;
SOCKS-aware applications may then be pointed at TOR, which then multiplexes the
traffic through a TOR virtual circuit.

5. (U) Once inside the TOR network, the traffic is sent from router to router,
ultimately reaching an exit node at which point the unencrypted packet is forwarded
on to its original destination. Viewed from the destination, the traffic appears to
originate at the TOR exit node.

6. (U) In addition to anonymous routing, TOR is often coupled with Privoxy (a

filtering proxy server) when browsing the web; use of Privoxy provides additional
anonymization at the Application Layer.

1
A hidden server is one that is hosted on a machine that also acts as an active onion router; the nature of
OR is such that clients can connect to the server without actually knowing its location.
2
A key-establishment facility used to secure private network communications; with PFS, if one encryption
key is compromised only data encrypted by that specific key is compromised. For PFS to exist, the key
used to protect transmission of data must not be used to derive any additional keys.
3
A protocol for handling TCP traffic through a proxy server. SOCKS can be used with virtually any TCP
application; the protocol is documented in RFC 1928, RFC 1929 and RFC 1961.

1
Hidden Servers

7. (U) Although TOR's most popular feature is its provision of anonymity to

clients, it can also provide anonymity to servers. Using the TOR network, it is
possible to host servers in such a way that their network location is unknown.

8. (U) Hidden servers are accessed through the TOR-specific ".onion" top level
domain (TLD). The TOR network understands this TLD and provides an anonymous
route to the hidden server; the hidden server then hands client requests over to
standard server software.

The TOR Menace

9. (U) As demonstrated in Annex A, interest in TOR has risen significantly in

recent months; this has seen roughly a 154% increase in the available TOR nodes
since November 2005; TOR is receiving considerable media attention, particularly in
network security/hacking circles.

10. (U) Considering the open source nature of TOR, the sudden upswing in its
popularity, the fact that TOR can be used for any TCP based application and the
discussions taking place on various hacking websites/IRC channels, it is only a
matter of time before hostile entities begin to use the technology for directed
network reconnaissance and attacks.

AIM

11. (U) The purpose of this report is three fold:

a. to convey information regarding OR and TOR in order that the

reader may understand the concepts involved with the technology;

b. to convey information regarding the potential threat TOR poses to

the organization's network assets; and

c. provide recommendations to defend our network assets from hostile

entities that may make use the TOR network to conduct network
reconnaissance and attack.

DISCUSSION

OR Concepts & Technologies

12. (U) Prior to explaining OR and TOR, one must be aware of the three basic
concepts/technologies used in its design; these are:

a. traffic proxies;

b. public key cryptography; and

c. Chaum Mixes.

2
Traffic Proxy

13. (U) A traffic proxy is a host that is placed between a client and another server
and intercepts the network session. The proxy handles the traffic exchanged to and
from the client, making the connection to the server on the client's behalf. As
demonstrated in Annex C, the client never touches the remote server directly and
remains anonymous.

14. (U) Although the traffic proxies are easily implemented, there are several
weaknesses that render its anonymization useless to a determined adversary. These
include:

a. the proxy provides a single point of failure, compromise and/or

attack;

b. link encryption is not inherent - traffic being passed between the

client and the proxy is subject to intercept and/or analysis; and

c. routing information is conveyed unencrypted - the proxy is always

aware of the source and destination of the connection request.

Public Key Cryptography

15. (U) Public Key Cryptography is a cryptographic system invented in 1976 by

Whitfield Diffie and Martin Hellman that utilizes two types of keys:

a. a public key known to everyone - the recipient's public key is used

to encrypt the message; and

b. a secret key known only to the recipient of the message - the

recipient uses the private key to decrypt the message.

16. (U) The public and private keys are related in such a way that only the public
key can be utilized for encryption and only the corresponding private key can be
used for decryption; in addition, it is virtually impossible to derive the private key
even if an one possesses the public key.

17. (U) Public Key Cryptography is used in both Chaum Mixes and OR in order to
provide a level of anonymity by encrypting data and/or routing information.

The Chaum Mix

18. (U) The spark that led to the development of the OR's initial concept can be
found in a whitepaper regarding anonymous e-mail transmission authored by Dr.
David Chaum in 1981.

19. (U) In his paper, Dr. Chaum presented a system for anonymous E-mail
communication using public key cryptography and an network consisting of a large
number of what he called "Mix Nodes" (basically a special e-mail proxy); a simplified
diagram of a Chaum Mix Network is demonstrated in Annex D.

3
20. (U) Mix Nodes accept e-mails encrypted with the node's public key, decrypts
them, places them into a transmission queue for an arbitrary period of time and then
forwards them to the next Mix Node in the circuit. When the final Mix Node is
reached, the final layer of encryption is removed and the e-mail is forwarded to the
recipient.

21. (U) The OR technique builds upon Dr. Chaum's initial work in the
anonymization of e-mail traffic and expands the concept, allowing for the
anonymization of virtually any TCP based application.
OR 101 - An Introduction to Onion Routing 

22. (U) Contrary to popular belief, use of a switched communication network does
not preclude anonymity. The OR technique, developed by the U.S. military in the late
1990s, allows for anonymous communications over packet switched networks such
as the Internet.

23. (U) OR was originally developed to serve as a flexible switched

communications infrastructure that would be resistant to both packet sniffing and
traffic analysis; this was accomplished by separating the packet's identification
information from its routing information and the use of encryption.

24. (U) OR uses generic networking/proxy techniques and a variation of the

Chaum Mix to protect both the privacy and anonymity of communication channels.
Using OR technology, connections are always anonymous; any information being
conveyed may also be rendered anonymous by purging identifying information from
the data stream.

25. (U) Though originally designed to run on Solaris 2.5/2.6, the current version
(TOR) is easily implemented in a variety of operating systems and can be employed
in a wide variety of TCP based Internet applications (e.g. web browsing/publishing,
FTP, IRC, IM, etc.); TOR will be discussed further below.

26. (U) When the initiator endpoint wishes to establish an anonymous connection
to a host, it first connects to a SOCKS proxy; the SOCKS proxy accepts protocol-
specific connections from applications and converts them into a generic routable
protocol.

27. (U) Once this is done, the packets are forwarded to an "Onion Proxy". The
Onion Proxy then creates a route over the "onion network" and constructs a special
data structure known as the "initial onion". Once the onion is constructed, it is
passed to the TOR overlay network.

28. (U) When an onion router receives an onion, the outer layer is decrypted,
revealing a layer containing information about the next hop in the route; this layer is
then discarded and the onion forwarded on to this next hop in the circuit.

29. (U) Eventually the onion will reach the final hop on the overlay network,
known as an "Exit Node". The final layer of the onion will then be decrypted revealing
the original data packet; this packet will then be forwarded to the recipient endpoint.

30. (U) A simplified diagram of the onion decode and forward process can be
found in Annex E.

4
OR 201 - Enter TOR 

31. (U) TOR, the latest incarnation of OR, is easily implemented on a plethora of
platforms (Windows, *nix, BSD, etc.). In addition, virtually any unmodified SOCKS
compatible TCP/IP based application can use TOR either by means of a proxy or by
shimming the network protocol stack of the host.

32. (U) In order to create a private network pathway with TOR, a circuit of
encrypted connections is built incrementally, extending the circuit one node at a time
as demonstrated in Annex F.

33. (U) Each node in the TOR circuit knows only which node forwarded it data and
to which node it is forwarding data - no individual node knows the complete path
that a data packet has taken. The onion proxy negotiates a separate set of
encryption keys for each hop along the circuit to ensure that the routing information
remains anonymous along each hop.

34. (U) Once a TOR circuit has been established, any SOCKS compliant TCP based
communication can be transmitted over the circuit. As each server sees no more
than a single hop in the circuit, neither sniffing nor the compromise of an individual
onion router will reveal the endpoints of the connection.

35. (U) In order to prevent abuse, each TOR node's "exit-policy" (a form of ACL4 -
An example of the default TOR exit policy is demonstrated in Annex H) can be
configured to selectively deny or allow access to external addresses and services.
Despite this feature, it is worth noting that there are potentially hundreds of "open
exit nodes"5 that allow full connectivity to any resource using any service.

36. (U) The advantages of using TOR over other anonymizing solutions include but
are not limited to:

a. anonymity is further enhanced as single anonymous circuits are shared

with multiple TCP streams;

b. TOR is compatible with all SOCKS compliant applications;

c. flexible "Exit Policies" allow each node to choose what applications can
use the node and where the node can reach;

d. "Hidden Servers" are easily implemented;

e. TOR provides "Perfect Forward Secrecy";

f. traffic replay attacks are rendered impotent; and

g. TOR implements robust communications circuits; unlike normal "single

hop" proxies, no single point of failure exists.

4
Most network security systems operate by allowing selective use of services. An Access Control List
(ACL) is the usual means by which access to, and denial of, services is controlled; it is simply a list of the
services available, each with a list of the hosts permitted to use the service.

5
On an Onion Network, the node at which point the cleartext packet is available and is forwarded on to its
final destination; viewed from the destination, the traffic appears to originate at the Tor exit node's IP
address.

5
37. (U) The potential threat of Onion Routing lies in its ability to allow attackers
to conduct completely anonymous reconnaissance and attacks directed at remote
networks.

38. (U) TOR is specifically designed to stymie analysis attempts; considering this,
anonymous reconnaissance and attacks could conceivably be directed network assets
at the whim of an attacker while at the same time hindering the victim's incident
analysis and response efforts.

CONCLUSIONS & RECOMMENDATIONS

A "Clear and Present Danger"

39. (U) TOR, with its increasing popularity and recent exposure in various
hacking/computer security media, poses a clear and present danger to the
organization's network assets.

40. (U) In addition to its increased public exposure, hundreds of unverified TOR
nodes have appeared since November 2005; the appearance of these nodes be an
indicator of increased untoward activity.

41. (U) As the TOR network is a public and the software is open source,
belligerent nations could conceivably utilize TOR or deploy hidden servers that could
be used specifically to conduct anonymous attacks/reconnaissance against the
organization's network assets.

42. (U) In addition to the anonymity provided by the TOR network, any attacks
routed through it that would be resistant to most analysis techniques, greatly
hindering both analysis and incident response.

43. (U) Considering the above, it is hereby recommended that:

a. primary TOR nodes be immediately blocked at the network

perimeter (a partial list of primary TOR nodes can be
found in annex X);

b. "rogue" TOR nodes be blocked at the network perimeter as they

are identified; and

c. online monitoring of the appropriate online resources (e.g.

http://serifos.eecs.harvard.edu/cgi-bin/exit.pl) be undertaken to
block new primary TOR nodes as they come online.

6
44. (U) Any questions regarding this report may be addressed to the
undersigned.

//signed//

E.L. Mac Daibhidh, CD

Cpl
Special Operations Analyst
DND CIRT IH&AA Team
Special Operations Cell
945-7747

Attachments:

References

Annexes A-H

7
8
References:

Chaum, Dr. David. Communications of the ACM, Volume 24 Number 2. "Untraceable

Electronic Mail, Return Addresses, and Digital Pseudonyms". Febuary 1981. Accessed
on 1 July 2006. www.freehaven.net/anonbib/cache/chaum-mix.pdf.

Darknet Administrator. "Anonymity - Hiding Your Identity in 2006". 16 May 2006.

Accessed on 17 May 2006. http://www.darknet.org.uk/2006/05/anonymity-hiding-
your-identity-in-2006/.

Danezis, George. "Anonymous Communications I". Date unknown. Accessed on 17 June 2006.
www.ccc.de/congress/2004/fahrplan/ files/355-anonymous-communication-slides.pdf.

Dhanjani, Nitesh. "Launching Attacks via Tor". 10 July 2005. Accessed on 02 June
2006. http://www.oreillynet.com/pub/wlg/7333.

Dhanjani, Nitesh. "Tor: An Anonymous Internet Communication System". 20 January

2005. Accessed on 02 June 2006. http://www.oreillynet.com/onlamp/blog/2005/01
/tor_an_anonymous_internet_comm.html.

Dingledine et al. "Tor: The Second Generaton Onion Router". August 2005. Accessed
on 25 May 2006. http://www.onion-router.net/Publications/tor-design.pdf.

Harrison, Ann. "Onion Routing Averts Prying Eyes". 05 August 2004. Accessed on 03 Mar
2005. http://www.wired.com/news/privacy/0,1848,64464,00.html.

Hasuo, Ichiro. "Provable Anonymity". 27 May 2005. Accessed on 30 June 2006.

www.cs.ru.nl/~ichiro/talks/spanWorkshop.pdf.

Holer, Vlastimil. "Practical Onion Routing". Date unknown. Accessed on 20 June

2006. www.fi.muni.cz/~xholer/content/school/tor/poster.pdf.

Infosecninja Administrator. "Anonymizing network traffic using TOR". 28 Jun 2005.

Accessed on 31 May 2006. http://www.infosecninja.org/content/view/16/28/.

Leech et al. "RFC1928 - 'SOCKS Protocol Version 5'". March 1996. Accessed on 03
June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1928.txt.

Leech, M. "RFC1929 - 'Username/Password Authentication for SOCKS V5'". March

1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1929.txt.

McMahon, P. "RFC1961 - 'GSS-API Authentication Method for SOCKS Version 5'".

June 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1961.txt.

Noreply Wiki. "TheOnionRouter/TorFAQ" (sic). Last edited on 04 June 2006. Accessed

on 05 June 2006. http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ.

 O'Morain et al. "Onion Routing for Anonymous Communications". Date unknown.

Accessed on 01 June 2006. http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group10/index.html.

Permeo Technologies, Inc. "SOCKS Overview". 2005. Accessed on 31 May 2006.

http://www.socks.permeo.com/AboutSOCKS/SOCKSOverview.asp.

i
Reed et al. "Anonymous Connections and Onion Routing". 1998. Accessed on 25 May
2006. http://www.onion-router.net/Publications/JSAC-1998.pdf.

Security Focus. In Focus "Pen-Test" Forum. "Pen-Testing via TOR". Last reply on 22
July 2005. Accessed on 30 May 2006. http://www.securityfocus.com/archive/101
/406003/30/0/threaded.

Stanford et al. "TheOnionRouter - NoreplyWiki" (sic). Last edited on 19 May 2006.

Accessed on 26 May 2006. http://wiki.noreply.org/noreply/TheOnionRouter.

U.S. Naval Research Laboratory. "Onion Routing - Executive Summary". November

2003. Accessed on 02 May 2006. http://www.onion-router.net/Summary.html.

"Weasel". "Anonymous Remailer Stats, Meta-Stats and other Information". 16 May

2006. Accessed on 16 May 2006. http://www.noreply.org/tor-running-
routers/totalLong.html.

Wikipedia.org. "Onion Routing". Last edited on 10 May 2006. Accessed on 11 May

2006. http://en.wikipedia.org/wiki/Onion_routing.

 Wikipedia.org. "Tor (anonymity network)" (sic). Last edited on 30 May 2006. Accessed
on 08 May 2006. http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29.

ii
(U) ANNEX A - Available TOR Routers (May 2004 - May 2006)

This graph, obtained from the Noreply website, clearly demonstrates the
increase in available TOR nodes since May 2004.

A-1
(U) ANNEX B - TOR Network Data Throughput (May 2004 - May 2006)

This graph, obtained from the Noreply website, clearly demonstrates the
increase in TOR traffic that has been directly proportional to the increase in TOR
nodes.

A-2
(U) ANNEX C - Rudimentary Anonymizing Proxy

The diagram below demonstrates a rudimentary anonymizing proxy.

Connections routed through the proxy appear to originate from the proxy and not
from the endpoint host.

Advantages:

• Simple implementation.
• Focuses traffic to enhance anonymity.

Disadvantages:

• Single point of failure, compromise and attack.

• Link encryption is not inherent, proxy is always aware of the
source and destination of the connection request.

A-3
 (U) ANNEX D - Simplified Chaum Mix-Net

Initiator
Endpoint
Internet Cloud
MIX 1 MIX 2

Proxies the traffic from Proxies the traffic from

the initiating endpoint MIX 1 to obfuscate its
C(1) to obfuscate its identity. identity.

Decrypts C(1) with its Decrypts C(2) with its

C(2) secret key. secret key.

Changes identifying Changes identifying

information within the information within the
Message e-mail header (FROM, e-mail header (FROM,
TO, etc.). TO, etc.).

Message is placed in a Message is placed in a

transmission queue to transmission queue to
add a random delay to add a random delay to
the next hop. the next hop.

The message, still The unencrupted

encrypted with C(2) is message is forwarded to
forwarded to the next the destination
mix. endpoint.
.

Destination
Endpoint

A simplified diagram of a simple Chaum Mix-Net is demonstrated above. The

initiating endpoint first encrypts the email with the public key for the last Mix in the
circuit and then encrypts it again with the public key for the first hop in the circuit.

The e-mail is then sent to the first Mix on the Mix-Net, which proxies the e-
mail on behalf of the sender, thereby obfuscating the location of the initiator. The e-
mail is then decrypted with the Mix's secret key and any identifying information is
stripped from the e-mail headers.

The e-mail, still encrypted with C(2) is then placed in an arbitrary

transmission queue where it is held for a random amount of time then forwarded to
the last Mix in the circuit. On arrival at the final Mix, this process is repeated and the
original e-mail, now stripped of all identifying information, is forwarded to the
destination endpoint.

A-4
 (U) ANNEX E - The Onion Decrypt and Forward Process

Initial Onion forwarded to hop one. Onion forwarded to second hop.

The first router decrypts the C[1] layer using its The router located at the second hop will
private key in order to find the IP address of the decrypt the C[2] layer using its private key in
next router in the circuit and encrypted data. order to find the IP address of the final router
in the circuit and encrypted data.

Data forwarded from final hop

Onion forwarded to final hop. to recipient endpoint.

The router located at the final hop will decrypt the The router located at the final hop forwards
C[3] layer using its private key in order to find the the unencrypted data packet to the recipient
unencrypted data packet. endpoint outside the OR cloud.

The diagram above demonstrates the initial onion generated for a two-hop
trip through the OR cloud and the actions taken as the onion travels along each hop.

After the Onion Proxy determines the route the data will take through the OR
cloud, it constructs an initial onion which consists of a payload and routing
information surrounded by layers of encryption.

At each hop along the circuit, another layer of the onion is decrypted,
revealing the next destination in the communications link; once the final l hop of the
circuit is completed, the last onion router decrypts the final layer of routing
information and forwards the data to the recipient endpoint.

A-5
(U) ANNEX F - Onion Routing Circuit Configuration

The simplified diagram above demonstrates the basic configuration of an OR

circuit through multiple Onion Routers from the initiator endpoint to the recipient
endpoint.

The SOCKS proxy accepts protocol-specific connections from applications on

behalf of the client (the initiator endpoint), and converts them into a generic protocol
(such as a stripped down SOCKS protocol); the data packets are then forwarded to
the onion proxy.

The onion proxy is aware of the OR network topography and determines the
path the data will take through the cloud and constructs a the initial onion.

A-6
(U) ANNEX G - TOR Telescoping Circuit

Onion routers form a telescoping "overlay" network and combine the use of
proxies and mixes in order to ensure the anonymity of the communication link; note
that this does not involve the anonymization of the underlying information.

The diagram below demonstrates a simplified version of OR's telescoping

circuit setup process.

A-7
(U) ANNEX H - Default TOR Exit Policy

TOR's default exit policy is demonstrated below. The syntax of each policy
rule is "accept|reject ADDR[/MASK]:PORT". An asterisk is used as the policy
wildcard; if "/MASK" is omitted then the rule applies solely to the IP address in the
rule.

Default TOR Exit Policy:

reject 0.0.0.0/8
reject 169.254.0.0/16
reject 127.0.0.0/8
reject 192.168.0.0/16
reject 10.0.0.0/8
reject 172.16.0.0/12
accept *:20-22
accept *:53
accept *:79-81
accept *:110
accept *:143
accept *:443
accept *:706
accept *:873
accept *:993
accept *:995
reject *:1214
reject *:4661-4666
reject *:6346-6429
reject *:6881-6999
accept *:1024-65535
reject *:*

A-8
(U) ANNEX I - Known Primary TOR Nodes (02 Jun 2006)

Country
Node Designation Node IP Address Node Net Name
Code
AT
AT attnjupiter 80.120.3.32 TZA-HWY-AT
AT euripides 62.178.28.11 VIE-11-CUSTOMERS-DOCSIS
AT kronegger 83.65.91.110 Dieter-Kronegger
AT linzfrank 140.78.95.135 JKU-LAN
AT mundl 195.230.168.95 ICB-NET
AT nickthephreak 86.56.195.211 AT-LIWEST-HEADEND-86-56-19
AT no0borders 83.64.135.124 Textdesign-GmbH
AT scgghjtywbtzda9yzi 217.196.64.205 FUNKNETZ-DSL-CUST-1
AT tor26 86.59.21.38 SIL-ALFIE
AU
AU nexus 202.173.141.155 WestNet
AU psion 220.233.6.198 EXETEL
AU wokwaixtor 203.59.165.124 IINET-AU
BE
BE blueaqua 213.219.164.163 BE-EDP-20000830
BE justatorserver 81.11.162.171 PI-BELGIUM
BG
BG thunder 217.79.72.59 D-D-SOFTSYSTEM-VARNA-BG-NE
BR
BR poderosotor 200.222.114.90 AS7738
CA
CA biffhenderson 65.92.65.203 NEXHSE6-CA
CA citlabwin32 128.100.171.34 TORONTO
CA comfortablynumb 216.194.67.53 TERA-BYTE-3
CA computer 70.27.181.246 DOC-4-8-1-1-WLFDLE-3
CA deuxpi 66.11.179.38 PEER1-DONCASTER-BLK1
CA gatekeeper 66.130.125.131 VL-D-MT-42827D00
CA gingkobiloba 216.239.83.223 VIF-BLK-1
CA kgn9yct9 69.194.143.65 DOC-1-8-1-2-WLFDLE-3
CA leafs 70.53.93.156 SYMF20051102-CA
CA lionstooth 64.26.169.184 MAGMA-BLK3
CA lostwizard 198.161.91.196 LEXICOM-AB
CA mick 69.70.104.213 VL-D-SC-45466800
CA mozgotor 142.167.19.244 ALIANT-TEL-142-167
CA mytor654321 72.0.207.216 EBOX-24207072-CA
CA nachocheese 24.80.166.229 SHAW-COMM
CA necroscop 24.36.207.144 CGOC-OAWH5
CA paliandroid 64.230.24.153 NEX100704-CA
CA scooby 72.60.167.5 DOC-2-7-1-2-ETOB-2
CA sod 24.36.129.106 CGOC-SACO3
CA telostor 70.68.168.93 SHAW-COMM
CA testamentpantera 65.38.64.204 GLOBALE-1
CA tortorcan65 24.42.92.42 DOC-1-5-0-2-BLOOR-2
CA turdburglar 69.156.56.175 SYMV0129-CA
CA vedant 65.49.223.229 DOC-4-8-0-0-MTNK-2

A-9
CA yoda 24.68.0.201 SHAW-COMM
CA zenten 70.27.5.5 DOC-3-7-0-0-SLNT-2
CA zz9plural9zalpha 70.82.218.182 VL-D-MU-4652DA00
CH
CH b17a21c8 80.74.144.159 METANET
CH crayzzytor 83.228.142.189 VTX-ADSL-ACCESS
CH fno42rd 217.14.64.70 BBI-WMC
CH makemefree 80.242.195.68 GLATTNET-NET
CH milkya64 84.72.104.77 CABLECOMMAIN-NET
CH mjollnir 84.227.224.47 SUNRISE-ADSL
CH *n37gu3r1lla 85.0.173.159 BLUEWINNET
CH obrii 62.2.174.20 CABLECOMMAIN-NET
CH tigerlaptop 85.218.24.143 SIMA-NET-1
CN
CN chenkeikari 222.212.61.48 CHINANET-SC
CN dayqz 61.177.200.173 CHINANET-JS
CN dee 221.5.239.212 CNCGROUP-CQ
CN deepin 221.5.239.161 CNCGROUP-CQ
CN *distro 61.242.102.18 UNICOM
CN fgsinternet 211.94.188.225 CNNIC
CN flyingboy 166.111.249.39 TUNET
CN glrum2970 222.94.8.209 CHINANET-JS
CN hj 222.94.174.148 CHINANET-JS
CN jlkjl 222.33.219.5 CRTC
CN lebut 221.137.6.171 COLNET
CN lori 60.63.126.72 COLNET
CN mlogictor 218.58.83.164 CNCGROUP-SD
CN monkey 58.33.130.199 CHINANET-SH-BBAD-190
CN moonese 218.0.209.97 CHINANET-ZJ-HZ
CN oldwatch 218.242.93.172 COLNET
CN prism 221.0.32.66 CNCGROUP-SD
CN terminal2000 218.9.121.242 CNCGROUP-HL
`CN welcometothejungle2 159.226.169.121 NCFC
CN whocaresfreedom2 222.212.225.29 CHINANET-SC
CN wysiwyg 222.28.80.131 BLCUB-CN
CN yass 222.94.224.22 CHINANET-JS
CN zen 218.20.159.95 CHINANET-GD
CZ
CZ fitor1 147.251.52.140 MUNI
CZ iraq 81.0.225.179 HYPERREAL-CZ
CZ nikon2704 83.208.14.29 NEXTEL-XDSL
CZ redemptor 213.220.233.15 UPC-BROADBAND-XIII
DE
DE 1898 85.178.203.21 HANSENET-ADSL
DE 1984jhb 84.58.249.136 ARCOR-DSL-NET13
DE 23foobar42 80.143.147.175 DTAG-DIAL16
DE 686e 80.190.241.118 IPX-Server-NET
DE aaf9200ab4053a5d19c 88.217.34.146 DE-MNET-20051123
DE ai48373 80.86.191.107 LNC-AIHS-NET-GMBH2
DE amnesty 81.169.130.130 STRATO-RZG-DED

A-10
DE andromeda 82.149.72.85 IPX-SMK-NETWORKS-NET-DE
DE anon579401375 84.61.54.237 ARCOR-DSL-NET13
DE anonymousbalsercc 62.75.129.201 BALSER1
DE anpnym 217.160.177.118 SCHLUND-CUSTOMERS
DE antiterrorkrieg 85.214.29.61 DE-TECT-20050224
DE b0red 80.190.250.83 IPX-Server-NET
DE b9ivvwkf774ff2n7cvk 81.169.183.70 STRATO-RZG-DED
DE babylon5 217.172.187.46 SERVER4YOU-1
DE baphomet 81.169.136.161 STRATO-RZG-DED
DE beershakes 213.239.202.232 HETZNER-RZ-NBG-NET2
DE bellum 62.75.222.205 SERVER4YOU-1
DE bembelgott 81.169.166.136 STRATO-RZG-DED
DE biafra 84.16.234.153 NETDIRECT-NET
DE bigbadbertfw 84.154.193.106 DTAG-DIAL20
DE bigwormhole 212.12.60.181 AGALTENBERGER-NET
DE bitnatter 212.202.53.91 HOME-DYNAMIC-NET
DE biz18 84.167.14.205 DTAG-DIAL20
DE bmwanon 85.25.132.119 SERVER4YOU-1
DE calypso 217.190.230.122 TEDE-UNIFIED
DE camperquake 212.51.10.6 ADDIX-CUST1-KIEL-NET
DE carryitcrossthesea 84.60.99.253 ARCOR-DSL-NET13
DE ccc2 85.214.59.14 DE-TECT-20050224
DE cce12eb07e2d92a7 213.133.99.185 HETZNER-RZ-NBG-NET
DE chaba 84.169.124.87 DTAG-DIAL20
DE chaoscomputerclub 80.237.206.93 HE-DEDIC-CGN-206
DE charon 195.158.168.91 HOME-DYNAMIC-NET
DE chimaera 212.112.241.137 IPX-Server-NET
DE chrism 217.160.135.169 SCHLUND-CUSTOMERS
DE commodore64 137.226.59.249 ACHSES
DE corelogics 217.20.118.156 NETDIRECT-NET
DE cptnem0 194.97.49.42 ROESENER-NET
DE cromacserver 81.169.171.90 STRATO-RZG-DED
DE cweiske 80.237.146.62 DDS-NET
DE d2921 84.142.176.142 DTAG-DIAL20
DE daedalus 84.157.147.155 DTAG-DIAL20
DE dasflinkewiesel 217.187.159.113 DE-MEDIAWAYS-20010314
DE dastorzurwelt 87.123.75.227 VT-DYNAMICPOOL
DE datenhalde 212.112.235.83 IPX-Server-NET
DE datentrampelpfad 81.169.177.134 STRATO-RZG-DED
DE deepquest 80.130.140.13 DTAG-DIAL16
DE devilproxytor 213.39.155.121 HANSENET
DE df37134371e64eb 62.158.45.235 DTAG-DIAL8
DE diegedankensindfrei 85.177.235.33 HANSENET-ADSL
DE dl3daz 217.160.167.28 SCHLUND-CUSTOMERS
DE dogfy 212.114.250.252 NEFKOM-DSL2
DE dreckskind 217.160.220.28 SCHLUND-CUSTOMERS
DE dtick 217.20.117.240 NETDIRECT-NET
DE einfallstor 212.112.241.159 IPX-Server-NET
DE eingangstor 217.224.189.216 DTAG-DIAL15
DE emzy 212.112.242.21 IPX-Server-NET

A-11
DE enterprise 193.201.52.136 FIRSTHOP-NET
DE fastfashion 212.112.228.2 IPX-Server-NET
DE feh 217.160.108.109 SCHLUND-CUSTOMERS
DE fengor 81.169.176.178 STRATO-RZG-DED
DE foebud 85.31.186.86 ISPPRO-RZJ1-NET
DE freedomandprivacy 62.75.184.254 VSERVER-1
DE frell2 85.10.240.250 Lampe-Net
DE fs2lsk220 217.189.246.169 DE-MEDIAWAYS-20010314
DE fsd13d24bge 84.141.182.215 DTAG-DIAL20
DE g3power 84.56.132.211 ARCOR-DSL-NET12
DE georglutz 85.214.18.185 DE-TECT-20050224
DE glouklack 85.31.187.90 ISPPRO-RZJ1-NET
DE good2bking 84.146.144.89 DTAG-DIAL20
DE gumba8786server 213.239.217.146 HETZNER-RZ-NBG-NET
DE gwaihir 84.16.236.83 NETDIREKT-STAR-HOSTING
DE h5922 81.169.176.135 STRATO-RZG-DED
DE heaven 193.239.165.73 FKSIP-NET
DE helios 212.202.202.39 HOME-DYNAMIC-NET
DE hendi1 81.169.168.38 STRATO-RZG-DED
DE historserver 212.202.233.2 QSC-CUSTOMER-548140-280988
DE hoppelgaloppel 84.61.155.3 ARCOR-DSL-NET14
DE iapetus 134.130.58.205 ACHSE
DE ididnoteditheconfig 89.54.109.214 STRATO-POOL-NET
DE ihackforfood 131.220.141.131 UNI-BONN
DE iku 212.88.142.147 IKU-NET1
DE impersonator 84.56.184.214 ARCOR-DSL-NET12
DE infodn 212.168.190.8 VIADE-DSL-NET
DE itlnettor1 62.75.218.130 DE-INTERGENIA-20010727
DE jap 141.76.46.90 TUDINF-LAN
DE jnz 85.31.187.84 ISPPRO-RZJ1-NET
DE juchadcod8 213.239.212.133 HETZNER-RZ-NBG-NET
DE karotte 88.198.253.18 DE-HETZNER-20051227
DE keenmind 84.19.181.66 DE-KEYWEB-II
DE kiu112 62.75.241.48 VSERVER-1
DE koehntopp2 85.214.44.126 DE-TECT-20050224
DE kolrabi 217.160.95.117 SCHLUND-CUSTOMERS
DE kozmix 85.10.195.106 HETZNER-RZ-NBG-NET
DE krypton 212.37.39.59 HAMCOM-GMBH
DE lanroamer 85.14.217.228 UNITEDCOLO
DE lincserv 62.224.62.226 DTAG-DIAL1
DE lostpackets 81.169.180.180 STRATO-RZG-DED
DE lowhome01 62.75.162.252 VSERVER-1
DE lunkwillstor 84.57.64.143 ARCOR-DSL-NET12
DE lysander 85.14.216.20 UNITEDCOLO
DE maconion26 62.141.39.14 FASTIT-DE-DUS1-COLO1
DE marvin 80.190.242.122 IPX-Server-NET
DE maximatornew 212.112.242.159 IPX-Server-NET
DE michik 84.16.235.143 NETDIRECT-NET
DE morefreedom 212.202.78.170 HOME-DYNAMIC-NET
DE morgentau 83.171.190.170 MNET-DSL

A-12
DE mxo 81.169.171.105 STRATO-RZG-DED
DE mysecretserv 213.202.217.164 UNITEDCOLO
DE mystiqx 217.84.1.6 DTAG-DIAL14
DE nanobot 88.73.15.46 ARCOR-DSL-NET15
DE narnia 85.119.156.72 INTERNETUNIVERSUM-VPS-NET
DE nebulawikia 80.134.253.148 DTAG-DIAL16
DE ned 80.190.251.24 IPX-Server-NET
DE neskaya 81.169.181.10 STRATO-RZG-DED
DE netzhure 80.244.242.127 moritz-augsburger-de-net
DE newtoruser 87.122.14.230 VT-DYNAMICPOOL
DE nobodyeditedaconfig 85.10.194.117 HETZNER-RZ-NBG-NET
DE nocabal 212.227.20.86 SCHLUND-CUSTOMERS
DE noctednachos 131.246.89.15 RHRK-LAN
DE nt 84.165.162.55 DTAG-DIAL20
DE oas1 213.200.90.122 OLE-TINET
DE ohnetoreinthor 84.160.124.51 DTAG-DIAL20
DE ouagadougou 213.239.212.45 HETZNER-RZ-NBG-NET
DE partytool 84.145.172.206 DTAG-DIAL20
DE pax 217.172.183.219 SERVER4YOU-1
DE pegasus 137.226.181.149 ACHSES
DE peterp1701 212.227.108.114 SCHLUND-CUSTOMERS
DE prescher 85.16.0.4 EWETEL-DYNDSL-POOL6
DE pw 88.84.139.250 IXEUROPE-1BLU-2
DE quousquetandem 85.178.70.48 HANSENET-ADSL
DE r4g3 80.130.228.153 DTAG-DIAL16
DE rainbow 80.243.60.137 DE-ENVIA-TEL-20011029
DE raptor2 85.14.220.126 UNITEDCOLO
DE ratte 212.202.193.62 HOME-DYNAMIC-NET
DE ravenslaptop 84.184.119.159 DTAG-DIAL20
DE redgene 85.31.186.61 ISPPRO-RZJ1-NET
DE reversed 217.172.49.89 GIGAHOSTING-NET
DE rootkit 213.203.214.130 DE-CEITSYSTEMS
DE roundabout 81.169.178.215 STRATO-RZG-DED
DE s02 84.16.233.47 NETDIRECT-NET
DE sanders 217.172.50.130 GIGAHOSTING-NET
DE saturn 85.214.49.175 DE-TECT-20050224
DE schmaller 217.80.83.203 DTAG-DIAL14
DE schnarpf2nd 195.37.132.28 IN-FRANKEN-III
DE sechole 85.14.220.165 UNITEDCOLO
DE seniorix 62.141.42.179 FASTIT-DE-DUS1-COLO1
DE serverbox 213.39.128.232 HANSENET
DE sharktooth 213.239.194.175 HETZNER-RZ-NBG-NET2
DE sic4gh 84.172.106.156 DTAG-DIAL20
DE sikamikanico 82.82.69.203 ARCOR-DSL-NET2
DE siliconverl 195.71.99.214 MWAYS-HEADQUARTER
DE snoopy 80.143.156.153 DTAG-DIAL16
DE so19charsismax 85.214.29.9 DE-TECT-20050224
DE somebody 80.135.50.29 DTAG-DIAL16
DE sparced 217.160.170.132 SCHLUND-CUSTOMERS
DE squirrel 213.146.114.96 KAMP-DSL-NET

A-13
DE stasiserver 81.169.174.124 STRATO-RZG-DED
DE stnv 84.16.236.173 NETDIREKT-STAR-HOSTING
DE stop1984 141.76.7.58 TUDINF-LAN
DE stop1984now 88.73.74.148 ARCOR-DSL-NET15
DE surfingsamurai 212.112.231.99 IPX-Server-NET
DE theeternalpowerami 217.160.219.14 SCHLUND-CUSTOMERS
DE tilde0ne 84.58.9.222 ARCOR-DSL-NET13
DE tokra 80.139.152.94 DTAG-DIAL16
DE tomaslander 89.49.169.65 FREENET-POOL-NET
DE toratcdtmde 129.187.150.131 LRZ-MUNICH-NET
DE torpaulianer 89.110.144.180 NCL-NET
DE torproxyblnger2 85.178.86.28 HANSENET-ADSL
DE tortortor 84.19.187.11 DE-KEYWEB-II
DE torwart 217.160.134.33 SCHLUND-CUSTOMERS
DE torxunixguxru 85.31.186.26 ISPPRO-RZJ1-NET
DE trooper 84.152.125.104 DTAG-DIAL20
DE tunnelreality 84.169.105.217 DTAG-DIAL20
DE turing2006 217.84.162.106 DTAG-DIAL14
DE universi8d3c39 141.35.122.98 UNI-JENANET
DE unterwachung 213.239.212.206 HETZNER-RZ-NBG-NET
DE vidalia 84.60.132.2 ARCOR-DSL-NET13
DE visnator 85.10.226.188 DE-HETZNER-20050223
DE waabbeel 85.25.141.60 SERVER4YOU-1
DE waerternet 217.160.109.40 SCHLUND-CUSTOMERS
DE wannabe 195.137.213.113 MBBG-NET
DE wirsindhaftbar 80.190.243.158 IPX-Server-NET
DE wlmxwalnueb6s6z5gyw 88.84.130.170 IXEUROPE-1BLU-2
DE wor 85.182.31.75 HANSENET-ADSL
DE workshop2 134.169.164.172 TU-BS
DE wormhole 84.19.182.23 DE-KEYWEB-II
DE wuschelpuschel 212.112.235.78 IPX-Server-NET
DE xsteadfastx 85.25.66.203 NETFABRIK
DE yaap 62.75.185.15 VSERVER-1
DE yetanothertorserver 193.201.54.32 FIRSTHOP-NET
DE zbvis 80.145.153.46 DTAG-DIAL16
DE ztor2 81.169.158.102 STRATO-RZG-DED
DE ztor3 217.160.203.26 SCHLUND-CUSTOMERS
DE zwiebelfissh 217.160.176.49 SCHLUND-CUSTOMERS
DK
DK notexitnodedenmark 62.243.85.164 KABELTV
DK protofaust 193.88.185.116 TDC-HOSTING
DK raz0r 212.10.91.141 STOFANET-9
EE
EE borism 82.131.5.34 EE-STARMAN-CLIENTS
EE kuratkull 212.7.12.43 INFONET-CABLE-MODEM-POOL3-
ES
ES ddfdfdf 83.39.161.116 RIMA
ES hazel 85.57.129.159 UNI2-NET
ES torero 84.77.48.196 YACOMNET
FI

A-14
FI anonrouter 88.112.63.167 ELISA-ADSL
FI beaver 80.223.105.208 SONERA-PLAZA-NET
FI djhasis 80.222.227.120 SONERA-PLAZA-NET
FI erkkimatix 82.141.91.230 PPO-ADSL7
FI esko 80.186.67.109 ELISA-ADSL
FI huoneisto 62.183.213.178 LANNENPUHELIN-NET
FI jyketorserver42 85.76.189.225 SCIFI-DYNAMIC-ADSL
FI luthien 193.184.9.66 MediaosakeyhtioFrantic
FI middleguy 84.249.213.94 SONERA-FINLAND-BBNET
FI nemeinfigw 84.34.133.217 TMVVISION-NET
FI paraziteorg 88.113.36.247 FI-ELISA-20050824
FI randomghost 212.246.66.120 FI-ELISA-980508
FI salottisipuli 88.112.243.180 ELISA-ADSL
FI sivusto9022 80.222.75.74 SONERA-PLAZA-NET
FI spongebob 62.241.240.86 LOHJANPUHELIN-6
FI vapaus2006 217.119.47.6 SUOMICOM-CUST-29
FI xtl 82.128.209.49 OPOY-NET18
FR
FR bartfa24279fa4 81.251.26.110 IP2000-ADSL-BAS
FR caboulot 82.244.152.77 FR-PROXAD-ADSL
FR casa 82.230.146.52 FR-PROXAD-ADSL
FR chaorules 82.238.188.44 FR-PROXAD-ADSL
FR charliebrown583 213.41.242.132 FR-NERIM-20020705
FR eyilobdabifu 81.56.123.123 FR-PROXAD-ADSL
FR frenchserver 88.136.16.177 CEGETEL-INTERNET-RESIDENTI
FR ghuiol 82.66.155.32 FR-PROXAD-ADSL
FR golfleme 82.67.37.163 FR-PROXAD-ADSL
FR herminio 82.233.182.73 FR-PROXAD-ADSL
FR hydre 82.225.251.113 FR-PROXAD-ADSL
FR idontwantanickname 82.227.67.108 FR-PROXAD-ADSL
FR irulanshands 81.56.27.175 FR-PROXAD-ADSL
FR jiji 82.216.189.240 NUMERICABLE
FR kuanckik5 86.214.220.139 IP2000-ADSL-BAS
FR latortue 82.231.59.44 FR-PROXAD-ADSL
FR marouen 82.235.154.172 FR-PROXAD-ADSL
FR natmakaone 82.235.7.49 FR-PROXAD-ADSL
FR rumsfeldd 62.212.121.77 NERIM-ADSL-LDCOM-20020611
FR sbs23 82.238.225.133 FR-PROXAD-ADSL
FR titmerde 82.225.238.47 FR-PROXAD-ADSL
FR tortest 82.233.97.149 FR-PROXAD-ADSL
FR ubuntor 81.57.158.21 FR-PROXAD-ADSL
FR user 82.254.177.202 FR-PROXAD-ADSL
GB
GB atl4ntysserver 86.14.146.162 NTL
GB buzzcoil 85.234.130.43 PH-NETWORK-LON1
GB colds7ream 86.128.217.112 BT-CENTRAL-PLUS
GB computer 84.13.43.183 OPAL-DSL
GB conchis 84.9.189.25 BULLDOG-BSH
GB crackedactor 83.245.82.184 Euro1net-Net1
GB dementia 81.5.172.97 UK-ECLIPSE-ADSL-STATIC

A-15
GB doormouse 62.197.40.155 LNC-TH-NET
GB ephemer 128.232.110.15 CL-CAM-AC-UK
GB gizmoguy 217.155.230.230 ZEN000007354
GB k 85.8.136.101 NET-SERVELOCITY
GB lancsdesk 148.88.224.185 LANCS
GB miller 193.110.91.7 YOYO-NETWORKS
GB mrslippery 81.159.48.153 BT-CENTRAL-PLUS
GB myacer 62.17.252.166 MCIEIRE01
GB penfold 195.137.53.121 FREEDOM2SURF
GB peregrinedontmooo 217.147.80.73 BLACKCAT-ADSL
GB pod159 80.87.131.159 POSITIVE-DOLPHIN
GB prezebs 62.121.31.116 KEME-ADSL
GB prospero 83.223.108.108 G-CUST-GS02-2
GB quaker5567 87.80.96.52 EASYNET-UKONLINE-DSL
GB scyphtor 84.9.61.90 Bulldog
GB sphere 213.228.241.143 PKXG-prodigy0
GB torserver8tlsk41 82.24.161.140 NTL
GB xtor123 82.109.81.98 MSM
GB xx 85.210.1.124 PIPEX-DSL-DYNAMIC
GB z0rb 86.139.184.75 BT-CENTRAL-PLUS
GR
GR masquerade 155.207.113.227 AUTH-NET
GR patra 150.140.191.108 PATRASNET
GR trap1 83.235.253.243 OTENET
HK
HK main 219.79.53.165 NETVIGATOR
HK nouser 218.189.210.17 HGC
HK usethespork 147.8.224.157 HKUNET
HK yt1n1rt 203.218.152.187 NETVIGATOR
HR
HR apollo 195.245.255.11 OGLASNIK
HU
HU 0verture 212.24.170.230 PANTEL
HU hutorfun 213.253.212.106 Fofoto
HU naamtor 85.90.166.105 HU-OPTICON-20041110
HU spongyola 193.202.88.3 CYBERSYSTEMS-NET
IS
IS klaatubaradanikto 193.4.140.225 IS-SIBERIA
IT
IT alessgio 87.14.103.209 TELECOM-ADSL-7
IT alverman 62.123.118.97 ACEATELEFONICA
IT arigatto 212.239.118.83 RATTIADSL-NET
IT bananajoe 84.220.97.65 TISCALINET
IT bestkevin 84.221.92.15 TISCALINET
IT enemy 82.56.40.135 TELECOM-ADSL-6
IT gege 82.56.187.78 TELECOM-ADSL-6
IT magisystem 84.221.197.63 TISCALINET
IT miminu 88.149.167.126 NGI-INFR1
IT molly 151.8.40.35 INFOSTRADA-CUSTOMERS-15184
IT nemesis0101 82.56.18.53 TELECOM-ADSL-6

A-16
IT newnew 151.38.93.96 IUNET-BNET38
IT obabakoak 194.21.56.6 GOLDNET
IT papinet 80.180.110.110 TELECOM-ADSL
IT t3xwi113r 151.38.231.174 IUNET-BNET38
IT tetra4 159.149.57.14 UNIMINET
IT torbis 83.184.179.221 IT-TELE2-NET2
IT torserveritalyninf 88.39.72.170 INTERBUSINESS
IT tortuga 62.48.34.110 FLUG-NET
IT ulisse 83.184.189.34 IT-TELE2-NET2
IT unixum 84.221.65.117 TISCALINET
IT xbox 84.221.204.193 TISCALINET
JP
JP ddog 59.134.15.153 KDDI-NET
JP monkeymagic 60.36.181.86 THEPPN
JP nfgtor 219.121.56.122 ASAHI-NET
JP pingi 219.196.60.124 BBTECH
JP plagw 60.42.135.249 PLALA
JP torjapan 219.105.111.74 ADACHI-NET
LV
LV 4.52387E+13 83.243.88.133 Telenet
LV clickety 62.63.190.100 TERABITS-TELIALV
LV vic 86.63.172.156 LV-CITYNET-20050628
MY
MY gnikraf 60.48.185.41 XDSLSTREAMYX
NL
NL 1 81.207.29.49 NL-PMG-ADSL
NL aprogas 130.89.160.179 UTNET
NL arighttospeak 213.84.192.84 XS4ALL
NL arighttosurf 213.84.192.84 XS4ALL
NL ben 84.41.143.100 SPEEDLINQ08
NL bigwillem 82.173.155.16 VERSATEL-CONSUMER-2
NL bloemkool 83.85.60.134 NL-CASEMA-20031128
NL ced 83.217.93.246 BE-REALROOT-20040305
NL dib0 217.19.27.52 NL-CAMBRIUM
NL digitalbrains 82.92.225.162 XS4ALL
NL dizum 194.109.206.212 NL-XS4ALL-960513
NL expander 212.129.150.55 EURONET-ADSL-2
NL exquisite 80.56.97.172 NL-CHELLO-20000509
NL fioyaz3iuthaihiera 131.155.71.110 TUENET1
NL flubber 83.160.255.58 NL-DEMON-20040303
NL flyingdutchman 82.156.33.125 WANADOO-CABLE
NL freedom 62.216.16.183 XS4ALL
NL gompie 62.163.136.55 AMSTERDAM-CUSTOMER-CABLE
NL gvg1 130.161.165.129 DUNET
NL gvg2 194.109.161.161 XS4ALL
NL isis 80.126.234.27 XS4ALL
NL lbeew 213.84.94.72 XS4ALL
NL leviathan 83.149.97.103 LEASEWEB
NL miabonkers 212.187.48.185 LELYSTAD-CUSTOMER-CABLE
NL morgana 213.84.43.3 XS4ALL

A-17
NL nggrplz 194.109.109.109 amaze
NL nightspear 193.16.154.187 NL-ZYLON
NL outerspace 131.155.141.98 TUENET1
NL pristor 80.57.244.213 ZUTPHEN-CUSTOMER-CABLE
NL rascalio 145.99.247.70 SURFSNEL-ADSL
NL rhw47 212.64.16.77 WANADOO-CABLE-DT
NL sabotage 195.85.225.145 COLOCLUE
NL sec 192.42.113.248 SURFmirror
NL streamtime 195.169.149.213 WAAG
NL swampserver 80.127.66.162 XS4ALL
NL tawny 80.126.44.214 XS4ALL
NL tonga 82.94.251.206 colonah6
NL tornyet 137.120.180.65 MAASNET
NL toronaise 137.120.180.50 MAASNET
NO
NO ai 85.165.49.148 NO-TELENOR-DSL-3
NO anemonenemorosa 84.48.64.142 NEXTGENTEL-NO
NO rain 129.177.234.39 BERGEN-NET
NO slottet 80.203.211.14 BJORG-METTE-H-ANTONSEN-NO-
NO torzone2 128.39.141.245 NTANET
PE
PE cebolla43 200.121.55.151 200.121.55.151
PL
PL bolanda 193.219.28.245 ICM-PL
PL gotodengo 83.28.60.37 NEOSTRADA-ADSL
PL kriss 217.153.252.4 MMJ-SIEMIANOWICE-PL
PL pingwin 83.24.18.77 NEOSTRADA-ADSL
PL q23bderty 195.140.155.18 KOPNET-NET-PL
PL xau 82.146.244.99 PL-BYDMAN-20030627
PL zazul 81.190.214.42 MULTIMEDIA-POLSKA-8
RO
RO dfdfasf 86.124.64.168 RO-RDSNET-IS-IASI-CABLELIN
RO elvis 86.127.228.193 RO-RDS-20050316
RO mikemckenzie 88.158.182.193 RO-EVONET
RO wiseowl 82.76.242.24 RDSNET-82-76-242
RU
RU neverland 85.15.185.38 TTKNET-COMINTEL-NET
SE
SE 3ieom3roqk7qlx 80.252.209.6 BEARNET
SE boliviakopimi 83.226.210.104 BB-BISP-STO2-SE
SE carcass 85.8.4.206 SE-WASADATA-LKP1
SE che 81.226.218.204 TELIANET
SE clomp 87.251.197.210 WEBTECHNORD-HELSINGBORG-NE
SE dfghbfght545 87.96.132.191 SE-BLIXTVIK-1
SE earthbound 85.227.10.132 SE-CYBER-20041217
SE elora 84.217.70.153 GLOCALNET-SE-NET
SE eripax 83.227.72.118 BB-BISP-DSL11-STO46-SE
SE forantipiratbyran 85.230.154.105 SE-CYBER-20041217
SE gnutten 213.113.166.243 B2-CUSTOMERS
SE gogoli 217.208.47.127 TELIANET

A-18
SE helmetedwarrior 194.47.250.233 LUNET
SE ichbineinberliner 213.114.177.149 BB-BISP-STO21-SE
SE landoonmillenium 84.119.119.199 AT-TELEKABEL-20040407
SE leeloo 85.226.135.224 BB-BISP-dsl10-skv10-jkp1
SE liveshere 213.114.238.177 BB-BISP-STO5-SE
SE lurchtor 82.214.2.226 SE-TRANSIT-KABELTV
SE maewdsa 83.233.97.253 BREDBAND2-NET-SE
SE manetherendrelle 83.219.212.101 UMEA-BRF_NORNAN-NET
SE mbop 85.225.169.74 BB-BISP-dsl11-hbg10
SE mrjones 194.47.215.94 LUNET
SE rzn 213.113.27.79 B2-CUSTOMERS
SE scheelov 81.216.128.130 AH-WHOLESALE
SE serenity 82.182.109.115 SCREAM-BOSTREAM-NET
SE stordatorn 85.226.129.119 BB-BISP-dsl10-skv10-jkp1
SE t9viej3fba73fe1 83.233.34.183 BREDBAND2-NET-SE
SE tele3 217.28.206.143 SE-TRIPNET
SE tomandandy 81.229.66.237 TELIANET
SE torebror 81.227.234.84 TELIANET
SE torlla 213.199.120.94 SKEKRAFT-NET
SE tux 213.114.29.49 BB-BISP-LKP1-SE
SE viking 81.216.158.19 AH-WHOLESALE
SE zatla 62.20.240.76 TELIANET
SG
SG qltor 202.166.24.240 MAGIX
SG toranonx 219.74.197.116 SINGNET-SG
SI
SI alpha007org 84.255.254.174 SI-T-2
SK
SK jhohnbalance 195.72.0.6 EWSK-DIAL-BB-1
TH
TH bxddavidnetthailand 124.121.173.236 ASIAINFONET
TH censorbustor 124.120.242.178 ASIAINFONET
TH pen2 125.24.68.94 TOTNET-AP
TH proview 202.149.122.98 WJG-TH
TH somjuk 202.29.6.56 THAINET-TH
US
US 44thprecinct 72.225.234.118 RRNY
US 79c14cccec 66.24.227.242 ROADRUNNER-NYS
US 8xspeed 65.25.218.34 ROADRUNNER-CENTRAL
US a2b90e6b35564bd991 68.227.90.101 NETBLK-OM-CBS-68-227-88-0
US aala 149.9.0.25 PSINET-B-9
US ajjaxsafe 69.162.42.169 69-162-0-0-Z8
US ally2006 66.235.26.171 JEFFCO-MILLENNIUM-DIGITAL-
US anarchy 207.210.85.116 GNAXNET
US anduin 209.51.169.86 HURRICANE-DC0206-5A1
US anonettorserver 70.187.87.248 NETBLK-AT-RDC-70-187-80-0
US anonisgood 70.92.178.34 RRWE
US anonnntpandim2 66.234.69.158 INJU-2BLK
US anselcomputers 24.170.55.120 ROAD-RUNNER-5
US anselmi 154.35.101.77 PSINET-B2-35

A-19
US arg0 64.246.50.101 EVRY-BLK-9
US asano 68.35.123.187 ALBUQUERQUE-1
US atticusf1nch 68.167.210.203 NETBLK-COVAD-IP-4-NET
US banana 72.21.33.202 LAYERED-TECH
US bananaphone 68.49.1.86 DC-3
US beehive 72.36.146.118 LAYERED-TECH-
US bender 207.150.167.67 SAGO-207-150-167-60
US bhmidc2 68.41.182.107 MICHIGAN-2
US binarymixer 71.133.227.217 SBC07113322721629050729023
US bitcircle 216.55.190.201 ABAC1999A
US blackstripe 67.180.83.36 BAYAREA-16
US blorchmonster 68.40.192.5 MICHIGAN-2
US blueneedle 12.222.100.156 INSIGHT-12-222-96-0-NOBLES
US botswananpula 24.206.212.55 BUCKHANNON-CEBRIDGE-CONNEC
US bubbajoeblow 216.39.146.25 SENSE
US buddhawouldbeproud 64.142.74.86 SONIC-BLK-3
US bulldozer2003 67.162.109.41 ILLINOIS-1
US bushytail 24.21.201.102 OREGON-7
US caedescontego 70.134.225.109 SBC07013422400023051028140
US caethaver2 69.113.27.92 OOL-CPE-ISLPNY-69-113-16-0
US capacitor 68.113.150.180 MDS-WI-68-113-144
US capiastor 63.85.194.6 UU-63-85-194
US cau 216.130.255.201 VIS-64-BLK1
US ceftorrd00 146.201.211.64 FSUFDDI
US cgull 24.18.9.231 WASHINGTON-9
US chaoticsilence 67.15.128.17 EVRY-BLK-15
US cherubim 18.78.1.92 MIT
US chimera 67.190.100.183 COLORADO-18
US china3 129.186.194.102 CYCLONENET
US chromakey 70.84.114.153 NETBLK-THEPLANET-BLK-13
US chunkysoup 208.40.218.144 APPSCOMM-NET1
US cipheralgo 64.122.12.107 INT-BLK-1
US clanspum 82.165.180.112 SCHLUND-CUSTOMERS
US clarity 65.196.226.32 UU-65-196-224-D1
US clearbluetormonster 71.246.25.54 VIS-BLOCK
US codegnometor1 71.83.118.3 REN-NE-71-83-112
US comeuppance 69.230.52.16 SBC06923004800020050107123
US cqas02 129.21.228.86 RIT
US crenshaw 70.110.70.238 FTTP
US crimsondestroyer 69.139.100.168 E-TENNESSEE-4
US cyberdynelabs 68.207.136.55 RR-SOUTHEAST-BLK3
US d8cf6t 66.92.188.226 SPEK-SFO-BR-46
US d9p0ph71 69.136.16.247 NAPLES-12
US dao 216.12.165.46 MERKATO-POWERED-NETWORK
US darkelf109 68.98.18.98 PH-RDC-68-98-0-0
US darkridge 64.90.164.74 NYIC-1BLK
US datadotcdu 82.165.253.73 SCHLUND-CUSTOMERS
US dedication 208.99.207.139 FORONA-TECHNOLOGIES-LLC
US default 12.76.173.57 ATTSVC-12-76-0-0
US deststorserver 68.192.208.164 OOL-CPE-RNDHNJ-68-192-208-

A-20
US digitalrhapsody1 204.15.133.171 NDCNETWORK-02
US digitalrhapsody2 64.5.53.220 NETBLK-THEPLANET-BLK-5
US dmux01 71.117.235.93 VIS-71-96
US donk3ypunch 149.9.25.222 PSINET-B-9
US doppelganger 64.175.67.76 SBC06417506600023060423215
US dragon 72.177.87.57 RRSW
US echelonalpha 71.117.236.5 VIS-71-96
US elysian 68.4.226.53 OC-RDC-68-4-0-0
US elysium 68.5.114.127 OC-RDC-68-4-0-0
US epoch 72.226.235.186 RRNY
US ericspeaks 66.219.161.166 DTC-COM-CCIFALLS
US erictor 71.112.165.46 VIS-71-96
US err 128.2.141.33 CMU-NET
US extrapolator 207.210.101.242 GNAXNET
US factormachine 24.238.57.137 PENTEL-CABLE
US fartknocker 64.95.64.86 PNAP-BSN-ARDENN-DC-01
US fcmc 216.105.150.8 ACSINC-BLK-1
US fern 64.5.53.76 NETBLK-THEPLANET-BLK-5
US findthecup 216.237.143.47 XOXO-BLK-19
US floydian 68.57.216.138 INDIANAPOLIS-2
US fluffycrypto 70.132.32.156 SBC07013203200019051025142
US freedaemontor 66.210.104.251 NETBLK-OK-OHFC-66-210-104-
US freedomvoice 63.149.255.18 Q0113-63-149-255-0
US froggy 24.255.8.175 NETBLK-PH-RDC-24-255-0-0
US fry 192.83.249.30 BUNGI
US ftsiiwew90 66.93.134.53 SPEK-SFO-BR-7
US furrywannabe 71.210.181.168 QWEST-INET-118
US gameover 24.8.67.2 COLORADO-10
US gamma 216.55.149.21 ABAC1999A
US gentoopenguins 72.9.242.90 GNAXNET
US gewegsg 169.237.136.170 UCDAVIS2
US ghettocluster 70.92.81.85 RRWE
US ghewgill 69.41.174.196 800-NET1
US ghotiwork 12.44.215.27 ACCESS2G19-215-0
US ginsberg 65.28.30.197 RR-CENTRAL-2BLK
US gnunet 131.179.224.133 UCLA-CS
US gojimmers 144.126.75.68 LOYOLA-IN-MD
US gold 24.118.78.189 MINNESOTA-1
US goldensun 69.200.81.164 RRNY
US gondwanaland 64.5.53.33 NETBLK-THEPLANET-BLK-5
US goocononion1 74.129.166.67 INSIGHT-COMMUNCATIONS-CORP
US gotclue 216.32.80.75 NET-216-32-64-0
US graze 71.116.80.146 VIS-71-96
US greybeard95a 66.93.170.242 SPEK-333585-0
US gtisc 199.77.130.14 LVLT-ORG-199-75
US gusgate 67.40.233.130 QWEST-INET-116
US hackshaven 64.81.100.208 SPEK-DSL-BR22-0
US hamaphry1 68.116.85.27 TRLK-CA-68-116-80
US hamcavetor 66.92.13.212 SPEK-DSL-SFO-BR4-0
US hanselwilson 71.112.223.105 VIS-71-96

A-21
US hbro 12.210.240.109 ATT
US hcpnet 65.174.217.58 FON-110197790494889
US heilong 67.174.220.150 BAYAREA-15
US heimdal 74.67.47.248 RRNY
US hellohellomoomoo 71.250.215.8 VIS-BLOCK
US hgabertgoldmine 166.70.232.84 XMISSION-166-70-0-0
US hiball 160.36.137.37 MED-NET
US hologramtw 24.47.23.103 OOL-CPE-STJMNY-24-47-16-0-
US holyfreakingcrap 208.14.31.5 FON-349058457672565
US hpeterstorserver 24.111.174.178 MIDCO
US httpdnet 66.90.89.162 FDCSERVERS
US hubbahubbahubba 154.35.47.59 PSINET-B2-35
US icarus 69.134.216.49 RRMA
US ice 66.119.199.39 GCNETBLK-TERRA1
US idealworld 68.236.70.84 VZ-DLWRLD-1
US ididediconfigtphhhh 68.202.36.79 RR-SOUTHEAST-BLK3
US ieditedtheconfig 66.75.35.155 RR-WEST-2BLK
US illithid 208.40.218.131 APPSCOMM-NET1
US illithid2 208.40.218.136 APPSCOMM-NET1
US inap1 64.74.207.50 PNAP-SEA-BLOCK4
US intarweb 70.232.81.31 SBC07023208000020051116153
US inthekeyofv 70.246.78.213 SBC07024607800023050404194
US iris 138.202.192.210 USFCA
US irishcitizensarmy 68.199.62.178 OOL-CPE-NYX2NY-68-199-56-0
US irithimus 64.132.239.129 TWTC-COI-01
US janus3 66.70.10.53 DATAPIPE-BLK3
US jizbomb 141.149.128.197 VIS-141-149
US jms1 209.114.200.129 FIBERPLUS
US joeysa64 69.110.57.243 SBC069110048000040218
US joiseytor 154.35.85.17 PSINET-B2-35
US juniormint 72.228.245.16 RRNY
US knauerhase 24.22.8.74 OREGON-9
US krumpet 66.96.192.44 NOC
US kumbaya 24.11.233.143 SOUTHBEND-2
US landrover 70.85.75.42 NETBLK-THEPLANET-BLK-13
US lantana 68.166.0.140 NETBLK-COVAD-IP-4-NET
US leela 66.111.43.137 SAGO-66-111-43-130
US lefkada 140.247.60.64 HARVARD-COLL
US lehighnet 66.197.193.212 HOSTNOC-2BLK
US lemongrass 71.129.180.29 SBC07112918000022050503214
US lillemy 66.199.240.50 NETBLK-EZZI
US linuxonthebrain 216.137.65.86 AVALON-NETWORKS
US livefreeordie 68.96.178.10 LV-RDC-68-96-160-0
US loosemoose 206.174.19.25 GCI-ALASKA-5BLK
US lostinthenoise 64.142.98.231 SONIC-BLK-3
US m 69.163.32.140 69-193-32-0-Z3
US m00kie 154.35.36.18 PSINET-B2-35
US manning18 68.167.210.195 NETBLK-COVAD-IP-4-NET
US markoer 64.90.191.94 NYIC-1BLK
US martinscorsese 71.32.251.76 QWEST-INET-119

A-22
US mauger 149.9.137.153 PSINET-B-9
US mc242 208.66.194.14 MCCOLO
US mercury 24.91.169.157 BOSTON-7
US merlin 66.90.118.68 FDCSERVERS
US midator 24.9.185.227 COLORADO-10
US middleman 68.40.171.66 MICHIGAN-2
US minotor 71.242.124.82 VIS-BLOCK
US mmitor 70.248.104.35 SBC07024810400022050102144
US moria1 18.244.0.188 MIT
US moria2 18.244.0.114 MIT
US mp94564 24.7.86.165 BAYAREA-11
US mtrojnar 64.62.190.126 HURRICANE-CE1301-9087
US multicstor 67.101.197.199 NETBLK-COVAD-IP-4-NET
US mushin 18.152.2.242 MIT
US myrandomnode 72.165.204.124 Q0209-72-165-204-0
US nao 70.152.40.47 BELLSNET-BLK15
US nbx 64.142.31.83 SONIC-BLK-3
US neurohydra 216.254.70.208 SPEK-NYC-BR-103
US neuropunks 38.117.144.218 COGENT-NB-0002
US neworleansla 70.156.122.109 BELLSNET-BLK15
US newtorserverofmine 24.148.3.176 RCN-BLK-25
US nicj 64.34.180.99 PEER1-SERVERBEACH-02
US nickname 24.196.173.135 ASHE-NC-24-196-160
US nopants 70.179.174.128 NETBLK-MA-RDC-70-179-128-0
US nowhereman 209.221.206.114 QNET-0
US nurotek 66.52.66.26 PWT-SKTN-3817
US nycbug 64.90.179.108 NYIC-1BLK
US olden 64.81.246.230 SPEK-DSL-SFO-BR3-0
US omgprivacy 68.94.13.72 SBC068094000000040102
US omgroflstfuthx 68.68.234.218 68682240-Z7
US omgwtf 64.81.240.144 SPEK-DSL-SFO-BR3-0
US onionkicksass 69.60.120.99 INMM-69-60-114-0
US optimum 69.123.5.158 OOL-CPE-LYBRNY-69-123-0-0-
US p4killa 67.162.80.138 ILLINOIS-1
US palisade 24.7.38.138 BAYAREA-11
US pansqopticon 68.174.141.133 ROADRUNNER-NYC-4
US pappymcnasty 12.44.215.69 ACCESS2G19-215-0
US paradox985 24.12.139.78 ILLINOIS-14
US paulz 24.34.185.135 BOSTON-5
US paxprivoso 149.9.205.73 PSINET-B-9
US phobos 66.228.127.27 SOFTLAYER-NETBLOCK2
US phoboslabs 71.245.238.31 VIS-BLOCK
US phuzzie 64.142.78.232 SONIC-BLK-3
US pianarchist 67.20.56.66 6720320-Z5
US pizon 72.20.1.166 STAMINUS-COMMUNICATIONS
US planck 68.167.210.150 NETBLK-COVAD-IP-4-NET
US pleasant 66.92.65.81 SPEK-DSL-BOS-BR0-0
US pmw 209.223.236.238 SAVV-T31436-3
US poptex 154.35.55.129 PSINET-B2-35
US privacyecosystem1 66.98.136.49 EVRY-BLK-14

A-23
US privacyecosystem2 66.98.208.43 EVRY-BLK-14
US privacyecosystem3 67.15.225.36 EVRY-BLK-15
US privbox 68.196.204.6 OOL-CPE-PRNYNJ-68-196-192-
US pup 67.173.143.46 ILLINOIS-11
US qnetanonproxy 209.221.193.39 QNET-0
US qumquat 154.35.217.62 PSINET-B2-35
US randombox 24.10.127.243 SACRAMENTO-9
US readmorebooks 71.56.119.250 ATLANTA-13
US *redemmas 66.93.119.120 SPEK-BLT-BR-4
US richhomednsorg 151.197.195.212 VZ-DSLDIAL-PHLAPA-3
US rndmodmdmtornnode 69.62.156.11 SUREWEST-BROADBAND
US robomasked 69.165.250.121 69-165-128-0-Z10
US rodos 140.247.62.64 HARVARD-COLL
US s3rv3runkn0wn 71.229.90.176 MICHIGAN-G-8
US sacredkowz 68.167.210.88 NETBLK-COVAD-IP-4-NET
US sasquatch 207.44.180.3 EVRY-BLK-11
US schtichenit2damon 66.92.35.222 SPEK-DSL-LAX-BR4-0
US sdpeaecpe 68.94.196.229 SBC068094192000040115
US secretagenda 24.30.67.89 ATLANTA-3
US serifos 140.247.62.119 HARVARD-COLL
US server334 70.162.75.105 NETBLK-PH-RDC-70-162-0-0
US seventreasures 68.171.58.114 68171320-Z7
US shadowroot 69.249.105.136 PA-28
US shamborfosi 68.20.22.44 SBC068020016000020514
US shiggidy 24.99.140.249 ATLANTA-5
US silenticey2 71.98.9.231 VIS-71-96
US sipbtor 18.187.1.68 MIT
US sisyiphustwo 74.237.5.229 BELLSNET-BLK18
US sniper 66.32.101.55 EARTHLINKDSL-2BLK
US soprano1 154.35.72.223 PSINET-B2-35
US sosayweall 24.21.11.160 OREGON-7
US spanktacular 70.127.121.248 RRSW
US sparky 69.12.145.165 SONIC
US spoon 128.30.28.19 MIT-NET
US spslosalamitos 67.49.101.49 RRWE
US starling 69.51.152.43 JASNET-ONE
US stinky 69.31.42.139 NLYR-69-31-40-0-1
US stugsdotcom 216.9.82.85 PINN-216
US subsurfaces 68.13.104.181 OMRDC-68-13-0-0
US t800 216.67.26.114 ACSG-1-NET-1
US talentperrine 208.40.218.151 APPSCOMM-NET1
US tapthisassholes 71.245.102.3 VIS-BLOCK
US tditor0 64.146.134.221 NOANET-SBLK2-SAWNET1
US techfinesse 64.135.207.45 FVI-NET
US tekgnome 70.39.193.13 70-39-0-0-Z7
US teleri 216.32.89.2 NET-216-32-64-0
US tenacity 154.35.1.8 PSINET-B2-35
US thearistocrats 206.124.149.146 BLARG-BLK
US thebigcheeseofall 209.181.56.100 QWEST-INET-112
US thegreatsantini 149.9.92.194 PSINET-B-9

A-24
US thehackerfoundation 64.142.22.13 SONIC-BLK-3
US themightytor 70.176.93.179 NETBLK-PH-RDC-70-176-0-0
US theprocess 82.165.144.169 SCHLUND-CUSTOMERS
US theseed 24.250.192.233 NETBLK-AT-RDC-24-250-192-0
US thisisnotajoke 72.40.156.54 ERLK-TW-CENTRALFL02
US thruvu 209.172.52.78 IWEB-HD-T838CL-1
US thundergododin 63.211.169.142 LEVEL4-CIDR
US ticktockclock 69.212.31.172 SBC069212030000040224
US tonealdon 70.245.211.184 SBC07024521000023050307192
US tor4781671 216.231.168.178 MEBTEL-BLK-7
US toratgmcto 70.84.253.4 NETBLK-THEPLANET-BLK-13
US torhbg 69.242.85.10 PA-METRO-27
US tornsd 24.94.2.121 ROAD-RUNNER-3-A
US torrific 71.126.187.88 VIS-71-96
US torrigauci 5.20.197.41 RESERVED-5
US torro50 68.107.40.142 COX-ATLANTA-2
US torserver123 169.232.102.54 UCLANET4
US torsvartvittorg 64.5.53.254 NETBLK-THEPLANET-BLK-5
US torture 209.237.225.244 NET-BLK-TOADHALL
US toruser2867562 71.56.235.157 COLORADO-16
US transistor 24.183.45.221 MDS-WI-24-183-32
US troglomatix 72.3.249.87 RSCP-NET-4
US trustnone 209.67.209.196 CW-209-67-208
US twosixsix 74.0.33.114 NETBLK-COVAD-IP-6-NET
US ultraviolet 75.5.99.178 SBC07500509917629060409013
US ulwy75nt743 68.48.87.43 DC-3
US undef 216.218.240.205 HURRICANE-CE0579-331
US veronika 66.199.252.58 NETBLK-EZZI
US viaov 71.120.32.3 VIS-71-96
US vietnamwitch 70.101.164.134 ELI-NETWORK-ELIX
US vm 38.99.66.86 PSINETA
US voigner 216.27.178.157 SPEK-DSL-SFO-BR2-0
US whatever 64.136.200.11 EVEREST-BLK3
US whomthebelltolls 66.200.164.250 DSL-NET-17
US whooodat 66.92.220.226 SPEK-NYC-BR-115
US wilderness 24.159.55.136 CLKSVL-TN-24-159-48
US wintools 208.66.194.6 MCCOLO
US woden 154.35.12.203 PSINET-B2-35
US xtremenw 71.231.237.76 WASHINGTON-17
US xxserver3 24.199.198.152 RR-COMM-MIDSOUTH
US xyzzyx 67.166.235.186 TEXAS-5
US *yargh 69.55.237.39 JOHNCOMPANIES
US yeatorfday 209.6.168.183 RCN-BLK-9
US yo 168.150.251.36 DCN-B1
US yonkeltron 68.80.155.150 PA-METRO-7
US yoshtor 66.236.18.180 XOX1-BLK-2
US yxgdf09e7987sa6f97g 64.217.16.129 SBC064217016000030615
US zachsplaceorg 66.219.59.183 CORENAP-NETBLOCK-01
US zantars 72.72.92.133 VIS-72-64
US zymurgy 18.246.1.160 MIT

A-25
ZA
ZA leftover 196.11.98.20 UWCNET3

A-26