Artists Against 419

2013/08/11

aa419 DDoS Aug 2013 Breakdown; LACNIC

This post forms part of "aa419 DDoS Aug 2013 Breakdown" split for ease of reading

Here are statistics for bots from the LACNIC region, broken down by Country code, ASN, IP address.

LACNIC (593 bots)
     AR (16 bots)
      AS10318 (1 bots) - CABLEVISION S.A.
          190.19.204.197     190.19.192.0/19
      AS10834 (1 bots) - Telefonica de Argentina
          200.70.38.164      200.70.0.0/16
      AS22927 (1 bots) - Telefonica de Argentina
          186.58.164.51      186.58.0.0/15
      AS28015 (1 bots) - MERCO COMUNICACIONES
          201.217.226.217    201.217.226.0/24
      AS7303 (12 bots) - Telecom Argentina S.A.
           181.95.68.105      181.95.64.0/20
           186.109.188.55     186.109.184.0/21
           186.124.229.227    186.124.224.0/21
           186.124.254.207    186.124.248.0/21
           186.125.75.189     186.125.72.0/21
           186.153.88.167     186.153.88.0/21
           186.153.91.13      186.153.88.0/21
           190.226.105.114    190.226.104.0/21
           190.227.20.140     190.227.16.0/21
           190.31.221.137     190.31.216.0/21
           200.117.46.46      200.117.40.0/21
           201.253.190.33     201.253.184.0/21
     BO (12 bots)
      AS12956 (3 bots) - TELEFONICA Telefonica Backbone Autonomous System
          190.103.65.118     190.103.64.0/20
          190.103.65.132     190.103.64.0/20
          190.103.67.34      190.103.64.0/20
      AS26210 (1 bots) - AXS Bolivia S. A.
          190.181.13.163     190.181.13.0/24
      AS27839 (1 bots) - Comteco Ltda
          190.102.51.107     190.102.48.0/21
      AS27882 (5 bots) - TelefÃ³nica Celular de Bolivia S.A.
          190.104.22.231     190.104.22.0/24
          190.104.27.81      190.104.26.0/23
          190.104.28.62      190.104.28.0/24
          190.104.7.37       190.104.7.0/24
          190.52.52.9        190.52.48.0/21
      AS28024 (1 bots) - Nuevatel PCS de Bolivia S.A.
          186.27.87.111      186.27.84.0/22
      AS6568 (1 bots) - Ag para el Desarrollo de la Sociedad de la Inf en Bolivia - ADSIB
           200.87.236.98      200.87.224.0/20
     BR (57 bots)
      AS18881 (8 bots) - Global Village Telecom
          177.134.134.78     177.134.128.0/19
          177.16.140.103     177.16.136.0/21
          177.18.236.170     177.18.224.0/20
          177.40.54.162      177.40.32.0/19
          177.97.218.217     177.97.192.0/19
          186.213.120.56     186.213.112.0/20
          186.213.200.226    186.213.192.0/19
          189.26.27.80       189.26.0.0/17
      AS1916 (1 bots) - AssociaÃ§Ã£o Rede Nacional de Ensino e Pesquisa
           200.17.115.6       200.17.112.0/20
      AS22085 (9 bots) - Claro S/A
          177.58.172.168     177.58.128.0/18
          187.26.140.94      187.26.128.0/18
          187.27.37.129      187.27.0.0/18
          187.27.87.103      187.27.64.0/18
          187.70.75.171      187.70.64.0/18
          187.70.99.103      187.70.64.0/18
          187.71.131.77      187.71.128.0/18
          187.71.98.83       187.71.64.0/18
          189.92.85.184      189.92.0.0/14
      AS262375 (1 bots) - Data Info Comercio e Servico Ltda.
         177.131.4.117      177.131.4.0/22
      AS262468 (1 bots) - Natel Telecom Ltda. - ME
         177.53.144.34      177.53.144.0/24
      AS262690 (1 bots) - Netwave TelecomunicaÃ§Ãµes Ltda.
         187.87.240.5       187.87.240.0/22
      AS262901 (1 bots) - Vcnet Provedora de Internet Ltda.
         177.22.193.99      177.22.192.0/20
      AS263001 (1 bots) - Via Cabo Provedor de Internet e InformÃ¡tica Ltda.
         186.227.49.155     186.227.48.0/20
      AS26599 (5 bots) - Vivo S.A.
          177.115.59.98      177.115.0.0/16
          177.199.127.84     177.199.0.0/17
          179.119.153.65     179.119.128.0/17
          179.166.151.11     179.166.128.0/17
          189.98.129.65      189.98.128.0/19
      AS26609 (1 bots) - Universal Telecom S.A.
          189.8.39.100       189.8.0.0/18
      AS26615 (1 bots) - Tim Celular S.A.
          177.121.29.161     177.121.0.0/19
      AS27699 (3 bots) - TELEFÃ”NICA BRASIL S.A
          179.99.22.41       179.98.0.0/15
          187.11.64.123      187.10.0.0/15
          187.57.102.198     187.56.0.0/15
      AS28260 (1 bots) - Altarede de Teresopolis Provedor de Internet Ltda
          187.95.35.62       187.95.35.0/24
      AS28573 (4 bots) - NET ServiÃ§os de ComunicaÃ§Ã£o S.A.
          177.81.246.143     177.81.224.0/19
          177.81.69.52       177.81.64.0/19
          186.207.139.110    186.207.128.0/19
          201.82.187.97      201.82.0.0/16
      AS28637 (1 bots) - Cia Proc. de Dados do Estado de S Paulo - Prodesp
          201.55.31.16       201.55.0.0/19
      AS4230 (1 bots) - EMBRATEL-EMPRESA BRASILEIRA DE TELECOMUNICAÃ‡Ã•ES SA
           200.179.192.2      200.179.0.0/16
      AS52624 (1 bots) - EDSON MARTINS PROVEDOR LTDA ME
          177.124.142.97     177.124.142.0/24
      AS7738 (7 bots) - Telemar Norte Leste S.A.
           186.241.2.180      186.241.0.0/19
           187.14.117.23      187.14.96.0/19
           187.40.211.97      187.40.192.0/19
           187.40.216.193     187.40.192.0/19
           187.41.253.197     187.41.224.0/19
           189.48.170.197     189.48.160.0/19
           200.164.101.251    200.164.0.0/16
      AS8167 (9 bots) - Brasil Telecom S/A - Filial Distrito Federal
           177.3.62.199       177.3.0.0/18
           177.4.154.171      177.4.128.0/18
           179.252.37.91      179.252.0.0/18
           179.253.58.43      179.253.0.0/18
           189.72.202.89      189.72.192.0/18
           201.34.15.231      201.34.0.0/18
           201.34.58.96       201.34.0.0/18
           201.40.135.163     201.40.128.0/18
           201.88.254.200     201.88.254.0/23
     CL (5 bots)
      AS22047 (3 bots) - VTR BANDA ANCHA S.A.
          190.101.118.229    190.101.112.0/21
          200.83.216.120     200.83.216.0/24
          201.215.144.78     201.215.144.0/21
      AS27680 (1 bots) - TELEFONICA MOVIL DE CHILE S.A.
          201.220.235.7      201.220.235.0/24
      AS27925 (1 bots) - Entel PCS Telecomunicaciones S.A.
          186.11.231.21      186.11.128.0/17
     CO (31 bots)
      AS10620 (9 bots) - Telmex Colombia S.A.
          181.50.41.239      181.50.40.0/22
          181.52.102.159     181.52.100.0/22
          181.58.136.217     181.58.136.0/22
          186.145.116.168    186.145.112.0/21
          186.147.182.177    186.147.180.0/22
          186.80.248.65      186.80.248.0/21
          186.84.158.94      186.84.156.0/22
          186.85.51.43       186.85.48.0/21
          190.156.167.90     190.156.164.0/22
      AS13489 (4 bots) - EPM Telecomunicaciones S.A. E.S.P.
          181.130.134.240    181.130.128.0/18
          181.130.135.175    181.130.128.0/18
          190.165.18.34      190.165.0.0/19
          190.29.87.217      190.29.80.0/20
      AS18678 (2 bots) - INTERNEXA S.A. E.S.P
          190.107.30.55      190.107.30.0/24
          190.90.193.29      190.90.193.0/24
      AS18747 (1 bots) - IFX-NW - IFX Communication Ventures, Inc.
          190.60.119.50      190.60.119.0/24
      AS19429 (1 bots) - ETB - Colombia
          201.244.168.213    201.244.168.0/21
      AS23520 (1 bots) - COLUMBUS-NETWORKS - Columbus Networks USA, Inc.
          190.242.67.90      190.242.64.0/21
      AS26611 (1 bots) - COMCEL S.A.
          190.243.143.25     190.243.128.0/18
      AS27763 (1 bots) - ANDINET ON LINE
          200.25.230.25      200.25.230.0/24
      AS27765 (1 bots) - TRANSNEXA S.A. E.M.A.
          190.90.83.6        190.90.83.0/24
      AS28083 (1 bots) - GILAT Colombia S.A. E.S.P.
          190.110.83.152     190.110.83.0/24
      AS3816 (7 bots) - COLOMBIA TELECOMUNICACIONES S.A. ESP
           186.113.42.250     186.113.32.0/20
           186.115.50.239     186.115.48.0/20
           186.115.52.223     186.115.48.0/20
           186.115.63.247     186.115.48.0/20
           190.255.11.219     190.255.8.0/21
           190.255.36.68      190.255.32.0/21
           190.255.88.22      190.255.88.0/21
      AS52330 (1 bots) - S3WIRELESS COLOMBIA S.A
          190.184.200.114    190.184.200.0/21
      AS8163 (1 bots) - METROTEL REDES S.A.
           181.192.129.250    181.192.128.0/19
     DO (9 bots)
      AS12066 (1 bots) - TRICOM
          186.149.55.206     186.149.0.0/18
      AS6400 (8 bots) - CompaÃ±Ãa Dominicana de TelÃ©fonos, C. por A. - CODETEL
           186.7.86.49        186.7.0.0/16
           190.167.75.96      190.167.0.0/16
           190.80.198.21      190.80.128.0/17
           190.80.216.77      190.80.128.0/17
           200.88.204.134     200.88.0.0/16
           66.98.36.10        66.98.0.0/18
           66.98.36.24        66.98.0.0/18
           66.98.36.3         66.98.0.0/18
     EC (36 bots)
      AS14420 (22 bots) - CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP
          181.112.110.237    181.112.104.0/21
          181.113.207.62     181.113.200.0/21
          181.113.208.11     181.113.208.0/21
          181.113.218.65     181.113.216.0/21
          181.113.242.59     181.113.240.0/21
          186.178.139.214    186.178.136.0/21
          186.178.221.70     186.178.192.0/18
          186.178.222.201    186.178.192.0/18
          186.178.62.167     186.178.56.0/21
          186.178.63.181     186.178.56.0/21
          186.178.73.220     186.178.64.0/18
          186.42.41.122      186.42.0.0/18
          186.46.102.116     186.46.96.0/21
          186.46.219.115     186.46.216.0/21
          186.46.227.32      186.46.224.0/21
          186.46.43.90       186.46.40.0/22
          186.47.13.75       186.47.8.0/21
          186.47.212.144     186.47.212.0/22
          190.152.224.166    190.152.224.0/21
          190.152.40.40      190.152.40.0/24
          190.214.114.147    190.214.112.0/22
          190.214.202.25     190.214.200.0/21
      AS14522 (5 bots) - Satnet
          186.69.68.98       186.69.68.0/22
          186.70.41.222      186.70.0.0/17
          186.70.62.200      186.70.0.0/17
          190.155.153.42     190.155.152.0/21
          201.217.106.109    201.217.104.0/22
      AS19114 (1 bots) - Otecel S.A.
          200.24.197.19      200.24.192.0/20
      AS22724 (1 bots) - PUNTONET S.A.
          190.12.20.83       190.12.20.0/24
      AS23487 (1 bots) - CONECEL
          190.63.134.69      190.63.134.0/24
      AS27738 (1 bots) - Ecuadortelecom S.A.
          190.131.174.54     190.131.174.0/24
      AS27740 (1 bots) - NEW ACCESS S.A.
          190.11.251.10      190.11.251.0/24
      AS27947 (4 bots) - Telconet S.A
          186.101.10.1       186.101.10.0/24
          186.5.68.91        186.5.68.0/24
          190.95.195.237     190.95.195.0/24
          201.218.17.212     201.218.17.0/24
     GT (79 bots)
      AS14754 (75 bots) - Telgua
          186.151.118.115    186.151.112.0/20
          186.151.118.117    186.151.112.0/20
          186.151.118.155    186.151.112.0/20
          186.151.118.235    186.151.112.0/20
          186.151.118.49     186.151.112.0/20
          186.151.118.7      186.151.112.0/20
          186.151.118.90     186.151.112.0/20
          186.151.122.101    186.151.112.0/20
          186.151.122.108    186.151.112.0/20
          186.151.122.18     186.151.112.0/20
          186.151.122.194    186.151.112.0/20
          186.151.122.25     186.151.112.0/20
          186.151.122.38     186.151.112.0/20
          186.151.17.110     186.151.16.0/20
          186.151.17.160     186.151.16.0/20
          186.151.17.9       186.151.16.0/20
          186.151.172.33     186.151.160.0/20
          186.151.33.235     186.151.32.0/20
          186.151.40.140     186.151.32.0/20
          186.151.40.183     186.151.32.0/20
          186.151.40.196     186.151.32.0/20
          186.151.40.26      186.151.32.0/20
          186.151.40.58      186.151.32.0/20
          186.151.40.93      186.151.32.0/20
          186.151.84.133     186.151.80.0/20
          186.151.84.142     186.151.80.0/20
          186.151.84.220     186.151.80.0/20
          186.151.84.25      186.151.80.0/20
          186.151.84.78      186.151.80.0/20
          190.148.130.159    190.148.128.0/20
          190.148.130.246    190.148.128.0/20
          190.148.86.142     190.148.80.0/20
          190.149.125.99     190.149.112.0/20
          190.149.188.4      190.149.176.0/20
          190.149.188.75     190.149.176.0/20
          190.149.193.165    190.149.192.0/20
          190.56.173.219     190.56.160.0/20
          190.56.173.40      190.56.160.0/20
          190.56.253.219     190.56.240.0/20
          190.56.254.117     190.56.240.0/20
          190.56.48.131      190.56.48.0/20
          190.56.48.192      190.56.48.0/20
          190.56.49.169      190.56.48.0/20
          190.56.49.21       190.56.48.0/20
          190.56.49.51       190.56.48.0/20
          190.56.50.135      190.56.48.0/20
          190.56.51.164      190.56.48.0/20
          190.56.51.167      190.56.48.0/20
          190.56.51.214      190.56.48.0/20
          190.56.51.55       190.56.48.0/20
          190.56.54.150      190.56.48.0/20
          190.56.54.153      190.56.48.0/20
          190.56.54.38       190.56.48.0/20
          190.56.54.58       190.56.48.0/20
          190.56.55.104      190.56.48.0/20
          190.56.55.226      190.56.48.0/20
          190.56.55.236      190.56.48.0/20
          190.56.55.31       190.56.48.0/20
          190.56.55.66       190.56.48.0/20
          190.56.55.85       190.56.48.0/20
          190.56.56.154      190.56.48.0/20
          190.56.56.206      190.56.48.0/20
          190.56.56.217      190.56.48.0/20
          190.56.56.226      190.56.48.0/20
          190.56.56.245      190.56.48.0/20
          190.56.57.240      190.56.48.0/20
          190.56.57.243      190.56.48.0/20
          190.56.57.26       190.56.48.0/20
          190.56.57.34       190.56.48.0/20
          190.56.58.103      190.56.48.0/20
          190.56.58.237      190.56.48.0/20
          201.216.155.193    201.216.144.0/20
          201.216.155.52     201.216.144.0/20
          201.216.155.82     201.216.144.0/20
      AS23243 (5 bots) - COMCEL GUATEMALA S.A.
          190.106.200.84     190.106.200.0/24
          190.106.222.106    190.106.220.0/22
          190.106.222.239    190.106.220.0/22
          200.49.191.122     200.49.191.0/24
          200.49.191.16      200.49.191.0/24
     HN (3 bots)
      AS23383 (1 bots) - METRORED S.A. DE C.V.
          190.109.206.18     190.109.206.0/24
      AS27884 (1 bots) - CABLECOLOR S.A.
          190.92.44.104      190.92.44.0/24
      AS27932 (1 bots) - Redes y Telecomunicaciones
          190.11.234.204     190.11.224.0/20
     HT (2 bots)
      AS27759 (1 bots) - ACCESS HAITI S.A.
          186.190.120.120    186.190.0.0/17
      AS52260 (1 bots) - TÃ©lÃ©communications de HaitÃ (Teleco)
          186.1.205.182      186.1.205.0/24
     MX (100 bots)
      AS11172 (1 bots) - Alestra, S. de R.L. de C.V.
          201.163.21.20      201.163.21.0/24
      AS13591 (3 bots) - Brasil Telecom ComunicaÃ§Ã£o Multimidia
          148.246.184.204    148.246.176.0/20
          148.246.69.230     148.246.64.0/19
          187.186.232.176    187.186.224.0/20
      AS13999 (4 bots) - Mega Cable, S.A. de C.V.
          187.242.98.179     187.242.0.0/17
          189.193.231.188    189.193.192.0/18
          189.199.182.61     189.199.160.0/19
          201.164.171.39     201.164.160.0/19
      AS27672 (1 bots) - Tele Cable Centro Occidente, S.A. de C.V.
          200.77.144.49      200.77.144.0/20
      AS28503 (2 bots) - GSAT COMUNICACIONES SA DE CV
          201.139.198.187    201.139.192.0/20
          201.139.215.21     201.139.208.0/21
      AS28554 (1 bots) - Cablemas Telecomunicaciones SA de CV
          189.220.48.18      189.220.48.0/24
      AS6332 (1 bots) - Telefonos del Noroeste, S.A. de C.V.
           200.38.20.194      200.38.0.0/19
      AS6503 (1 bots) - Axtel, S.A.B. de C.V.
           187.165.69.86      187.164.0.0/14
      AS8151 (86 bots) - Uninet S.A. de C.V.
           187.137.175.181    187.137.160.0/19
           187.144.14.235     187.144.0.0/19
           187.151.83.248     187.151.64.0/19
           187.158.219.44     187.158.192.0/19
           187.158.26.147     187.158.0.0/19
           187.170.16.78      187.170.0.0/17
           187.171.42.172     187.171.0.0/16
           187.193.129.59     187.193.128.0/17
           187.193.130.96     187.193.128.0/17
           187.193.197.83     187.193.128.0/17
           187.195.195.40     187.195.128.0/17
           187.199.246.195    187.199.0.0/16
           187.201.32.213     187.201.0.0/17
           187.202.156.130    187.202.0.0/16
           187.206.250.162    187.206.0.0/16
           187.207.248.177    187.207.0.0/16
           187.208.131.248    187.208.0.0/16
           187.208.180.247    187.208.0.0/16
           187.208.217.41     187.208.0.0/16
           187.208.225.173    187.208.0.0/16
           187.208.247.127    187.208.0.0/16
           187.211.77.92      187.211.0.0/17
           187.212.30.105     187.212.0.0/17
           187.214.53.46      187.214.0.0/17
           187.233.33.83      187.233.0.0/17
           187.233.34.121     187.233.0.0/17
           187.233.78.65      187.233.0.0/17
           187.234.221.225    187.234.128.0/17
           189.128.45.54      189.128.32.0/19
           189.133.240.60     189.133.224.0/19
           189.139.12.169     189.139.0.0/17
           189.139.144.91     189.139.128.0/17
           189.139.147.195    189.139.128.0/17
           189.139.173.73     189.139.128.0/17
           189.139.206.80     189.139.128.0/17
           189.139.214.48     189.139.128.0/17
           189.139.245.66     189.139.128.0/17
           189.139.36.171     189.139.0.0/17
           189.139.4.221      189.139.0.0/17
           189.139.48.65      189.139.0.0/17
           189.139.81.120     189.139.0.0/17
           189.139.86.234     189.139.0.0/17
           189.143.255.191    189.143.0.0/16
           189.146.27.108     189.146.0.0/16
           189.147.28.54      189.147.0.0/19
           189.147.38.253     189.147.32.0/19
           189.147.44.34      189.147.32.0/19
           189.147.46.50      189.147.32.0/19
           189.147.54.88      189.147.32.0/19
           189.147.72.241     189.147.64.0/19
           189.147.9.240      189.147.0.0/19
           189.148.164.80     189.148.160.0/19
           189.148.165.195    189.148.160.0/19
           189.148.183.236    189.148.160.0/19
           189.148.189.190    189.148.160.0/19
           189.148.201.109    189.148.192.0/19
           189.148.40.178     189.148.32.0/19
           189.148.60.54      189.148.32.0/19
           189.154.30.6       189.154.0.0/19
           189.154.60.237     189.154.32.0/19
           189.154.62.190     189.154.32.0/19
           189.154.68.159     189.154.64.0/19
           189.154.82.183     189.154.64.0/19
           189.156.162.146    189.156.160.0/19
           189.156.18.23      189.156.0.0/19
           189.157.70.222     189.157.64.0/19
           189.167.51.194     189.167.32.0/19
           189.170.34.99      189.170.32.0/19
           189.170.37.52      189.170.32.0/19
           189.173.65.143     189.173.64.0/19
           189.176.25.34      189.176.0.0/19
           189.176.26.156     189.176.0.0/19
           189.179.159.216    189.179.128.0/17
           189.186.50.210     189.186.32.0/19
           189.186.54.96      189.186.32.0/19
           189.186.84.49      189.186.64.0/19
           189.191.29.93      189.191.0.0/17
           189.225.232.54     189.225.224.0/19
           189.237.111.48     189.237.96.0/19
           189.248.217.71     189.248.192.0/19
           189.250.2.41       189.250.0.0/19
           189.251.87.136     189.251.64.0/19
           189.254.9.35       189.254.0.0/18
           201.102.47.209     201.102.32.0/19
           201.114.27.153     201.114.0.0/19
           201.153.126.59     201.153.96.0/19
     NI (1 bots)
      AS14754 (75 bots) - Telgua
          186.77.193.216     186.77.192.0/20
     PA (2 bots)
      AS11556 (1 bots) - Cable & Wireless Panama
          190.35.218.34      190.35.0.0/16
      AS21599 (1 bots) - NETDIRECT S.A.
          201.218.237.162    201.218.237.0/24
     PE (184 bots)
      AS12252 (9 bots) - America Movil Peru S.A.C.
          190.113.208.2      190.113.208.0/23
          190.113.210.8      190.113.210.0/23
          190.113.211.250    190.113.210.0/23
          190.117.175.237    190.117.160.0/19
          190.222.203.53     190.222.192.0/19
          190.222.23.46      190.222.0.0/19
          190.222.91.215     190.222.64.0/19
          190.223.236.59     190.223.192.0/18
          190.81.182.117     190.81.176.0/20
      AS19180 (1 bots) - AMERICATEL PERU S.A.
          190.187.56.64      190.187.56.0/24
      AS262182 (1 bots) - Media Networks Latin America SAC
         190.52.113.160     190.52.112.0/21
      AS6147 (173 bots) - Telefonica del Peru S.A.A.
           181.64.10.118      181.64.0.0/19
           181.64.181.239     181.64.160.0/19
           181.64.5.30        181.64.0.0/19
           181.64.56.158      181.64.32.0/19
           181.64.6.17        181.64.0.0/19
           181.64.76.14       181.64.64.0/19
           181.64.76.201      181.64.64.0/19
           181.64.92.87       181.64.92.0/24
           181.65.159.73      181.65.128.0/19
           181.65.21.206      181.65.0.0/19
           181.65.22.151      181.65.0.0/19
           181.65.78.119      181.65.64.0/19
           181.65.95.90       181.65.64.0/19
           181.66.112.15      181.66.96.0/19
           181.66.118.102     181.66.96.0/19
           181.66.156.18      181.66.128.0/19
           181.66.157.69      181.66.128.0/19
           181.66.157.73      181.66.128.0/19
           181.66.161.2       181.66.160.0/19
           181.66.161.97      181.66.160.0/19
           181.66.201.32      181.66.192.0/19
           181.66.220.62      181.66.192.0/19
           181.66.45.4        181.66.32.0/19
           181.66.48.76       181.66.32.0/19
           181.67.114.230     181.67.96.0/19
           181.67.137.43      181.67.128.0/19
           181.67.144.226     181.67.128.0/19
           181.67.145.135     181.67.128.0/19
           181.67.154.165     181.67.128.0/19
           181.67.154.198     181.67.128.0/19
           181.67.156.235     181.67.128.0/19
           181.67.51.59       181.67.32.0/19
           181.67.61.89       181.67.32.0/19
           190.232.129.175    190.232.128.0/19
           190.232.135.159    190.232.128.0/19
           190.232.149.199    190.232.128.0/19
           190.232.174.239    190.232.160.0/19
           190.232.178.15     190.232.160.0/19
           190.232.191.225    190.232.160.0/19
           190.232.194.89     190.232.192.0/19
           190.232.218.111    190.232.192.0/19
           190.232.25.1       190.232.16.0/20
           190.232.34.128     190.232.32.0/19
           190.232.34.62      190.232.32.0/19
           190.232.89.81      190.232.64.0/19
           190.232.96.133     190.232.96.0/19
           190.233.122.231    190.233.96.0/19
           190.233.123.59     190.233.96.0/19
           190.233.16.86      190.233.16.0/20
           190.233.199.111    190.233.192.0/19
           190.233.2.80       190.233.0.0/20
           190.233.24.126     190.233.16.0/20
           190.233.26.178     190.233.16.0/20
           190.233.27.182     190.233.16.0/20
           190.233.44.243     190.233.40.0/21
           190.233.49.14      190.233.49.0/24
           190.233.54.58      190.233.54.0/24
           190.233.57.116     190.233.56.0/22
           190.234.155.80     190.234.128.0/19
           190.234.16.240     190.234.0.0/19
           190.234.171.14     190.234.160.0/19
           190.234.172.80     190.234.160.0/19
           190.234.177.250    190.234.160.0/19
           190.234.184.120    190.234.160.0/19
           190.234.40.163     190.234.32.0/19
           190.234.51.251     190.234.32.0/19
           190.234.7.98       190.234.0.0/19
           190.235.0.93       190.235.0.0/19
           190.235.103.72     190.235.96.0/19
           190.235.125.7      190.235.125.0/24
           190.235.215.19     190.235.208.0/21
           190.235.216.22     190.235.192.0/19
           190.236.188.176    190.236.160.0/19
           190.236.204.128    190.236.204.0/24
           190.236.204.186    190.236.204.0/24
           190.236.205.52     190.236.205.0/24
           190.236.28.56      190.236.0.0/19
           190.236.3.69       190.236.0.0/19
           190.236.30.154     190.236.0.0/19
           190.236.58.69      190.236.32.0/19
           190.236.65.81      190.236.64.0/19
           190.236.7.220      190.236.0.0/19
           190.236.83.120     190.236.64.0/19
           190.236.83.204     190.236.64.0/19
           190.237.227.206    190.237.227.0/24
           190.237.248.50     190.237.224.0/19
           190.237.250.200    190.237.250.0/24
           190.237.61.240     190.237.61.0/24
           190.237.61.242     190.237.61.0/24
           190.238.125.193    190.238.125.0/24
           190.238.125.43     190.238.125.0/24
           190.238.131.9      190.238.131.0/24
           190.238.147.74     190.238.128.0/19
           190.238.194.187    190.238.192.0/19
           190.238.197.177    190.238.192.0/19
           190.238.20.109     190.238.20.0/24
           190.238.213.201    190.238.192.0/19
           190.238.225.150    190.238.225.0/24
           190.238.229.89     190.238.224.0/19
           190.238.28.14      190.238.0.0/19
           190.239.128.150    190.239.128.0/24
           190.239.139.178    190.239.139.0/24
           190.239.139.191    190.239.139.0/24
           190.239.141.100    190.239.141.0/24
           190.239.145.201    190.239.128.0/19
           190.239.193.49     190.239.193.0/24
           190.239.194.235    190.239.194.0/24
           190.239.203.162    190.239.203.0/24
           190.239.226.252    190.239.192.0/18
           190.239.227.250    190.239.192.0/18
           190.239.247.170    190.239.247.0/24
           190.239.253.38     190.239.248.0/21
           190.239.51.197     190.239.32.0/19
           190.239.57.188     190.239.32.0/19
           190.239.70.189     190.239.64.0/19
           190.239.77.48      190.239.64.0/19
           190.239.77.6       190.239.64.0/19
           190.239.79.96      190.239.64.0/19
           190.239.85.84      190.239.64.0/19
           190.40.10.66       190.40.0.0/20
           190.40.218.236     190.40.218.0/24
           190.40.61.67       190.40.0.0/16
           190.41.106.35      190.41.0.0/17
           190.41.136.253     190.41.128.0/19
           190.41.179.129     190.41.160.0/19
           190.41.181.61      190.41.160.0/19
           190.42.147.226     190.42.128.0/19
           190.42.147.79      190.42.128.0/19
           190.42.160.25      190.42.160.0/19
           190.42.160.61      190.42.160.0/19
           190.42.199.167     190.42.199.0/24
           190.42.240.36      190.42.240.0/24
           190.42.27.179      190.42.16.0/20
           190.42.44.46       190.42.44.0/24
           190.42.92.167      190.42.0.0/16
           190.43.102.249     190.43.0.0/16
           190.43.116.10      190.43.116.0/24
           190.43.140.7       190.43.0.0/16
           190.43.147.153     190.43.0.0/16
           190.43.148.224     190.43.0.0/16
           190.43.174.36      190.43.0.0/16
           190.43.33.27       190.43.0.0/16
           190.43.64.90       190.43.64.0/19
           190.43.74.39       190.43.64.0/19
           200.106.107.61     200.106.64.0/18
           200.106.18.76      200.106.16.0/20
           200.106.3.165      200.106.0.0/20
           200.121.22.153     200.121.0.0/18
           200.121.226.139    200.121.192.0/18
           200.121.39.82      200.121.0.0/18
           200.37.182.85      200.37.160.0/19
           200.37.251.170     200.37.224.0/19
           200.37.251.42      200.37.224.0/19
           200.4.237.222      200.4.224.0/19
           201.230.120.100    201.230.0.0/16
           201.230.123.172    201.230.0.0/16
           201.230.146.185    201.230.128.0/17
           201.230.174.253    201.230.128.0/17
           201.230.185.177    201.230.128.0/17
           201.230.211.109    201.230.128.0/17
           201.230.211.244    201.230.128.0/17
           201.230.56.156     201.230.0.0/16
           201.230.76.34      201.230.64.0/19
           201.230.83.64      201.230.64.0/19
           201.240.113.95     201.240.113.0/24
           201.240.145.202    201.240.145.0/24
           201.240.150.120    201.240.150.0/24
           201.240.187.35     201.240.0.0/16
           201.240.193.174    201.240.0.0/16
           201.240.217.133    201.240.0.0/16
           201.240.219.156    201.240.0.0/16
           201.240.241.221    201.240.241.0/24
           201.240.89.91      201.240.64.0/19
     SV (1 bots)
      AS27773 (1 bots) - MILLICOM CABLE EL SALVADOR S.A. DE C.V.
          190.53.6.107       190.53.4.0/22
     TT (7 bots)
      AS27665 (2 bots) - Columbus Communications Trinidad Limited.
          190.83.176.155     190.83.176.0/20
          190.83.254.82      190.83.240.0/20
      AS5639 (5 bots) - Telecommunication Services of Trinidad and Tobago
           186.44.170.41      186.44.160.0/19
           186.45.154.9       186.45.152.0/21
           186.45.64.253      186.45.64.0/21
           186.45.91.253      186.45.88.0/21
           186.45.93.121      186.45.88.0/21
     VE (48 bots)
      AS21826 (2 bots) - CorporaciÃ³n Telemic C.A.
          186.14.116.99      186.14.96.0/19
          200.8.230.173      200.8.230.0/23
      AS27717 (10 bots) - Corporacion Digitel C.A.
          190.121.238.22     190.121.238.0/24
          190.121.238.23     190.121.238.0/24
          190.121.238.33     190.121.238.0/24
          190.121.238.34     190.121.238.0/24
          190.121.238.36     190.121.238.0/24
          190.121.238.47     190.121.238.0/24
          190.121.238.48     190.121.238.0/24
          190.121.239.38     190.121.239.0/24
          190.121.239.72     190.121.239.0/24
          190.121.239.82     190.121.239.0/24
      AS27889 (1 bots) - Telecomunicaciones MOVILNET
          181.17.210.22      181.17.128.0/17
      AS28007 (1 bots) - Gold Data C.A.
          186.96.68.58       186.96.64.0/20
      AS8048 (34 bots) - CANTV Servicios, Venezuela
           186.88.77.116      186.88.0.0/16
           186.90.121.35      186.90.0.0/16
           186.91.159.51      186.91.128.0/19
           186.92.220.206     186.92.0.0/16
           186.92.81.107      186.92.0.0/16
           186.92.86.137      186.92.0.0/16
           186.93.192.161     186.93.192.0/19
           186.94.138.234     186.94.0.0/16
           186.94.181.201     186.94.0.0/16
           186.94.28.211      186.94.0.0/19
           186.94.84.56       186.94.64.0/19
           190.198.42.136     190.198.0.0/16
           190.199.92.176     190.199.64.0/19
           190.201.234.98     190.201.0.0/16
           190.206.214.144    190.206.192.0/19
           190.36.114.74      190.36.96.0/19
           190.36.121.182     190.36.96.0/19
           190.36.121.33      190.36.96.0/19
           190.37.222.3       190.37.0.0/16
           190.37.254.83      190.37.224.0/19
           190.38.45.236      190.38.0.0/16
           190.38.89.138      190.38.0.0/16
           190.39.132.58      190.39.128.0/19
           190.72.26.251      190.72.0.0/16
           190.72.31.216      190.72.0.0/16
           190.73.128.110     190.73.0.0/16
           190.74.239.102     190.74.0.0/16
           190.75.132.118     190.75.0.0/16
           190.76.121.202     190.76.0.0/16
           190.77.20.4        190.77.0.0/16
           200.11.139.2       200.11.128.0/17
           200.93.82.16       200.93.64.0/19
           201.209.2.243      201.209.0.0/16
           201.242.249.120    201.242.0.0/16

aa419 DDoS Aug 2013 Breakdown

Over the past few days, aa419 has been under a DDoS attack once agin. Somewhere out there, there is a happy "scammer client". We are always happy to please and note your appreciation of our services, confirming the need for aa419 to be on the net doing what we do.

So when our "scammer client" hired a botnet to show his appreciation, we put steps into place.
It was believed to be in the best interests of the Internet community publish these statistics

A Problem in Escalation

Of late botnets have been abused to DDoS anti-abuse sites in an attempt at hiding criminality that targets the end users. However reporting these bots is a near impossible task due to lacking and stale information on network owners. Many companies that spend millions on advertising trying to convince their clients they are simply the best, are extremely negligent when maintaining their network information at their Regional Internet Registry.

What does this mean to you as a user of their services?

If a party like aa419 happens to notice abuse coming from an IP addess you are using, we will not know it is you who it is currently assigned to. What we will see is the network owner information (theoretically at least). There should be some form of valid contact that can easily be reached that will allow us to inform your provider of this abuse. However, if this information is not available, we have to go on a sleuthing exercise to try and determine the relevant esclation channel, or or alternative (slower) escalation channels.

In the meantime somebody unknown to you may have full access to your system, downloaded malware onto your system and is abusing it to attack us. His unauthorized access also allows him to steal information from you such as passwords and other personal details about you that in turn can be abused to your detriment. Also, at the same time, you may well be paying for his abuse of your system in terms of bandwidth used. Your system may also be abused to compromise other parties on the same home network as you, safely protected inside your own home network (or so you thought)!

As such any responsible provider would be keen to know about abuse on their network and not allowed it to be used as such. But if they cannot be contacted, they do not live up to their promised service.

At this stage we should also mention that another category of provider exists, one that supplies VPN's to his clients. This can be done responsibly, or irresponsibly. We will shortly see an example of this.

After trying to manually contact providers or other responsible parties, with numerous bounced emails ( It was also considered publishing such network records, but that will keep for if we ever end up in this situation again.), it was decided to publish our botnet client related DDoS statistics. This will enable the internet user to decide for himself what is safe and what is not, allowing him to protect himself.

aa419 invites contact from the providers and CERTS if evidence is needed. A special email address has been set up to receive your emails: ddosalert(AT)aa419.org.

The Statistics

A total of 3782 were sorted by Region, Country Code, AS number. and IP address. This allows the reader to easily spot problem areas and take perventative action.

We have also posted the full details by regions:

Summaries

Here is a summary of each area:

AFRINIC

297 Bots total for AFRINIC
73 Algeria - The country with the most bots in AFRINIC
65 The AS with the most bots was AS36947: ALGERIE TELECOM

APNIC

1299 Bots total for APNIC
310 India - The country with the most bots in APNIC
119 The AS with the most bots was AS36947: BSNL Internet

ARIN

42 Bots total
    35 USA - The country with the most bots in ARIN
     9 The AS with the most bots was AS4436: nLayer*

        *Also see what part VPN providers plays in these stats in
"A Special Note on the USA" below

LACNIC

   593 Bots total
   184 PERU - The country with the most bots in LACNIC
   119 The AS with the most bots was AS6147: Telefonica del Peru S.A.A.

RIPENCC

1551 Bots total for RIPENCC
348 Iran - The country with the most bots in RIPENCC
210 The AS with the most bots was AS21277: Newroz Telecom Ltd.

OVERALL

1551 Region with the highest number of bots - RIPENCC
348 Iran - The country with the most bots
210 AS21277: Newroz Telecom Ltd, the AS with the most bots

TOP 10 ASNs

210 AS21277 Newroz Telecom Ltd, Iran
173 AS6147 Telefonica del Peru S.A.A., Peru
127 AS9198 JSC Kazakhtelecom, Kazakhstan
119 AS9829 BSNL Internet, India
   92 AS50710 EarthLink Ltd, Iraq
   91 AS12880 Information Technology Company (ITC), Iran
   86 AS8151 Uninet S.A. de C.V., Mexico
   84 AS17882 UNIVISION LLC, Mongolia
   80 AS36947 ALGERIE TELECOM, Algeria
   75 AS14754 Telgua, Guatemala

Top 10 Countires

348 IR Iran
310 IN India
308 IQ Iraq
223 TH Thailand
216 PH Philippines
198 RU Russia
192 KZ Kazakhstan
184 PE Peru
144 VN Vietnam
100 MX Mexico

Some of the statistics are not a surprise and has been discussed before. However we were certainly surprised by the appearance of some of these countries on the radar. Somewhere the figure was bantered about that the Internet serves 2.4 billion users currently. We are all one another's neighbor. We trust this serves as a red flag to take corrective action if you find yourself to be linked to any of these stats in any way and we cans stay good neighbors.

A Special Note on the USA

Of note is how few bots were seen from the USA. The USA needs to be commended for their low prevalence in the logs.

At this stage it may be appropriate to analyze the top four abused US networks. Where abuse could be seen, the most abused networks can be attributed to VPN providers. nLayer, Hurricane Electric and EGIHosting are well known. Areti Internet is a new name to us.

9 AS4436 nLayer
5 AS6939 Hurricane Electric, Inc
5 AS21321 Areti Internet Ltd.
3 AS18779 EGIHosting

Let us put this into perspective:

22 IPs attributed to nLayer/Hurricane Electric/Aret/EGIHosting
35 Abused IP addresses for the USA.

More than half the USA abuse was attributable to VPNS!

Further, more than one remote bot may abuse a single VPN provider. As such:

22+ Bots attributed to nLayer/Hurricane Electric/Aret/EGIHosting

nLayer, Hurricane Electric and EGIHosting has been observed to be a contributor to online incidents where even the most common garden variety scammer scamms from. Their appearance once again, but now in denial of service attacks, is predictable as these providers have no real control over who they allow on their services as their is no real accountability. One of their common clients, AnchorFree with their HotSpot Shield product, by their own admittance, keeps no logs to ensure their user's privacy. Privacy to do what? Privacy and anonymity are not synonyms. We see the results in our logs and in our email boxes. Likewise we can be sure other service providers see the same.resulting abuse related to these VPN services. Previous HostExploit reports bears testimony to this.

List and Block Removal

Numerous parties had (not so) bright ideas to automate processes and did so incorrectly. These further contributed substantially to the server load and have been blocked, although not listed, One or more such entries may still exist. If you find yourself listed, please consider what you did that may have caused you to be listed before contacting us.

If you are one of our friends with a special arrangement, please accept our apologies.

We accept list removal requests for innocent issues, however the logs will be scrutinized before considering such requests.

Should a network provider indicate an IP address or range has been cleaned, such an IP address or range will be unblocked in good faith. Repeat requests to unblock after a previous unblocking was done and malicious activity was seen again causing blocking, will not be done without explanations of what was done in an attempt to resolve this issue.

Disclaimer

All possible steps were taken to check the logs for correctness as to present accurate and reliable data. No responsibility will be taken for information supplied in good faith but which is not correct. Checking the activity of each connection during a DDoS attack manually is near impossible. Automation may fail and produce false positives. Where such FP's were noted, corrective steps were taken and the results reproduced as to produce fair and impartial statistics.

2013/08/08

And yet another DDoS

Aa419.org is experiencing yet another DDoS attack.

Now here is the weird thing. When and as aa419 members encounter fraudulent websites, they get it listed and terminated, it's nothing personal. Fraud does not belong on the net. However those that lose there instruments of fraud do get more than a bit upset and is why we see attacks against us. It just confirms the effectiveness of aa419.org

However in this instance the attacker chose to highlight a listing for http://www.gline-bank.com/ in his attack. Why? What was this?

It's an entry for a fictitious "Bank Of Ivestments". This is not spelling error on the side of aa419, rather that of a not too clever HyIP scammer. Referring to the scammer a "not too clever" is deliberate and will become more than apparent as we analyze issues in this scam. In this case it's actually an understatement.

Looking at the domain name, "gline" in gline-bank.com, it was supposed to stand for Greenline.

This, linked to the scammer's lacking spelling skills, made a member curious to see what else there was on the net that matches these rather silly identifying mistakes. As we said many times before, nothing motivates our members like a DDoS attack.

Hello, what have we here? http://www.greenline-bank.com aka "Bank Of Ivestments"

Clicking on this "bank's" about us we see how they describe themselves:

About Us
Bank of Ivestments is a private investment company operating in the field of local and global investment. We offer investment opportunities to individuals and companies so to allow for participation in the business market within a safe and risk- free investment environment.

We have a strong infrastructure and solid administrative basis since we have sufficient expertise to manage our projects and invest funds in all available economic sectors in which we perceive the future dimension we aspire to reach.

We founded Bank of Ivestments with one goal in mind - making our company one of the most “Trusted and Respected” investment company in the world. Bank of Ivestments would never deviate from that commitment; to be a global standard bearer recognized worldwide for its fundamentals - based investment principles and first-class client services.

Very amusing, to say the least. They promise

Fixed monthly profit rate (7%).
Withdrawing the principal or profits at any time.
A minimum investment limit of 100 USD/EUR.
Possibility of reopening new investments.
Possibility of profits reinvestment.
Ongoing technical support around the clock.

Now this is borderline hilarious. Right below this promise of 24 x 7 technical support, we find "Online Support" to be Offline.

But it gets even better and mobves to the insane realm. Look at the domain registration details of this domain:

Domain Name: GREENLINE-BANK.COM
   Registrar: CENTER OF UKRAINIAN INTERNET NAMES
   Whois Server: whois.ukrnames.com
   Referral URL: http://www.ukrnames.com
   Name Server: NS1.AFRAID.ORG
   Name Server: NS2.AFRAID.ORG
   Name Server: NS3.AFRAID.ORG
   Name Server: NS4.AFRAID.ORG
   Status: ok
   Updated Date: 21-may-2013
   Creation Date: 21-may-2013
   Expiration Date: 21-may-2014

Service Provided By: Center of Ukrainian Internet Names
Website: http://www.ukrnames.com
Contact: +380.577626123

Domain Name: GREENLINE-BANK.COM

Creation Date: 21-May-2013
Modification Date: 21-May-2013
Expiration Date: 21-May-2014

Domain servers in listed order:
ns1.afraid.org
ns2.afraid.org
ns3.afraid.org
ns4.afraid.org

Registrant:
Green Bank f858614@rmqkr.net
22643, LUND, Magistratsvagen, 17
LUND, 22643
SWEDEN
+46.460169696

Billing Contact:
Green Bank f858614@rmqkr.net
Green Line
22643, LUND, Magistratsvagen, 17
LUND, 22643
SWEDEN
+46.460169696

Administrative Contact:
Green Bank f858614@rmqkr.net
Green Line
22643, LUND, Magistratsvagen, 17
LUND, 22643
SWEDEN
+46.460169696

Technical Contact:
Green Bank f858614@rmqkr.net
Green Line
22643, LUND, Magistratsvagen, 17
LUND, 22643
SWEDEN
+46.460169696

Status: ok

Not only is the address incomplete, the email address is a disposable email address. Please queue up here for your own personal rmkqr.net email address, guaranteed to self destruct in a few minutes!

Now, let us reconsider the claims made initially: "We have a strong infrastructure and solid administrative basis since we have sufficient expertise..". "Trusted and Respected”

Surely this HyIP scammer qualifies for the internet equivalent of the Darwin award? Not only himself, but also his scams. At any time he may loose his domain if somebody had to report it for invalid registration details and that registrar follows the provisions of the ICANN RAA. Strangely (?) any attempts at calling +46.460169696 also fails. As such we have a domain where there is no control - our HyIP scammer essentially cut himself off from the domain and can't respond to any Registrar communication to him. Not too bright for a scammer.

Any "investor" in Green Bank / Green Line / Bank Of Ivestments, or whatever he choses to call himself next, is bound to be building his HyIP investment on extremly fragile foundations. The word quicksand jumps to mind.

Now let's take this a step further. We already showed the domain registration details of this HyIP scam. Let's take a look at the now suspended gline-bank.com domain, our HyIP scammer has just taken stupidity to a new level.

Privacy Protection Service is enabled for this domain
To contact the owner of the domain please send a request to the registrar

Domain Name: GLINE-BANK.COM

Creation Date: 22-Jul-2013
Modification Date: 22-Jul-2013
Expiration Date: 22-Jul-2014

Domain servers in listed order:
ns1.afraid.org
ns2.afraid.org
ns3.afraid.org
ns4.afraid.org

Registrant:
Protected name, protect@privacy.com.ua
p.b. 2354, Kharkov, UA
+380.577626123

Billing Contact:
Protected name, protect@privacy.com.ua
p.b. 2354, Kharkov, UA
+380.577626123

Administrative Contact:
Protected name, protect@privacy.com.ua
p.b. 2354, Kharkov, UA
+380.577626123

Technical Contact:
Protected name, protect@privacy.com.ua
p.b. 2354, Kharkov, UA
+380.577626123

Apart from the privacy abuse, do you spot it? Of course you do. How stupid does it get.

Let's take it a bit further: http://bankof7.com / bankofseven.com.

About Us

Report an Error BANK OF 7 is a private investment company operating in the field of local and global investment. We offer investment opportunities to individuals and companies so to allow for participation in the business market within a safe and risk- free investment environment.

We have a strong infrastructure and solid administrative basis since we have sufficient expertise to manage our projects and invest funds in all available economic sectors in which we perceive the future dimension we aspire to reach.

We founded BANK OF 7 with one goal in mind - making our company one of the most “Trusted and Respected” investment company in the world. BANK OF 7 would never deviate from that commitment; to be a global standard bearer recognized worldwide for its fundamentals - based investment principles and first-class client services.

What can I say, the aa419 team is bored thanks to certain issues beyond our control. Slay away scam killers!

Update
Digging around a bit more, we find:
bankof7.net (domain recently expired)
lineinv.com (alive and well)