3380-1 (CFNOC/DND CIRT)

09 Jul 06

NOS O (via CoC)

I&W ANALYSIS - ONION ROUTING AND "TOR"

INTRODUCTION

1. (U) As of late, there has been much discussion in both the internet and hacking communities regarding "Onion Routing" (hereafter referred to as "OR") and an open source OR implementation designated "TOR".

2. (U) Both OR and TOR are specifically designed to:

a. provide anonymous internet connections (obfuscation of communication end points, resistance to eavesdropping/packet sniffing and traffic analysis prevention); and

b. provide a facility for "hidden servers".1

Anonymous Internet Connections

3. (U) Users of the TOR network run an "Onion Proxy" on their machine; this proxy connects to the TOR network, periodically negotiating a virtual circuit through which the data will be forwarded; this proxy can either be implemented using software or a shim in the OS' network stack.

4. (U) TOR employs public key cryptography in a layered manner (hence the 'onion' analogy), ensuring perfect forward secrecy (PFS)2 between routers. At the same time, the Onion Proxy software presents a SOCKS3 interface to its clients; SOCKS-aware applications may then be pointed at TOR, which then multiplexes the traffic through a TOR virtual circuit.

5. (U) Once inside the TOR network, the traffic is sent from router to router, ultimately reaching an exit node at which point the unencrypted packet is forwarded on to its original destination. Viewed from the destination, the traffic appears to originate at the TOR exit node.

6. (U) In addition to anonymous routing, TOR is often coupled with Privoxy (a filtering proxy server) when browsing the web; use of Privoxy provides additional anonymization at the Application Layer.

1 A hidden server is one that is hosted on a machine that also acts as an active onion router; the nature of OR is such that clients can connect to the server without actually knowing its location.

2 A key-establishment facility used to secure private network communications; with PFS, if one encryption key is compromised only data encrypted by that specific key is compromised. For PFS to exist, the key used to protect transmission of data must not be used to derive any additional keys.

3 A protocol for handling TCP traffic through a proxy server. SOCKS can be used with virtually any TCP application; the protocol is documented in RFC 1928, RFC 1929 and RFC 1961.

1

Hidden Servers

7. (U) Although TOR's most popular feature is its provision of anonymity to clients, it can also provide anonymity to servers. Using the TOR network, it is possible to host servers in such a way that their network location is unknown.

8. (U) Hidden servers are accessed through the TOR-specific ".onion" top level domain (TLD). The TOR network understands this TLD and provides an anonymous route to the hidden server; the hidden server then hands client requests over to standard server software.

The TOR Menace

9. (U) As demonstrated in Annex A, interest in TOR has risen significantly in recent months; this has seen roughly a 154% increase in the available TOR nodes since November 2005; TOR is receiving considerable media attention, particularly in network security/hacking circles.

10. (U) Considering the open source nature of TOR, the sudden upswing in its popularity, the fact that TOR can be used for any TCP based application and the discussions taking place on various hacking websites/IRC channels, it is only a matter of time before hostile entities begin to use the technology for directed network reconnaissance and attacks.

AIM

11. (U) The purpose of this report is three fold:

a. to convey information regarding OR and TOR in order that the reader may understand the concepts involved with the technology;

b. to convey information regarding the potential threat TOR poses to the organization's network assets; and

c. provide recommendations to defend our network assets from hostile

entities that may make use the TOR network to conduct network reconnaissance and attack.

DISCUSSION

OR Concepts & Technologies

12. (U) Prior to explaining OR and TOR, one must be aware of the three basic concepts/technologies used in its design; these are:

a. traffic proxies;

b. public key cryptography; and

c. Chaum Mixes.

2

Traffic Proxy

13. (U) A traffic proxy is a host that is placed between a client and another server and intercepts the network session. The proxy handles the traffic exchanged to and from the client, making the connection to the server on the client's behalf. As demonstrated in Annex C, the client never touches the remote server directly and remains anonymous.

14. (U) Although the traffic proxies are easily implemented, there are several weaknesses that render its anonymization useless to a determined adversary. These include:

a. the proxy provides a single point of failure, compromise and/or attack;

b. link encryption is not inherent - traffic being passed between the client and the proxy is subject to intercept and/or analysis; and

c. routing information is conveyed unencrypted - the proxy is always aware of the source and destination of the connection request.

Public Key Cryptography

15. (U) Public Key Cryptography is a cryptographic system invented in 1976 by Whitfield Diffie and Martin Hellman that utilizes two types of keys:

a. a public key known to everyone - the recipient's public key is used to encrypt the message; and

b. a secret key known only to the recipient of the message - the recipient uses the private key to decrypt the message.

16. (U) The public and private keys are related in such a way that only the public key can be utilized for encryption and only the corresponding private key can be used for decryption; in addition, it is virtually impossible to derive the private key even if an one possesses the public key.

17. (U) Public Key Cryptography is used in both Chaum Mixes and OR in order to provide a level of anonymity by encrypting data and/or routing information.

The Chaum Mix

18. (U) The spark that led to the development of the OR's initial concept can be found in a whitepaper regarding anonymous e-mail transmission authored by Dr. David Chaum in 1981.

19. (U) In his paper, Dr. Chaum presented a system for anonymous E-mail communication using public key cryptography and an network consisting of a large number of what he called "Mix Nodes" (basically a special e-mail proxy); a simplified diagram of a Chaum Mix Network is demonstrated in Annex D.

3

20. (U) Mix Nodes accept e-mails encrypted with the node's public key, decrypts them, places them into a transmission queue for an arbitrary period of time and then forwards them to the next Mix Node in the circuit. When the final Mix Node is reached, the final layer of encryption is removed and the e-mail is forwarded to the recipient.

21. (U) The OR technique builds upon Dr. Chaum's initial work in the anonymization of e-mail traffic and expands the concept, allowing for the anonymization of virtually any TCP based application.

OR 101 - An Introduction to Onion Routing

22. (U) Contrary to popular belief, use of a switched communication network does not preclude anonymity. The OR technique, developed by the U.S. military in the late 1990s, allows for anonymous communications over packet switched networks such as the Internet.

23. (U) OR was originally developed to serve as a flexible switched communications infrastructure that would be resistant to both packet sniffing and traffic analysis; this was accomplished by separating the packet's identification information from its routing information and the use of encryption.

24. (U) OR uses generic networking/proxy techniques and a variation of the Chaum Mix to protect both the privacy and anonymity of communication channels. Using OR technology, connections are always anonymous; any information being conveyed may also be rendered anonymous by purging identifying information from the data stream.

25. (U) Though originally designed to run on Solaris 2.5/2.6, the current version (TOR) is easily implemented in a variety of operating systems and can be employed in a wide variety of TCP based Internet applications (e.g. web browsing/publishing, FTP, IRC, IM, etc.); TOR will be discussed further below.

26. (U) When the initiator endpoint wishes to establish an anonymous connection to a host, it first connects to a SOCKS proxy; the SOCKS proxy accepts protocol-specific connections from applications and converts them into a generic routable protocol.

27. (U) Once this is done, the packets are forwarded to an "Onion Proxy". The Onion Proxy then creates a route over the "onion network" and constructs a special data structure known as the "initial onion". Once the onion is constructed, it is passed to the TOR overlay network.

28. (U) When an onion router receives an onion, the outer layer is decrypted, revealing a layer containing information about the next hop in the route; this layer is then discarded and the onion forwarded on to this next hop in the circuit.

29. (U) Eventually the onion will reach the final hop on the overlay network, known as an "Exit Node". The final layer of the onion will then be decrypted revealing the original data packet; this packet will then be forwarded to the recipient endpoint.

30. (U) A simplified diagram of the onion decode and forward process can be found in Annex E.

4

OR 201 - Enter TOR

31. (U) TOR, the latest incarnation of OR, is easily implemented on a plethora of platforms (Windows, *nix, BSD, etc.). In addition, virtually any unmodified SOCKS compatible TCP/IP based application can use TOR either by means of a proxy or by shimming the network protocol stack of the host.

32. (U) In order to create a private network pathway with TOR, a circuit of encrypted connections is built incrementally, extending the circuit one node at a time as demonstrated in Annex F.

33. (U) Each node in the TOR circuit knows only which node forwarded it data and to which node it is forwarding data - no individual node knows the complete path that a data packet has taken. The onion proxy negotiates a separate set of encryption keys for each hop along the circuit to ensure that the routing information remains anonymous along each hop.

34. (U) Once a TOR circuit has been established, any SOCKS compliant TCP based communication can be transmitted over the circuit. As each server sees no more than a single hop in the circuit, neither sniffing nor the compromise of an individual onion router will reveal the endpoints of the connection.

35. (U) In order to prevent abuse, each TOR node's "exit-policy" (a form of ACL4 - An example of the default TOR exit policy is demonstrated in Annex H) can be configured to selectively deny or allow access to external addresses and services. Despite this feature, it is worth noting that there are potentially hundreds of "open exit nodes"5 that allow full connectivity to any resource using any service.

36. (U) The advantages of using TOR over other anonymizing solutions include but are not limited to:

a. anonymity is further enhanced as single anonymous circuits are shared with multiple TCP streams;

b. TOR is compatible with all SOCKS compliant applications;

c. flexible "Exit Policies" allow each node to choose what applications can use the node and where the node can reach;

d. "Hidden Servers" are easily implemented;

e. TOR provides "Perfect Forward Secrecy";

f. traffic replay attacks are rendered impotent; and

g. TOR implements robust communications circuits; unlike normal "single hop" proxies, no single point of failure exists.

4 Most network security systems operate by allowing selective use of services. An Access Control List (ACL) is the usual means by which access to, and denial of, services is controlled; it is simply a list of the services available, each with a list of the hosts permitted to use the service.

5 On an Onion Network, the node at which point the cleartext packet is available and is forwarded on to its final destination; viewed from the destination, the traffic appears to originate at the Tor exit node's IP address.

5

37. (U) The potential threat of Onion Routing lies in its ability to allow attackers to conduct completely anonymous reconnaissance and attacks directed at remote networks.

38. (U) TOR is specifically designed to stymie analysis attempts; considering this, anonymous reconnaissance and attacks could conceivably be directed network assets at the whim of an attacker while at the same time hindering the victim's incident analysis and response efforts.

CONCLUSIONS & RECOMMENDATIONS

A "Clear and Present Danger"

39. (U) TOR, with its increasing popularity and recent exposure in various hacking/computer security media, poses a clear and present danger to the organization's network assets.

40. (U) In addition to its increased public exposure, hundreds of unverified TOR nodes have appeared since November 2005; the appearance of these nodes be an indicator of increased untoward activity.

41. (U) As the TOR network is a public and the software is open source, belligerent nations could conceivably utilize TOR or deploy hidden servers that could be used specifically to conduct anonymous attacks/reconnaissance against the organization's network assets.

42. (U) In addition to the anonymity provided by the TOR network, any attacks routed through it that would be resistant to most analysis techniques, greatly hindering both analysis and incident response.

43. (U) Considering the above, it is hereby recommended that:

a. primary TOR nodes be immediately blocked at the network perimeter (a partial list of primary TOR nodes can be found in annex X);

b. "rogue" TOR nodes be blocked at the network perimeter as they are identified; and

c. online monitoring of the appropriate online resources (e.g. http://serifos.eecs.harvard.edu/cgi-bin/exit.pl) be undertaken to block new primary TOR nodes as they come online.

6

44. (U) Any questions regarding this report may be addressed to the undersigned.

//signed//

E.L. Mac Daibhidh, CDCplSpecial Operations AnalystDND CIRT IH&AA TeamSpecial Operations Cell945-7747

Attachments:

References

Annexes A-H

7

8

References:

Chaum, Dr. David. Communications of the ACM, Volume 24 Number 2. "Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms". Febuary 1981. Accessed on 1 July 2006. www.freehaven.net/anonbib/cache/chaum-mix.pdf.

Darknet Administrator. "Anonymity - Hiding Your Identity in 2006". 16 May 2006. Accessed on 17 May 2006. http://www.darknet.org.uk/2006/05/anonymity-hiding-your-identity-in-2006/.

Danezis, George. "Anonymous Communications I". Date unknown. Accessed on 17 June 2006. www.ccc.de/congress/2004/fahrplan/ files/355-anonymous-communication-slides.pdf.

Dhanjani, Nitesh. "Launching Attacks via Tor". 10 July 2005. Accessed on 02 June 2006. http://www.oreillynet.com/pub/wlg/7333.

Dhanjani, Nitesh. "Tor: An Anonymous Internet Communication System". 20 January 2005. Accessed on 02 June 2006. http://www.oreillynet.com/onlamp/blog/2005/01/tor_an_anonymous_internet_comm.html.

Dingledine et al. "Tor: The Second Generaton Onion Router". August 2005. Accessed on 25 May 2006. http://www.onion-router.net/Publications/tor-design.pdf.

Harrison, Ann. "Onion Routing Averts Prying Eyes". 05 August 2004. Accessed on 03 Mar 2005. http://www.wired.com/news/privacy/0,1848,64464,00.html.

Hasuo, Ichiro. "Provable Anonymity". 27 May 2005. Accessed on 30 June 2006. www.cs.ru.nl/~ichiro/talks/spanWorkshop.pdf.

Holer, Vlastimil. "Practical Onion Routing". Date unknown. Accessed on 20 June 2006. www.fi.muni.cz/~xholer/content/school/tor/poster.pdf.

Infosecninja Administrator. "Anonymizing network traffic using TOR". 28 Jun 2005. Accessed on 31 May 2006. http://www.infosecninja.org/content/view/16/28/.

Leech et al. "RFC1928 - 'SOCKS Protocol Version 5'". March 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1928.txt.

Leech, M. "RFC1929 - 'Username/Password Authentication for SOCKS V5'". March 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1929.txt.

McMahon, P. "RFC1961 - 'GSS-API Authentication Method for SOCKS Version 5'". June 1996. Accessed on 03 June 2006. ftp://ftp.rfc-editor.org/in-notes/rfc1961.txt.

Noreply Wiki. "TheOnionRouter/TorFAQ" (sic). Last edited on 04 June 2006. Accessed on 05 June 2006. http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ.

O'Morain et al. "Onion Routing for Anonymous Communications". Date unknown. Accessed on 01 June 2006. http://ntrg.cs.tcd.ie/undergrad/4ba2.05/group10/index.html.

Permeo Technologies, Inc. "SOCKS Overview". 2005. Accessed on 31 May 2006. http://www.socks.permeo.com/AboutSOCKS/SOCKSOverview.asp.

i

Reed et al. "Anonymous Connections and Onion Routing". 1998. Accessed on 25 May 2006. http://www.onion-router.net/Publications/JSAC-1998.pdf.

Security Focus. In Focus "Pen-Test" Forum. "Pen-Testing via TOR". Last reply on 22 July 2005. Accessed on 30 May 2006. http://www.securityfocus.com/archive/101/406003/30/0/threaded.

Stanford et al. "TheOnionRouter - NoreplyWiki" (sic). Last edited on 19 May 2006. Accessed on 26 May 2006. http://wiki.noreply.org/noreply/TheOnionRouter.

U.S. Naval Research Laboratory. "Onion Routing - Executive Summary". November 2003. Accessed on 02 May 2006. http://www.onion-router.net/Summary.html.

"Weasel". "Anonymous Remailer Stats, Meta-Stats and other Information". 16 May 2006. Accessed on 16 May 2006. http://www.noreply.org/tor-running-routers/totalLong.html.

Wikipedia.org. "Onion Routing". Last edited on 10 May 2006. Accessed on 11 May 2006. http://en.wikipedia.org/wiki/Onion_routing.

Wikipedia.org. "Tor (anonymity network)" (sic). Last edited on 30 May 2006. Accessed on 08 May 2006. http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29.

ii

(U) ANNEX A - Available TOR Routers (May 2004 - May 2006)

This graph, obtained from the Noreply website, clearly demonstrates the increase in available TOR nodes since May 2004.

A-1

(U) ANNEX B - TOR Network Data Throughput (May 2004 - May 2006)

This graph, obtained from the Noreply website, clearly demonstrates the increase in TOR traffic that has been directly proportional to the increase in TOR nodes.

A-2

(U) ANNEX C - Rudimentary Anonymizing Proxy

The diagram below demonstrates a rudimentary anonymizing proxy. Connections routed through the proxy appear to originate from the proxy and not from the endpoint host.

Advantages:

• Simple implementation.• Focuses traffic to enhance anonymity.

Disadvantages:

• Single point of failure, compromise and attack.• Link encryption is not inherent, proxy is always aware of the

source and destination of the connection request.

A-3

(U) ANNEX D - Simplified Chaum Mix-Net

A simplified diagram of a simple Chaum Mix-Net is demonstrated above. The initiating endpoint first encrypts the email with the public key for the last Mix in the circuit and then encrypts it again with the public key for the first hop in the circuit.

The e-mail is then sent to the first Mix on the Mix-Net, which proxies the e-mail on behalf of the sender, thereby obfuscating the location of the initiator. The e-mail is then decrypted with the Mix's secret key and any identifying information is stripped from the e-mail headers.

The e-mail, still encrypted with C(2) is then placed in an arbitrary transmission queue where it is held for a random amount of time then forwarded to the last Mix in the circuit. On arrival at the final Mix, this process is repeated and the original e-mail, now stripped of all identifying information, is forwarded to the destination endpoint.

A-4

Internet Cloud

Initiator Endpoint

MIX 1

Proxies the traffic from the initiating endpoint to obfuscate its identity.

Decrypts C(1) with its secret key.

Changes identifying information within the e-mail header (FROM, TO, etc.).

Message is placed in a transmission queue to add a random delay to the next hop.

The message, still encrypted with C(2) is forwarded to the next mix.

MIX 2

Proxies the traffic from MIX 1 to obfuscate its identity.

Decrypts C(2) with its secret key.

Changes identifying information within the e-mail header (FROM, TO, etc.).

Message is placed in a transmission queue to add a random delay to the next hop.

The unencrupted message is forwarded to the destination endpoint..

Message

C(2)

C(1)

DestinationEndpoint

(U) ANNEX E - The Onion Decrypt and Forward Process

Initial Onion forwarded to hop one.

The first router decrypts the C[1] layer using its private key in order to find the IP address of the next router in the circuit and encrypted data.

Onion forwarded to second hop.

The router located at the second hop will decrypt the C[2] layer using its private key in order to find the IP address of the final router in the circuit and encrypted data.

Onion forwarded to final hop.

The router located at the final hop will decrypt the C[3] layer using its private key in order to find the unencrypted data packet.

Data forwarded from final hop to recipient endpoint.

The router located at the final hop forwards the unencrypted data packet to the recipient endpoint outside the OR cloud.

The diagram above demonstrates the initial onion generated for a two-hop trip through the OR cloud and the actions taken as the onion travels along each hop.

After the Onion Proxy determines the route the data will take through the OR cloud, it constructs an initial onion which consists of a payload and routing information surrounded by layers of encryption.

At each hop along the circuit, another layer of the onion is decrypted, revealing the next destination in the communications link; once the final l hop of the circuit is completed, the last onion router decrypts the final layer of routing information and forwards the data to the recipient endpoint.

A-5

(U) ANNEX F - Onion Routing Circuit Configuration

The simplified diagram above demonstrates the basic configuration of an OR circuit through multiple Onion Routers from the initiator endpoint to the recipient endpoint.

The SOCKS proxy accepts protocol-specific connections from applications on behalf of the client (the initiator endpoint), and converts them into a generic protocol (such as a stripped down SOCKS protocol); the data packets are then forwarded to the onion proxy.

The onion proxy is aware of the OR network topography and determines the path the data will take through the cloud and constructs a the initial onion.

A-6

(U) ANNEX G - TOR Telescoping Circuit

Onion routers form a telescoping "overlay" network and combine the use of proxies and mixes in order to ensure the anonymity of the communication link; note that this does not involve the anonymization of the underlying information.

The diagram below demonstrates a simplified version of OR's telescoping circuit setup process.

A-7

(U) ANNEX H - Default TOR Exit Policy

TOR's default exit policy is demonstrated below. The syntax of each policy rule is "accept|reject ADDR[/MASK]:PORT". An asterisk is used as the policy wildcard; if "/MASK" is omitted then the rule applies solely to the IP address in the rule.

A-8

Default TOR Exit Policy:

reject 0.0.0.0/8reject 169.254.0.0/16reject 127.0.0.0/8reject 192.168.0.0/16reject 10.0.0.0/8reject 172.16.0.0/12accept *:20-22accept *:53accept *:79-81accept *:110accept *:143accept *:443accept *:706accept *:873accept *:993accept *:995reject *:1214reject *:4661-4666reject *:6346-6429reject *:6881-6999accept *:1024-65535reject *:*

(U) ANNEX I - Known Primary TOR Nodes (02 Jun 2006)

CountryCode

Node Designation Node IP Address Node Net Name

ATAT attnjupiter 80.120.3.32 TZA-HWY-ATAT euripides 62.178.28.11 VIE-11-CUSTOMERS-DOCSISAT kronegger 83.65.91.110 Dieter-KroneggerAT linzfrank 140.78.95.135 JKU-LANAT mundl 195.230.168.95 ICB-NETAT nickthephreak 86.56.195.211 AT-LIWEST-HEADEND-86-56-19AT no0borders 83.64.135.124 Textdesign-GmbHAT scgghjtywbtzda9yzi 217.196.64.205 FUNKNETZ-DSL-CUST-1AT tor26 86.59.21.38 SIL-ALFIEAUAU nexus 202.173.141.155 WestNetAU psion 220.233.6.198 EXETELAU wokwaixtor 203.59.165.124 IINET-AUBEBE blueaqua 213.219.164.163 BE-EDP-20000830BE justatorserver 81.11.162.171 PI-BELGIUMBGBG thunder 217.79.72.59 D-D-SOFTSYSTEM-VARNA-BG-NEBRBR poderosotor 200.222.114.90 AS7738CACA biffhenderson 65.92.65.203 NEXHSE6-CACA citlabwin32 128.100.171.34 TORONTOCA comfortablynumb 216.194.67.53 TERA-BYTE-3CA computer 70.27.181.246 DOC-4-8-1-1-WLFDLE-3CA deuxpi 66.11.179.38 PEER1-DONCASTER-BLK1CA gatekeeper 66.130.125.131 VL-D-MT-42827D00CA gingkobiloba 216.239.83.223 VIF-BLK-1CA kgn9yct9 69.194.143.65 DOC-1-8-1-2-WLFDLE-3CA leafs 70.53.93.156 SYMF20051102-CACA lionstooth 64.26.169.184 MAGMA-BLK3CA lostwizard 198.161.91.196 LEXICOM-ABCA mick 69.70.104.213 VL-D-SC-45466800CA mozgotor 142.167.19.244 ALIANT-TEL-142-167CA mytor654321 72.0.207.216 EBOX-24207072-CACA nachocheese 24.80.166.229 SHAW-COMMCA necroscop 24.36.207.144 CGOC-OAWH5CA paliandroid 64.230.24.153 NEX100704-CACA scooby 72.60.167.5 DOC-2-7-1-2-ETOB-2CA sod 24.36.129.106 CGOC-SACO3CA telostor 70.68.168.93 SHAW-COMMCA testamentpantera 65.38.64.204 GLOBALE-1CA tortorcan65 24.42.92.42 DOC-1-5-0-2-BLOOR-2CA turdburglar 69.156.56.175 SYMV0129-CACA vedant 65.49.223.229 DOC-4-8-0-0-MTNK-2

A-9

CA yoda 24.68.0.201 SHAW-COMMCA zenten 70.27.5.5 DOC-3-7-0-0-SLNT-2CA zz9plural9zalpha 70.82.218.182 VL-D-MU-4652DA00CHCH b17a21c8 80.74.144.159 METANETCH crayzzytor 83.228.142.189 VTX-ADSL-ACCESSCH fno42rd 217.14.64.70 BBI-WMCCH makemefree 80.242.195.68 GLATTNET-NETCH milkya64 84.72.104.77 CABLECOMMAIN-NETCH mjollnir 84.227.224.47 SUNRISE-ADSLCH *n37gu3r1lla 85.0.173.159 BLUEWINNETCH obrii 62.2.174.20 CABLECOMMAIN-NETCH tigerlaptop 85.218.24.143 SIMA-NET-1CNCN chenkeikari 222.212.61.48 CHINANET-SCCN dayqz 61.177.200.173 CHINANET-JSCN dee 221.5.239.212 CNCGROUP-CQCN deepin 221.5.239.161 CNCGROUP-CQCN *distro 61.242.102.18 UNICOMCN fgsinternet 211.94.188.225 CNNICCN flyingboy 166.111.249.39 TUNETCN glrum2970 222.94.8.209 CHINANET-JSCN hj 222.94.174.148 CHINANET-JSCN jlkjl 222.33.219.5 CRTCCN lebut 221.137.6.171 COLNETCN lori 60.63.126.72 COLNETCN mlogictor 218.58.83.164 CNCGROUP-SDCN monkey 58.33.130.199 CHINANET-SH-BBAD-190CN moonese 218.0.209.97 CHINANET-ZJ-HZCN oldwatch 218.242.93.172 COLNETCN prism 221.0.32.66 CNCGROUP-SDCN terminal2000 218.9.121.242 CNCGROUP-HL`CN welcometothejungle2 159.226.169.121 NCFCCN whocaresfreedom2 222.212.225.29 CHINANET-SCCN wysiwyg 222.28.80.131 BLCUB-CNCN yass 222.94.224.22 CHINANET-JSCN zen 218.20.159.95 CHINANET-GDCZCZ fitor1 147.251.52.140 MUNICZ iraq 81.0.225.179 HYPERREAL-CZCZ nikon2704 83.208.14.29 NEXTEL-XDSLCZ redemptor 213.220.233.15 UPC-BROADBAND-XIIIDEDE 1898 85.178.203.21 HANSENET-ADSLDE 1984jhb 84.58.249.136 ARCOR-DSL-NET13DE 23foobar42 80.143.147.175 DTAG-DIAL16DE 686e 80.190.241.118 IPX-Server-NETDE aaf9200ab4053a5d19c 88.217.34.146 DE-MNET-20051123DE ai48373 80.86.191.107 LNC-AIHS-NET-GMBH2DE amnesty 81.169.130.130 STRATO-RZG-DED

A-10

DE andromeda 82.149.72.85 IPX-SMK-NETWORKS-NET-DEDE anon579401375 84.61.54.237 ARCOR-DSL-NET13DE anonymousbalsercc 62.75.129.201 BALSER1DE anpnym 217.160.177.118 SCHLUND-CUSTOMERSDE antiterrorkrieg 85.214.29.61 DE-TECT-20050224DE b0red 80.190.250.83 IPX-Server-NETDE b9ivvwkf774ff2n7cvk 81.169.183.70 STRATO-RZG-DEDDE babylon5 217.172.187.46 SERVER4YOU-1DE baphomet 81.169.136.161 STRATO-RZG-DEDDE beershakes 213.239.202.232 HETZNER-RZ-NBG-NET2DE bellum 62.75.222.205 SERVER4YOU-1DE bembelgott 81.169.166.136 STRATO-RZG-DEDDE biafra 84.16.234.153 NETDIRECT-NETDE bigbadbertfw 84.154.193.106 DTAG-DIAL20DE bigwormhole 212.12.60.181 AGALTENBERGER-NETDE bitnatter 212.202.53.91 HOME-DYNAMIC-NETDE biz18 84.167.14.205 DTAG-DIAL20DE bmwanon 85.25.132.119 SERVER4YOU-1DE calypso 217.190.230.122 TEDE-UNIFIEDDE camperquake 212.51.10.6 ADDIX-CUST1-KIEL-NETDE carryitcrossthesea 84.60.99.253 ARCOR-DSL-NET13DE ccc2 85.214.59.14 DE-TECT-20050224DE cce12eb07e2d92a7 213.133.99.185 HETZNER-RZ-NBG-NETDE chaba 84.169.124.87 DTAG-DIAL20DE chaoscomputerclub 80.237.206.93 HE-DEDIC-CGN-206DE charon 195.158.168.91 HOME-DYNAMIC-NETDE chimaera 212.112.241.137 IPX-Server-NETDE chrism 217.160.135.169 SCHLUND-CUSTOMERSDE commodore64 137.226.59.249 ACHSESDE corelogics 217.20.118.156 NETDIRECT-NETDE cptnem0 194.97.49.42 ROESENER-NETDE cromacserver 81.169.171.90 STRATO-RZG-DEDDE cweiske 80.237.146.62 DDS-NETDE d2921 84.142.176.142 DTAG-DIAL20DE daedalus 84.157.147.155 DTAG-DIAL20DE dasflinkewiesel 217.187.159.113 DE-MEDIAWAYS-20010314DE dastorzurwelt 87.123.75.227 VT-DYNAMICPOOLDE datenhalde 212.112.235.83 IPX-Server-NETDE datentrampelpfad 81.169.177.134 STRATO-RZG-DEDDE deepquest 80.130.140.13 DTAG-DIAL16DE devilproxytor 213.39.155.121 HANSENETDE df37134371e64eb 62.158.45.235 DTAG-DIAL8DE diegedankensindfrei 85.177.235.33 HANSENET-ADSLDE dl3daz 217.160.167.28 SCHLUND-CUSTOMERSDE dogfy 212.114.250.252 NEFKOM-DSL2DE dreckskind 217.160.220.28 SCHLUND-CUSTOMERSDE dtick 217.20.117.240 NETDIRECT-NETDE einfallstor 212.112.241.159 IPX-Server-NETDE eingangstor 217.224.189.216 DTAG-DIAL15DE emzy 212.112.242.21 IPX-Server-NET

A-11

DE enterprise 193.201.52.136 FIRSTHOP-NETDE fastfashion 212.112.228.2 IPX-Server-NETDE feh 217.160.108.109 SCHLUND-CUSTOMERSDE fengor 81.169.176.178 STRATO-RZG-DEDDE foebud 85.31.186.86 ISPPRO-RZJ1-NETDE freedomandprivacy 62.75.184.254 VSERVER-1DE frell2 85.10.240.250 Lampe-NetDE fs2lsk220 217.189.246.169 DE-MEDIAWAYS-20010314DE fsd13d24bge 84.141.182.215 DTAG-DIAL20DE g3power 84.56.132.211 ARCOR-DSL-NET12DE georglutz 85.214.18.185 DE-TECT-20050224DE glouklack 85.31.187.90 ISPPRO-RZJ1-NETDE good2bking 84.146.144.89 DTAG-DIAL20DE gumba8786server 213.239.217.146 HETZNER-RZ-NBG-NETDE gwaihir 84.16.236.83 NETDIREKT-STAR-HOSTINGDE h5922 81.169.176.135 STRATO-RZG-DEDDE heaven 193.239.165.73 FKSIP-NETDE helios 212.202.202.39 HOME-DYNAMIC-NETDE hendi1 81.169.168.38 STRATO-RZG-DEDDE historserver 212.202.233.2 QSC-CUSTOMER-548140-280988DE hoppelgaloppel 84.61.155.3 ARCOR-DSL-NET14DE iapetus 134.130.58.205 ACHSEDE ididnoteditheconfig 89.54.109.214 STRATO-POOL-NETDE ihackforfood 131.220.141.131 UNI-BONNDE iku 212.88.142.147 IKU-NET1DE impersonator 84.56.184.214 ARCOR-DSL-NET12DE infodn 212.168.190.8 VIADE-DSL-NETDE itlnettor1 62.75.218.130 DE-INTERGENIA-20010727DE jap 141.76.46.90 TUDINF-LANDE jnz 85.31.187.84 ISPPRO-RZJ1-NETDE juchadcod8 213.239.212.133 HETZNER-RZ-NBG-NETDE karotte 88.198.253.18 DE-HETZNER-20051227DE keenmind 84.19.181.66 DE-KEYWEB-IIDE kiu112 62.75.241.48 VSERVER-1DE koehntopp2 85.214.44.126 DE-TECT-20050224DE kolrabi 217.160.95.117 SCHLUND-CUSTOMERSDE kozmix 85.10.195.106 HETZNER-RZ-NBG-NETDE krypton 212.37.39.59 HAMCOM-GMBHDE lanroamer 85.14.217.228 UNITEDCOLODE lincserv 62.224.62.226 DTAG-DIAL1DE lostpackets 81.169.180.180 STRATO-RZG-DEDDE lowhome01 62.75.162.252 VSERVER-1DE lunkwillstor 84.57.64.143 ARCOR-DSL-NET12DE lysander 85.14.216.20 UNITEDCOLODE maconion26 62.141.39.14 FASTIT-DE-DUS1-COLO1DE marvin 80.190.242.122 IPX-Server-NETDE maximatornew 212.112.242.159 IPX-Server-NETDE michik 84.16.235.143 NETDIRECT-NETDE morefreedom 212.202.78.170 HOME-DYNAMIC-NETDE morgentau 83.171.190.170 MNET-DSL

A-12

DE mxo 81.169.171.105 STRATO-RZG-DEDDE mysecretserv 213.202.217.164 UNITEDCOLODE mystiqx 217.84.1.6 DTAG-DIAL14DE nanobot 88.73.15.46 ARCOR-DSL-NET15DE narnia 85.119.156.72 INTERNETUNIVERSUM-VPS-NETDE nebulawikia 80.134.253.148 DTAG-DIAL16DE ned 80.190.251.24 IPX-Server-NETDE neskaya 81.169.181.10 STRATO-RZG-DEDDE netzhure 80.244.242.127 moritz-augsburger-de-netDE newtoruser 87.122.14.230 VT-DYNAMICPOOLDE nobodyeditedaconfig 85.10.194.117 HETZNER-RZ-NBG-NETDE nocabal 212.227.20.86 SCHLUND-CUSTOMERSDE noctednachos 131.246.89.15 RHRK-LANDE nt 84.165.162.55 DTAG-DIAL20DE oas1 213.200.90.122 OLE-TINETDE ohnetoreinthor 84.160.124.51 DTAG-DIAL20DE ouagadougou 213.239.212.45 HETZNER-RZ-NBG-NETDE partytool 84.145.172.206 DTAG-DIAL20DE pax 217.172.183.219 SERVER4YOU-1DE pegasus 137.226.181.149 ACHSESDE peterp1701 212.227.108.114 SCHLUND-CUSTOMERSDE prescher 85.16.0.4 EWETEL-DYNDSL-POOL6DE pw 88.84.139.250 IXEUROPE-1BLU-2DE quousquetandem 85.178.70.48 HANSENET-ADSLDE r4g3 80.130.228.153 DTAG-DIAL16DE rainbow 80.243.60.137 DE-ENVIA-TEL-20011029DE raptor2 85.14.220.126 UNITEDCOLODE ratte 212.202.193.62 HOME-DYNAMIC-NETDE ravenslaptop 84.184.119.159 DTAG-DIAL20DE redgene 85.31.186.61 ISPPRO-RZJ1-NETDE reversed 217.172.49.89 GIGAHOSTING-NETDE rootkit 213.203.214.130 DE-CEITSYSTEMSDE roundabout 81.169.178.215 STRATO-RZG-DEDDE s02 84.16.233.47 NETDIRECT-NETDE sanders 217.172.50.130 GIGAHOSTING-NETDE saturn 85.214.49.175 DE-TECT-20050224DE schmaller 217.80.83.203 DTAG-DIAL14DE schnarpf2nd 195.37.132.28 IN-FRANKEN-IIIDE sechole 85.14.220.165 UNITEDCOLODE seniorix 62.141.42.179 FASTIT-DE-DUS1-COLO1DE serverbox 213.39.128.232 HANSENETDE sharktooth 213.239.194.175 HETZNER-RZ-NBG-NET2DE sic4gh 84.172.106.156 DTAG-DIAL20DE sikamikanico 82.82.69.203 ARCOR-DSL-NET2DE siliconverl 195.71.99.214 MWAYS-HEADQUARTERDE snoopy 80.143.156.153 DTAG-DIAL16DE so19charsismax 85.214.29.9 DE-TECT-20050224DE somebody 80.135.50.29 DTAG-DIAL16DE sparced 217.160.170.132 SCHLUND-CUSTOMERSDE squirrel 213.146.114.96 KAMP-DSL-NET

A-13

DE stasiserver 81.169.174.124 STRATO-RZG-DEDDE stnv 84.16.236.173 NETDIREKT-STAR-HOSTINGDE stop1984 141.76.7.58 TUDINF-LANDE stop1984now 88.73.74.148 ARCOR-DSL-NET15DE surfingsamurai 212.112.231.99 IPX-Server-NETDE theeternalpowerami 217.160.219.14 SCHLUND-CUSTOMERSDE tilde0ne 84.58.9.222 ARCOR-DSL-NET13DE tokra 80.139.152.94 DTAG-DIAL16DE tomaslander 89.49.169.65 FREENET-POOL-NETDE toratcdtmde 129.187.150.131 LRZ-MUNICH-NETDE torpaulianer 89.110.144.180 NCL-NETDE torproxyblnger2 85.178.86.28 HANSENET-ADSLDE tortortor 84.19.187.11 DE-KEYWEB-IIDE torwart 217.160.134.33 SCHLUND-CUSTOMERSDE torxunixguxru 85.31.186.26 ISPPRO-RZJ1-NETDE trooper 84.152.125.104 DTAG-DIAL20DE tunnelreality 84.169.105.217 DTAG-DIAL20DE turing2006 217.84.162.106 DTAG-DIAL14DE universi8d3c39 141.35.122.98 UNI-JENANETDE unterwachung 213.239.212.206 HETZNER-RZ-NBG-NETDE vidalia 84.60.132.2 ARCOR-DSL-NET13DE visnator 85.10.226.188 DE-HETZNER-20050223DE waabbeel 85.25.141.60 SERVER4YOU-1DE waerternet 217.160.109.40 SCHLUND-CUSTOMERSDE wannabe 195.137.213.113 MBBG-NETDE wirsindhaftbar 80.190.243.158 IPX-Server-NETDE wlmxwalnueb6s6z5gyw 88.84.130.170 IXEUROPE-1BLU-2DE wor 85.182.31.75 HANSENET-ADSLDE workshop2 134.169.164.172 TU-BSDE wormhole 84.19.182.23 DE-KEYWEB-IIDE wuschelpuschel 212.112.235.78 IPX-Server-NETDE xsteadfastx 85.25.66.203 NETFABRIKDE yaap 62.75.185.15 VSERVER-1DE yetanothertorserver 193.201.54.32 FIRSTHOP-NETDE zbvis 80.145.153.46 DTAG-DIAL16DE ztor2 81.169.158.102 STRATO-RZG-DEDDE ztor3 217.160.203.26 SCHLUND-CUSTOMERSDE zwiebelfissh 217.160.176.49 SCHLUND-CUSTOMERSDKDK notexitnodedenmark 62.243.85.164 KABELTVDK protofaust 193.88.185.116 TDC-HOSTINGDK raz0r 212.10.91.141 STOFANET-9EEEE borism 82.131.5.34 EE-STARMAN-CLIENTSEE kuratkull 212.7.12.43 INFONET-CABLE-MODEM-POOL3-ESES ddfdfdf 83.39.161.116 RIMAES hazel 85.57.129.159 UNI2-NETES torero 84.77.48.196 YACOMNETFI

A-14

FI anonrouter 88.112.63.167 ELISA-ADSLFI beaver 80.223.105.208 SONERA-PLAZA-NETFI djhasis 80.222.227.120 SONERA-PLAZA-NETFI erkkimatix 82.141.91.230 PPO-ADSL7FI esko 80.186.67.109 ELISA-ADSLFI huoneisto 62.183.213.178 LANNENPUHELIN-NETFI jyketorserver42 85.76.189.225 SCIFI-DYNAMIC-ADSLFI luthien 193.184.9.66 MediaosakeyhtioFranticFI middleguy 84.249.213.94 SONERA-FINLAND-BBNETFI nemeinfigw 84.34.133.217 TMVVISION-NETFI paraziteorg 88.113.36.247 FI-ELISA-20050824FI randomghost 212.246.66.120 FI-ELISA-980508FI salottisipuli 88.112.243.180 ELISA-ADSLFI sivusto9022 80.222.75.74 SONERA-PLAZA-NETFI spongebob 62.241.240.86 LOHJANPUHELIN-6FI vapaus2006 217.119.47.6 SUOMICOM-CUST-29FI xtl 82.128.209.49 OPOY-NET18FRFR bartfa24279fa4 81.251.26.110 IP2000-ADSL-BASFR caboulot 82.244.152.77 FR-PROXAD-ADSLFR casa 82.230.146.52 FR-PROXAD-ADSLFR chaorules 82.238.188.44 FR-PROXAD-ADSLFR charliebrown583 213.41.242.132 FR-NERIM-20020705FR eyilobdabifu 81.56.123.123 FR-PROXAD-ADSLFR frenchserver 88.136.16.177 CEGETEL-INTERNET-RESIDENTIFR ghuiol 82.66.155.32 FR-PROXAD-ADSLFR golfleme 82.67.37.163 FR-PROXAD-ADSLFR herminio 82.233.182.73 FR-PROXAD-ADSLFR hydre 82.225.251.113 FR-PROXAD-ADSLFR idontwantanickname 82.227.67.108 FR-PROXAD-ADSLFR irulanshands 81.56.27.175 FR-PROXAD-ADSLFR jiji 82.216.189.240 NUMERICABLEFR kuanckik5 86.214.220.139 IP2000-ADSL-BASFR latortue 82.231.59.44 FR-PROXAD-ADSLFR marouen 82.235.154.172 FR-PROXAD-ADSLFR natmakaone 82.235.7.49 FR-PROXAD-ADSLFR rumsfeldd 62.212.121.77 NERIM-ADSL-LDCOM-20020611FR sbs23 82.238.225.133 FR-PROXAD-ADSLFR titmerde 82.225.238.47 FR-PROXAD-ADSLFR tortest 82.233.97.149 FR-PROXAD-ADSLFR ubuntor 81.57.158.21 FR-PROXAD-ADSLFR user 82.254.177.202 FR-PROXAD-ADSLGBGB atl4ntysserver 86.14.146.162 NTLGB buzzcoil 85.234.130.43 PH-NETWORK-LON1GB colds7ream 86.128.217.112 BT-CENTRAL-PLUSGB computer 84.13.43.183 OPAL-DSLGB conchis 84.9.189.25 BULLDOG-BSHGB crackedactor 83.245.82.184 Euro1net-Net1GB dementia 81.5.172.97 UK-ECLIPSE-ADSL-STATIC

A-15

GB doormouse 62.197.40.155 LNC-TH-NETGB ephemer 128.232.110.15 CL-CAM-AC-UKGB gizmoguy 217.155.230.230 ZEN000007354GB k 85.8.136.101 NET-SERVELOCITYGB lancsdesk 148.88.224.185 LANCSGB miller 193.110.91.7 YOYO-NETWORKSGB mrslippery 81.159.48.153 BT-CENTRAL-PLUSGB myacer 62.17.252.166 MCIEIRE01GB penfold 195.137.53.121 FREEDOM2SURFGB peregrinedontmooo 217.147.80.73 BLACKCAT-ADSLGB pod159 80.87.131.159 POSITIVE-DOLPHINGB prezebs 62.121.31.116 KEME-ADSLGB prospero 83.223.108.108 G-CUST-GS02-2GB quaker5567 87.80.96.52 EASYNET-UKONLINE-DSLGB scyphtor 84.9.61.90 BulldogGB sphere 213.228.241.143 PKXG-prodigy0GB torserver8tlsk41 82.24.161.140 NTLGB xtor123 82.109.81.98 MSMGB xx 85.210.1.124 PIPEX-DSL-DYNAMICGB z0rb 86.139.184.75 BT-CENTRAL-PLUSGRGR masquerade 155.207.113.227 AUTH-NETGR patra 150.140.191.108 PATRASNETGR trap1 83.235.253.243 OTENETHKHK main 219.79.53.165 NETVIGATORHK nouser 218.189.210.17 HGCHK usethespork 147.8.224.157 HKUNETHK yt1n1rt 203.218.152.187 NETVIGATORHRHR apollo 195.245.255.11 OGLASNIKHUHU 0verture 212.24.170.230 PANTELHU hutorfun 213.253.212.106 FofotoHU naamtor 85.90.166.105 HU-OPTICON-20041110HU spongyola 193.202.88.3 CYBERSYSTEMS-NETISIS klaatubaradanikto 193.4.140.225 IS-SIBERIAITIT alessgio 87.14.103.209 TELECOM-ADSL-7IT alverman 62.123.118.97 ACEATELEFONICAIT arigatto 212.239.118.83 RATTIADSL-NETIT bananajoe 84.220.97.65 TISCALINETIT bestkevin 84.221.92.15 TISCALINETIT enemy 82.56.40.135 TELECOM-ADSL-6IT gege 82.56.187.78 TELECOM-ADSL-6IT magisystem 84.221.197.63 TISCALINETIT miminu 88.149.167.126 NGI-INFR1IT molly 151.8.40.35 INFOSTRADA-CUSTOMERS-15184IT nemesis0101 82.56.18.53 TELECOM-ADSL-6

A-16

IT newnew 151.38.93.96 IUNET-BNET38IT obabakoak 194.21.56.6 GOLDNETIT papinet 80.180.110.110 TELECOM-ADSLIT t3xwi113r 151.38.231.174 IUNET-BNET38IT tetra4 159.149.57.14 UNIMINETIT torbis 83.184.179.221 IT-TELE2-NET2IT torserveritalyninf 88.39.72.170 INTERBUSINESSIT tortuga 62.48.34.110 FLUG-NETIT ulisse 83.184.189.34 IT-TELE2-NET2IT unixum 84.221.65.117 TISCALINETIT xbox 84.221.204.193 TISCALINETJPJP ddog 59.134.15.153 KDDI-NETJP monkeymagic 60.36.181.86 THEPPNJP nfgtor 219.121.56.122 ASAHI-NETJP pingi 219.196.60.124 BBTECHJP plagw 60.42.135.249 PLALAJP torjapan 219.105.111.74 ADACHI-NETLVLV 4.52387E+1383.243.88.133 TelenetLV clickety 62.63.190.100 TERABITS-TELIALVLV vic 86.63.172.156 LV-CITYNET-20050628MYMY gnikraf 60.48.185.41 XDSLSTREAMYXNLNL 1 81.207.29.49 NL-PMG-ADSLNL aprogas 130.89.160.179 UTNETNL arighttospeak 213.84.192.84 XS4ALLNL arighttosurf 213.84.192.84 XS4ALLNL ben 84.41.143.100 SPEEDLINQ08NL bigwillem 82.173.155.16 VERSATEL-CONSUMER-2NL bloemkool 83.85.60.134 NL-CASEMA-20031128NL ced 83.217.93.246 BE-REALROOT-20040305NL dib0 217.19.27.52 NL-CAMBRIUMNL digitalbrains 82.92.225.162 XS4ALLNL dizum 194.109.206.212 NL-XS4ALL-960513NL expander 212.129.150.55 EURONET-ADSL-2NL exquisite 80.56.97.172 NL-CHELLO-20000509NL fioyaz3iuthaihiera 131.155.71.110 TUENET1NL flubber 83.160.255.58 NL-DEMON-20040303NL flyingdutchman 82.156.33.125 WANADOO-CABLENL freedom 62.216.16.183 XS4ALLNL gompie 62.163.136.55 AMSTERDAM-CUSTOMER-CABLENL gvg1 130.161.165.129 DUNETNL gvg2 194.109.161.161 XS4ALLNL isis 80.126.234.27 XS4ALLNL lbeew 213.84.94.72 XS4ALLNL leviathan 83.149.97.103 LEASEWEBNL miabonkers 212.187.48.185 LELYSTAD-CUSTOMER-CABLENL morgana 213.84.43.3 XS4ALL

A-17

NL nggrplz 194.109.109.109 amazeNL nightspear 193.16.154.187 NL-ZYLONNL outerspace 131.155.141.98 TUENET1NL pristor 80.57.244.213 ZUTPHEN-CUSTOMER-CABLENL rascalio 145.99.247.70 SURFSNEL-ADSLNL rhw47 212.64.16.77 WANADOO-CABLE-DTNL sabotage 195.85.225.145 COLOCLUENL sec 192.42.113.248 SURFmirrorNL streamtime 195.169.149.213 WAAGNL swampserver 80.127.66.162 XS4ALLNL tawny 80.126.44.214 XS4ALLNL tonga 82.94.251.206 colonah6NL tornyet 137.120.180.65 MAASNETNL toronaise 137.120.180.50 MAASNETNONO ai 85.165.49.148 NO-TELENOR-DSL-3NO anemonenemorosa 84.48.64.142 NEXTGENTEL-NONO rain 129.177.234.39 BERGEN-NETNO slottet 80.203.211.14 BJORG-METTE-H-ANTONSEN-NO-NO torzone2 128.39.141.245 NTANETPEPE cebolla43 200.121.55.151 200.121.55.151PLPL bolanda 193.219.28.245 ICM-PLPL gotodengo 83.28.60.37 NEOSTRADA-ADSLPL kriss 217.153.252.4 MMJ-SIEMIANOWICE-PLPL pingwin 83.24.18.77 NEOSTRADA-ADSLPL q23bderty 195.140.155.18 KOPNET-NET-PLPL xau 82.146.244.99 PL-BYDMAN-20030627PL zazul 81.190.214.42 MULTIMEDIA-POLSKA-8RORO dfdfasf 86.124.64.168 RO-RDSNET-IS-IASI-CABLELINRO elvis 86.127.228.193 RO-RDS-20050316RO mikemckenzie 88.158.182.193 RO-EVONETRO wiseowl 82.76.242.24 RDSNET-82-76-242RURU neverland 85.15.185.38 TTKNET-COMINTEL-NETSESE 3ieom3roqk7qlx 80.252.209.6 BEARNETSE boliviakopimi 83.226.210.104 BB-BISP-STO2-SESE carcass 85.8.4.206 SE-WASADATA-LKP1SE che 81.226.218.204 TELIANETSE clomp 87.251.197.210 WEBTECHNORD-HELSINGBORG-NESE dfghbfght545 87.96.132.191 SE-BLIXTVIK-1SE earthbound 85.227.10.132 SE-CYBER-20041217SE elora 84.217.70.153 GLOCALNET-SE-NETSE eripax 83.227.72.118 BB-BISP-DSL11-STO46-SESE forantipiratbyran 85.230.154.105 SE-CYBER-20041217SE gnutten 213.113.166.243 B2-CUSTOMERSSE gogoli 217.208.47.127 TELIANET

A-18

SE helmetedwarrior 194.47.250.233 LUNETSE ichbineinberliner 213.114.177.149 BB-BISP-STO21-SESE landoonmillenium 84.119.119.199 AT-TELEKABEL-20040407SE leeloo 85.226.135.224 BB-BISP-dsl10-skv10-jkp1SE liveshere 213.114.238.177 BB-BISP-STO5-SESE lurchtor 82.214.2.226 SE-TRANSIT-KABELTVSE maewdsa 83.233.97.253 BREDBAND2-NET-SESE manetherendrelle 83.219.212.101 UMEA-BRF_NORNAN-NETSE mbop 85.225.169.74 BB-BISP-dsl11-hbg10SE mrjones 194.47.215.94 LUNETSE rzn 213.113.27.79 B2-CUSTOMERSSE scheelov 81.216.128.130 AH-WHOLESALESE serenity 82.182.109.115 SCREAM-BOSTREAM-NETSE stordatorn 85.226.129.119 BB-BISP-dsl10-skv10-jkp1SE t9viej3fba73fe1 83.233.34.183 BREDBAND2-NET-SESE tele3 217.28.206.143 SE-TRIPNETSE tomandandy 81.229.66.237 TELIANETSE torebror 81.227.234.84 TELIANETSE torlla 213.199.120.94 SKEKRAFT-NETSE tux 213.114.29.49 BB-BISP-LKP1-SESE viking 81.216.158.19 AH-WHOLESALESE zatla 62.20.240.76 TELIANETSGSG qltor 202.166.24.240 MAGIXSG toranonx 219.74.197.116 SINGNET-SGSISI alpha007org 84.255.254.174 SI-T-2SKSK jhohnbalance 195.72.0.6 EWSK-DIAL-BB-1THTH bxddavidnetthailand 124.121.173.236 ASIAINFONETTH censorbustor 124.120.242.178 ASIAINFONETTH pen2 125.24.68.94 TOTNET-APTH proview 202.149.122.98 WJG-THTH somjuk 202.29.6.56 THAINET-THUSUS 44thprecinct 72.225.234.118 RRNYUS 79c14cccec 66.24.227.242 ROADRUNNER-NYSUS 8xspeed 65.25.218.34 ROADRUNNER-CENTRALUS a2b90e6b35564bd991 68.227.90.101 NETBLK-OM-CBS-68-227-88-0US aala 149.9.0.25 PSINET-B-9US ajjaxsafe 69.162.42.169 69-162-0-0-Z8US ally2006 66.235.26.171 JEFFCO-MILLENNIUM-DIGITAL-US anarchy 207.210.85.116 GNAXNETUS anduin 209.51.169.86 HURRICANE-DC0206-5A1US anonettorserver 70.187.87.248 NETBLK-AT-RDC-70-187-80-0US anonisgood 70.92.178.34 RRWEUS anonnntpandim2 66.234.69.158 INJU-2BLKUS anselcomputers 24.170.55.120 ROAD-RUNNER-5US anselmi 154.35.101.77 PSINET-B2-35

A-19

US arg0 64.246.50.101 EVRY-BLK-9US asano 68.35.123.187 ALBUQUERQUE-1US atticusf1nch 68.167.210.203 NETBLK-COVAD-IP-4-NETUS banana 72.21.33.202 LAYERED-TECHUS bananaphone 68.49.1.86 DC-3US beehive 72.36.146.118 LAYERED-TECH-US bender 207.150.167.67 SAGO-207-150-167-60US bhmidc2 68.41.182.107 MICHIGAN-2US binarymixer 71.133.227.217 SBC07113322721629050729023US bitcircle 216.55.190.201 ABAC1999AUS blackstripe 67.180.83.36 BAYAREA-16US blorchmonster 68.40.192.5 MICHIGAN-2US blueneedle 12.222.100.156 INSIGHT-12-222-96-0-NOBLESUS botswananpula 24.206.212.55 BUCKHANNON-CEBRIDGE-CONNECUS bubbajoeblow 216.39.146.25 SENSEUS buddhawouldbeproud 64.142.74.86 SONIC-BLK-3US bulldozer2003 67.162.109.41 ILLINOIS-1US bushytail 24.21.201.102 OREGON-7US caedescontego 70.134.225.109 SBC07013422400023051028140US caethaver2 69.113.27.92 OOL-CPE-ISLPNY-69-113-16-0US capacitor 68.113.150.180 MDS-WI-68-113-144US capiastor 63.85.194.6 UU-63-85-194US cau 216.130.255.201 VIS-64-BLK1US ceftorrd00 146.201.211.64 FSUFDDIUS cgull 24.18.9.231 WASHINGTON-9US chaoticsilence 67.15.128.17 EVRY-BLK-15US cherubim 18.78.1.92 MITUS chimera 67.190.100.183 COLORADO-18US china3 129.186.194.102 CYCLONENETUS chromakey 70.84.114.153 NETBLK-THEPLANET-BLK-13US chunkysoup 208.40.218.144 APPSCOMM-NET1US cipheralgo 64.122.12.107 INT-BLK-1US clanspum 82.165.180.112 SCHLUND-CUSTOMERSUS clarity 65.196.226.32 UU-65-196-224-D1US clearbluetormonster 71.246.25.54 VIS-BLOCKUS codegnometor1 71.83.118.3 REN-NE-71-83-112US comeuppance 69.230.52.16 SBC06923004800020050107123US cqas02 129.21.228.86 RITUS crenshaw 70.110.70.238 FTTPUS crimsondestroyer 69.139.100.168 E-TENNESSEE-4US cyberdynelabs 68.207.136.55 RR-SOUTHEAST-BLK3US d8cf6t 66.92.188.226 SPEK-SFO-BR-46US d9p0ph71 69.136.16.247 NAPLES-12US dao 216.12.165.46 MERKATO-POWERED-NETWORKUS darkelf109 68.98.18.98 PH-RDC-68-98-0-0US darkridge 64.90.164.74 NYIC-1BLKUS datadotcdu 82.165.253.73 SCHLUND-CUSTOMERSUS dedication 208.99.207.139 FORONA-TECHNOLOGIES-LLCUS default 12.76.173.57 ATTSVC-12-76-0-0US deststorserver 68.192.208.164 OOL-CPE-RNDHNJ-68-192-208-

A-20

US digitalrhapsody1 204.15.133.171 NDCNETWORK-02US digitalrhapsody2 64.5.53.220 NETBLK-THEPLANET-BLK-5US dmux01 71.117.235.93 VIS-71-96US donk3ypunch 149.9.25.222 PSINET-B-9US doppelganger 64.175.67.76 SBC06417506600023060423215US dragon 72.177.87.57 RRSWUS echelonalpha 71.117.236.5 VIS-71-96US elysian 68.4.226.53 OC-RDC-68-4-0-0US elysium 68.5.114.127 OC-RDC-68-4-0-0US epoch 72.226.235.186 RRNYUS ericspeaks 66.219.161.166 DTC-COM-CCIFALLSUS erictor 71.112.165.46 VIS-71-96US err 128.2.141.33 CMU-NETUS extrapolator 207.210.101.242 GNAXNETUS factormachine 24.238.57.137 PENTEL-CABLEUS fartknocker 64.95.64.86 PNAP-BSN-ARDENN-DC-01US fcmc 216.105.150.8 ACSINC-BLK-1US fern 64.5.53.76 NETBLK-THEPLANET-BLK-5US findthecup 216.237.143.47 XOXO-BLK-19US floydian 68.57.216.138 INDIANAPOLIS-2US fluffycrypto 70.132.32.156 SBC07013203200019051025142US freedaemontor 66.210.104.251 NETBLK-OK-OHFC-66-210-104-US freedomvoice 63.149.255.18 Q0113-63-149-255-0US froggy 24.255.8.175 NETBLK-PH-RDC-24-255-0-0US fry 192.83.249.30 BUNGIUS ftsiiwew90 66.93.134.53 SPEK-SFO-BR-7US furrywannabe 71.210.181.168 QWEST-INET-118US gameover 24.8.67.2 COLORADO-10US gamma 216.55.149.21 ABAC1999AUS gentoopenguins 72.9.242.90 GNAXNETUS gewegsg 169.237.136.170 UCDAVIS2US ghettocluster 70.92.81.85 RRWEUS ghewgill 69.41.174.196 800-NET1US ghotiwork 12.44.215.27 ACCESS2G19-215-0US ginsberg 65.28.30.197 RR-CENTRAL-2BLKUS gnunet 131.179.224.133 UCLA-CSUS gojimmers 144.126.75.68 LOYOLA-IN-MDUS gold 24.118.78.189 MINNESOTA-1US goldensun 69.200.81.164 RRNYUS gondwanaland 64.5.53.33 NETBLK-THEPLANET-BLK-5US goocononion1 74.129.166.67 INSIGHT-COMMUNCATIONS-CORPUS gotclue 216.32.80.75 NET-216-32-64-0US graze 71.116.80.146 VIS-71-96US greybeard95a 66.93.170.242 SPEK-333585-0US gtisc 199.77.130.14 LVLT-ORG-199-75US gusgate 67.40.233.130 QWEST-INET-116US hackshaven 64.81.100.208 SPEK-DSL-BR22-0US hamaphry1 68.116.85.27 TRLK-CA-68-116-80US hamcavetor 66.92.13.212 SPEK-DSL-SFO-BR4-0US hanselwilson 71.112.223.105 VIS-71-96

A-21

US hbro 12.210.240.109 ATTUS hcpnet 65.174.217.58 FON-110197790494889US heilong 67.174.220.150 BAYAREA-15US heimdal 74.67.47.248 RRNYUS hellohellomoomoo 71.250.215.8 VIS-BLOCKUS hgabertgoldmine 166.70.232.84 XMISSION-166-70-0-0US hiball 160.36.137.37 MED-NETUS hologramtw 24.47.23.103 OOL-CPE-STJMNY-24-47-16-0-US holyfreakingcrap 208.14.31.5 FON-349058457672565US hpeterstorserver 24.111.174.178 MIDCOUS httpdnet 66.90.89.162 FDCSERVERSUS hubbahubbahubba 154.35.47.59 PSINET-B2-35US icarus 69.134.216.49 RRMAUS ice 66.119.199.39 GCNETBLK-TERRA1US idealworld 68.236.70.84 VZ-DLWRLD-1US ididediconfigtphhhh 68.202.36.79 RR-SOUTHEAST-BLK3US ieditedtheconfig 66.75.35.155 RR-WEST-2BLKUS illithid 208.40.218.131 APPSCOMM-NET1US illithid2 208.40.218.136 APPSCOMM-NET1US inap1 64.74.207.50 PNAP-SEA-BLOCK4US intarweb 70.232.81.31 SBC07023208000020051116153US inthekeyofv 70.246.78.213 SBC07024607800023050404194US iris 138.202.192.210 USFCAUS irishcitizensarmy 68.199.62.178 OOL-CPE-NYX2NY-68-199-56-0US irithimus 64.132.239.129 TWTC-COI-01US janus3 66.70.10.53 DATAPIPE-BLK3US jizbomb 141.149.128.197 VIS-141-149US jms1 209.114.200.129 FIBERPLUSUS joeysa64 69.110.57.243 SBC069110048000040218US joiseytor 154.35.85.17 PSINET-B2-35US juniormint 72.228.245.16 RRNYUS knauerhase 24.22.8.74 OREGON-9US krumpet 66.96.192.44 NOCUS kumbaya 24.11.233.143 SOUTHBEND-2US landrover 70.85.75.42 NETBLK-THEPLANET-BLK-13US lantana 68.166.0.140 NETBLK-COVAD-IP-4-NETUS leela 66.111.43.137 SAGO-66-111-43-130US lefkada 140.247.60.64 HARVARD-COLLUS lehighnet 66.197.193.212 HOSTNOC-2BLKUS lemongrass 71.129.180.29 SBC07112918000022050503214US lillemy 66.199.240.50 NETBLK-EZZIUS linuxonthebrain 216.137.65.86 AVALON-NETWORKSUS livefreeordie 68.96.178.10 LV-RDC-68-96-160-0US loosemoose 206.174.19.25 GCI-ALASKA-5BLKUS lostinthenoise 64.142.98.231 SONIC-BLK-3US m 69.163.32.140 69-193-32-0-Z3US m00kie 154.35.36.18 PSINET-B2-35US manning18 68.167.210.195 NETBLK-COVAD-IP-4-NETUS markoer 64.90.191.94 NYIC-1BLKUS martinscorsese 71.32.251.76 QWEST-INET-119

A-22

US mauger 149.9.137.153 PSINET-B-9US mc242 208.66.194.14 MCCOLOUS mercury 24.91.169.157 BOSTON-7US merlin 66.90.118.68 FDCSERVERSUS midator 24.9.185.227 COLORADO-10US middleman 68.40.171.66 MICHIGAN-2US minotor 71.242.124.82 VIS-BLOCKUS mmitor 70.248.104.35 SBC07024810400022050102144US moria1 18.244.0.188 MITUS moria2 18.244.0.114 MITUS mp94564 24.7.86.165 BAYAREA-11US mtrojnar 64.62.190.126 HURRICANE-CE1301-9087US multicstor 67.101.197.199 NETBLK-COVAD-IP-4-NETUS mushin 18.152.2.242 MITUS myrandomnode 72.165.204.124 Q0209-72-165-204-0US nao 70.152.40.47 BELLSNET-BLK15US nbx 64.142.31.83 SONIC-BLK-3US neurohydra 216.254.70.208 SPEK-NYC-BR-103US neuropunks 38.117.144.218 COGENT-NB-0002US neworleansla 70.156.122.109 BELLSNET-BLK15US newtorserverofmine 24.148.3.176 RCN-BLK-25US nicj 64.34.180.99 PEER1-SERVERBEACH-02US nickname 24.196.173.135 ASHE-NC-24-196-160US nopants 70.179.174.128 NETBLK-MA-RDC-70-179-128-0US nowhereman 209.221.206.114 QNET-0US nurotek 66.52.66.26 PWT-SKTN-3817US nycbug 64.90.179.108 NYIC-1BLKUS olden 64.81.246.230 SPEK-DSL-SFO-BR3-0US omgprivacy 68.94.13.72 SBC068094000000040102US omgroflstfuthx 68.68.234.218 68682240-Z7US omgwtf 64.81.240.144 SPEK-DSL-SFO-BR3-0US onionkicksass 69.60.120.99 INMM-69-60-114-0US optimum 69.123.5.158 OOL-CPE-LYBRNY-69-123-0-0-US p4killa 67.162.80.138 ILLINOIS-1US palisade 24.7.38.138 BAYAREA-11US pansqopticon 68.174.141.133 ROADRUNNER-NYC-4US pappymcnasty 12.44.215.69 ACCESS2G19-215-0US paradox985 24.12.139.78 ILLINOIS-14US paulz 24.34.185.135 BOSTON-5US paxprivoso 149.9.205.73 PSINET-B-9US phobos 66.228.127.27 SOFTLAYER-NETBLOCK2US phoboslabs 71.245.238.31 VIS-BLOCKUS phuzzie 64.142.78.232 SONIC-BLK-3US pianarchist 67.20.56.66 6720320-Z5US pizon 72.20.1.166 STAMINUS-COMMUNICATIONSUS planck 68.167.210.150 NETBLK-COVAD-IP-4-NETUS pleasant 66.92.65.81 SPEK-DSL-BOS-BR0-0US pmw 209.223.236.238 SAVV-T31436-3US poptex 154.35.55.129 PSINET-B2-35US privacyecosystem1 66.98.136.49 EVRY-BLK-14

A-23

US privacyecosystem2 66.98.208.43 EVRY-BLK-14US privacyecosystem3 67.15.225.36 EVRY-BLK-15US privbox 68.196.204.6 OOL-CPE-PRNYNJ-68-196-192-US pup 67.173.143.46 ILLINOIS-11US qnetanonproxy 209.221.193.39 QNET-0US qumquat 154.35.217.62 PSINET-B2-35US randombox 24.10.127.243 SACRAMENTO-9US readmorebooks 71.56.119.250 ATLANTA-13US *redemmas 66.93.119.120 SPEK-BLT-BR-4US richhomednsorg 151.197.195.212 VZ-DSLDIAL-PHLAPA-3US rndmodmdmtornnode 69.62.156.11 SUREWEST-BROADBANDUS robomasked 69.165.250.121 69-165-128-0-Z10US rodos 140.247.62.64 HARVARD-COLLUS s3rv3runkn0wn 71.229.90.176 MICHIGAN-G-8US sacredkowz 68.167.210.88 NETBLK-COVAD-IP-4-NETUS sasquatch 207.44.180.3 EVRY-BLK-11US schtichenit2damon 66.92.35.222 SPEK-DSL-LAX-BR4-0US sdpeaecpe 68.94.196.229 SBC068094192000040115US secretagenda 24.30.67.89 ATLANTA-3US serifos 140.247.62.119 HARVARD-COLLUS server334 70.162.75.105 NETBLK-PH-RDC-70-162-0-0US seventreasures 68.171.58.114 68171320-Z7US shadowroot 69.249.105.136 PA-28US shamborfosi 68.20.22.44 SBC068020016000020514US shiggidy 24.99.140.249 ATLANTA-5US silenticey2 71.98.9.231 VIS-71-96US sipbtor 18.187.1.68 MITUS sisyiphustwo 74.237.5.229 BELLSNET-BLK18US sniper 66.32.101.55 EARTHLINKDSL-2BLKUS soprano1 154.35.72.223 PSINET-B2-35US sosayweall 24.21.11.160 OREGON-7US spanktacular 70.127.121.248 RRSWUS sparky 69.12.145.165 SONICUS spoon 128.30.28.19 MIT-NETUS spslosalamitos 67.49.101.49 RRWEUS starling 69.51.152.43 JASNET-ONEUS stinky 69.31.42.139 NLYR-69-31-40-0-1US stugsdotcom 216.9.82.85 PINN-216US subsurfaces 68.13.104.181 OMRDC-68-13-0-0US t800 216.67.26.114 ACSG-1-NET-1US talentperrine 208.40.218.151 APPSCOMM-NET1US tapthisassholes 71.245.102.3 VIS-BLOCKUS tditor0 64.146.134.221 NOANET-SBLK2-SAWNET1US techfinesse 64.135.207.45 FVI-NETUS tekgnome 70.39.193.13 70-39-0-0-Z7US teleri 216.32.89.2 NET-216-32-64-0US tenacity 154.35.1.8 PSINET-B2-35US thearistocrats 206.124.149.146 BLARG-BLKUS thebigcheeseofall 209.181.56.100 QWEST-INET-112US thegreatsantini 149.9.92.194 PSINET-B-9

A-24

US thehackerfoundation 64.142.22.13 SONIC-BLK-3US themightytor 70.176.93.179 NETBLK-PH-RDC-70-176-0-0US theprocess 82.165.144.169 SCHLUND-CUSTOMERSUS theseed 24.250.192.233 NETBLK-AT-RDC-24-250-192-0US thisisnotajoke 72.40.156.54 ERLK-TW-CENTRALFL02US thruvu 209.172.52.78 IWEB-HD-T838CL-1US thundergododin 63.211.169.142 LEVEL4-CIDRUS ticktockclock 69.212.31.172 SBC069212030000040224US tonealdon 70.245.211.184 SBC07024521000023050307192US tor4781671 216.231.168.178 MEBTEL-BLK-7US toratgmcto 70.84.253.4 NETBLK-THEPLANET-BLK-13US torhbg 69.242.85.10 PA-METRO-27US tornsd 24.94.2.121 ROAD-RUNNER-3-AUS torrific 71.126.187.88 VIS-71-96US torrigauci 5.20.197.41 RESERVED-5US torro50 68.107.40.142 COX-ATLANTA-2US torserver123 169.232.102.54 UCLANET4US torsvartvittorg 64.5.53.254 NETBLK-THEPLANET-BLK-5US torture 209.237.225.244 NET-BLK-TOADHALLUS toruser2867562 71.56.235.157 COLORADO-16US transistor 24.183.45.221 MDS-WI-24-183-32US troglomatix 72.3.249.87 RSCP-NET-4US trustnone 209.67.209.196 CW-209-67-208US twosixsix 74.0.33.114 NETBLK-COVAD-IP-6-NETUS ultraviolet 75.5.99.178 SBC07500509917629060409013US ulwy75nt743 68.48.87.43 DC-3US undef 216.218.240.205 HURRICANE-CE0579-331US veronika 66.199.252.58 NETBLK-EZZIUS viaov 71.120.32.3 VIS-71-96US vietnamwitch 70.101.164.134 ELI-NETWORK-ELIXUS vm 38.99.66.86 PSINETAUS voigner 216.27.178.157 SPEK-DSL-SFO-BR2-0US whatever 64.136.200.11 EVEREST-BLK3US whomthebelltolls 66.200.164.250 DSL-NET-17US whooodat 66.92.220.226 SPEK-NYC-BR-115US wilderness 24.159.55.136 CLKSVL-TN-24-159-48US wintools 208.66.194.6 MCCOLOUS woden 154.35.12.203 PSINET-B2-35US xtremenw 71.231.237.76 WASHINGTON-17US xxserver3 24.199.198.152 RR-COMM-MIDSOUTHUS xyzzyx 67.166.235.186 TEXAS-5US *yargh 69.55.237.39 JOHNCOMPANIESUS yeatorfday 209.6.168.183 RCN-BLK-9US yo 168.150.251.36 DCN-B1US yonkeltron 68.80.155.150 PA-METRO-7US yoshtor 66.236.18.180 XOX1-BLK-2US yxgdf09e7987sa6f97g 64.217.16.129 SBC064217016000030615US zachsplaceorg 66.219.59.183 CORENAP-NETBLOCK-01US zantars 72.72.92.133 VIS-72-64US zymurgy 18.246.1.160 MIT

A-25

ZAZA leftover 196.11.98.20 UWCNET3

A-26