IP Block and
link to results of our investigation |
Organization Name Listed in Whois
(or to which it was assigned originally if not currently listed) |
Proper Owner for this IP block |
Current Whois Status |
Hijacking
Activity |
Type of
hijacking |
Responsible Hijacker
Groups and/or Recent Users of IP Block |
ASNs that are or were improperly
announcing
IP block* |
| 24.227.0.0/19 |
Auburn Cable Vision Inc |
Adelphia Cable
www.adelphia.net |
Domain Reregistered |
Past |
Unintentional
Whois Hijacking |
IP block used properly, but domain is
reregistered |
N/A |
| 34.0.0.0/8 |
Halliburton Company |
Halliburton Oil Company
www.halliburton.com |
Whois Restored to proper
owner |
Past |
Confirmed
Whois Hijacking |
RouteX LTD / Gordon Lantz |
N/A |
| 64.79.128.0/19 |
WorkNet Communications |
NuVox Communications
www.nuvox.com |
IP Block Deleted from
Whois |
Recent |
Probable
Whois Hijacking |
VMX/AdvisTech |
AS13768, AS14492 |
66.51.128.0/20 |
Novo Networks |
Novo Networks (Dallas) www.novonetworks.net |
IP Block Deleted from
Whois |
Active |
Probable
Whois Hijacking |
JIBH.NET |
AS23401, AS8001 |
|
66.135.64.0/19 |
First Internet |
NONE (company out of business from 2003)
Was: firstnethou.com |
IP Block Deleted from
Whois |
Hijacking Danger |
Probable
Whois Hijacking |
VMX/AdvisTech |
AS21844 |
| 128.13.0.0/16 |
DSI-South |
US Military - DoD
NIC
(was ARPANET project) |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS15188 |
| 131.157.0.0/16 |
Librascope Corporation |
Lockheed Martin
www.lmco.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS20290 |
| 132.220.0.0/16 |
Sobeco Group, Inc |
Mourneu Sobeco
www.morneausobeco.ca |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
unknown - see
this reference |
N/A |
| 132.232.0.0/16 |
BIS Mackintosh |
Strategy Analytics
strategyanalytics.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Brad
Martin - Reversed Networks |
AS16631 |
| 134.33.0.0/16 |
Codex Corporation |
Motorola
www.mot.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS8143,
AS27255 |
| 137.171.0.0/16 |
Systems Center Inc |
Computer Associates
www.ca.com |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS13419
|
| 138.121.0.0/16 |
Ready Systems |
Mentor Graphics
www.mentorg.com |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS27595, AS16631, AS10912,
AS26978 |
| 138.252.0.0/16 |
SMORGONS Consolidated Industries |
Smorgon Industries / Smorgon Steel Group Ltd
smorgonsteel.com.au |
Marked Invalid then
transferred to APNIC whois. |
Possible |
Very Likely
Whois Hijacking |
unknown - see
this reference |
unknown |
| 139.81.0.0/16 |
GLI |
unknown
(was gli.com) |
Network Marked Invalid by
ARIN |
Active |
Probable
Whois Hijacking |
James Dyer - VMX/AdvisTech
(used by
Global Compass) |
AS22653 |
| 141.196.0.0/16 |
Ferranti International |
NONE (company out of business since 1993) |
Hijacker Info
Removed. IP block transferred to RIPE whois. |
Possible |
Probable
Whois Hijacking |
links to VMX/AdvisTech |
AS8143
|
| 142.105.0.0/16 |
Dominion Textile |
Galey & Lord Industries
www.gnlpromo.com |
IP Block Deleted from
Whois |
Active |
Very Likely
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTechSA) |
AS26797
|
142.247.0.0/16 |
MDS Labs, Ltd |
MDS INC
www.mdsintl.com |
Whois partially restored |
On-Alert |
Confirmed
Whois Hijacking |
Empire
Towers,
Uplink Networks / Speedmatrix |
AS29893 |
| 143.49.0.0/16 |
Inform Ltd |
unknown (INFORUM building in Atlanta) |
Network Marked Invalid by
ARIN |
Possible |
Probable
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
| 144.2.0.0/16 |
Publico B.V. |
Audax Publishing
www.audax.nl |
Hijacker Info Removed |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
| 144.128.0.0/16 |
DSI-Europe |
US Military - DoD
NIC
(was ARPANET project) |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS15188 |
| 144.176.0.0/15 |
Trafalgar House Group |
Aker Kvaerner
www.akerkvaerner.com |
Whois changed to new owner |
Past |
Confirmed
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech) |
|
144.179.0.0/16
144.180.0.0/15 |
Trafalgar House
Group |
Aker Kvaerner
www.akerkvaerner.com |
Whois changed to new owner |
Past |
Confirmed
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech) |
|
| 146.20.0.0/16 |
Erie Forge and Steel |
Erie Forge and Steel
www.erieforge.com
- now owned by -
Park Corporation
See also whemco.com |
Network Marked Invalid by
ARIN |
Active |
Confirmed
Whois Hijacking |
Omachonu
Ogali -
Information
Wave |
AS5042,
AS6216,
AS20473,
AS23131,
AS12277,
and more... |
| 146.100.0.0/16 |
Zust-Ambrosetti |
Zust-Ambrosetti
www.zust.it |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
unknown - see
this reference
(ip block used by Nlayer) |
AS4474 |
|
147.111.0.0/16 |
Trioving A/S |
Trioving AS
www.trioving.no |
Marked Invalid then transferred to RIPE whois. |
Possible |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS7438 |
|
148.3.0.0/16 |
IT Southern Limited |
Fujitsu
Services - UK
(formerly ICN.NET) |
Marked Invalid then transferred to RIPE whois. |
Possible |
Confirmed
Whois Hijacking |
Web Design House/ Starlan
(possibly actual hijackng done by Nick Geyer - VMX/AdvisTech) |
AS26857, AS27526 |
| 150.112.0.0/16 |
IDIAP |
IDIAP - www.idiap.ch |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Steve Rubin - Layer42 Networks |
AS8121 |
| 152.147.0.0/16 |
Housing and Construction Victoria |
Department of Human Services - Victoria, AU
www.dhs.vic.gov.au |
Network Marked Invalid by
ARIN |
Recent |
Unauthorized Announcements |
Xingchao Network Communications - Beijing
part of China Netcom network |
AS9929 |
|
155.73.0.0/16 |
Borealis A/S |
Borealis A/S
borealisgroup.com |
Hijacker Info Removed |
Recent |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
|
| 157.112.0.0/16 |
Systems Clipper Inc. |
Systems Clipper Inc.
www.clipper.co.jp |
Whois Restored to proper
owner |
Recent |
Confirmed
Whois Hijacking |
Empire
Towers |
AS7018 |
| 157.156.0.0/16 |
VMX INC |
Avaya - www.avaya.com
|
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS27255 |
| 157.237.0.0/16 |
SIMRAD |
Simrad
www.simrad.com |
Whois Restored to proper
owner |
Past |
Confirmed
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech) |
AS26797
|
| 158.181.0.0/16 |
Trafalgar House
Group |
Aker Kvaerner
www.akerkvaerner.com |
IP Block Deleted from
Whois |
Past |
Confirmed
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech) |
|
| 159.2.0.0/16 |
CIS Corp |
CIS Corporation
www.ciscorporation.com |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Gordon Lantz -
RouteX LTD |
AS23184 |
| 160.116.0.0/16 |
Affiliated Computing |
unknown
(was acs.co.za) |
Hijacker Info Removed |
Possible |
Probable
Whois Hijacking |
VMX/AdvisTech |
AS8143 |
| 160.122.0.0/16 |
Tredcor Ltd. |
Tredcor Ltd / Trentyre
www.tredcor.co.za
www.trentyre.co.za |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Hijacking done by people at
VMX/AdvisTech
(ip block used by Max
Sutter) |
AS3561,
AS22938 |
| 162.73.0.0/16 |
Information Technology |
Molson Breweries
www.molson.com |
Whois Restored to proper
owner |
Past |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS8143 |
|
162.141.0.0/16 |
James River Corporation of VA |
Georgia-Pacific
www.gp.com |
Network Marked Invalid by
ARIN |
Recent |
Unauthorized Announcements |
unknown - see
this reference |
AS2828 |
| 166.88.0.0/16 |
Caribineros
De Chile |
Carabineros de Chile
www.carabineros.cl |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Steve Rubin -
Layer42 Networks |
AS8121 |
| 167.179.0.0/16 |
Tower Group Ltd |
Tower Group Limited
www.towerlimited.com |
Whois Restored to proper
owner |
Recent |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
| 167.212.0.0/16 |
Shark Information Systems Inc |
ADP
www.adp.com |
Hijacker Info Removed |
Possible |
Very Likely
Whois Hijacking |
Nick Geyer - VMX/AdvisTech
(ip block used by
Netwave) |
AS26522 |
| 169.141.0.0/16 |
Thomson Trading Services |
Thomson Corporation
www.thomson.com |
Whois Restored to proper
owner |
Recent |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS3356 |
| 170.67.0.0/16 |
OMC - Hospital Information Systems |
OU Medical Center www.oumedcenter.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech) |
AS28706,
AS13419
|
| 170.208.0.0/16 |
ISD |
Los Angeles County
www.co.la.ca.us |
Whois Restored to proper
owner |
Past |
Confirmed
Whois Hijacking |
James Dyer - VMX/AdvisTech
(ip block used by Atrivo) |
AS27595 |
| 192.67.16.0/24 |
Macknife |
Macknife
www.macknife.org |
POC Marked Invalid by ARIN
but not removed |
Possible |
Very Likely
Whois Hijacking |
unknown (hijacking possibly related to VMX/AdvisTech) |
AS18747 |
| 192.83.107.0/24 |
EPM INC |
EPM INC
www.epm-inc.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
192.107.49.0/24 |
Computer General Electronic Design |
unknown (company likely out of business by 1995)
domain was: cged.co.uk |
IP Block Deleted from
Whois |
Possible |
Probable
Whois Hijacking |
unknown - see
this reference
(possible links to RackSource) |
AS30080 |
|
192.150.201.0/24 |
Grumman Systems Support |
Northrop Grumman northropgrumman.com
|
Network Marked Invalid by
ARIN |
On-Alert |
Confirmed
Whois Hijacking |
Chris Tibaldo
- RackSource |
N/A |
|
192.150.240.0/24 |
Grumman Systems Support |
Northrop Grumman northropgrumman.com
|
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Chris Tibaldo
- RackSource |
N/A |
|
192.153.43.0/24 |
Grumman Systems Support |
Northrop Grumman northropgrumman.com
|
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Chris Tibaldo
- RackSource |
AS10741 |
|
192.160.34.0/24 |
Zacson Corporation |
NONE (company out of business since 2000)
domain was: zacson.com |
Network Marked Invalid by
ARIN |
Active |
Probable
Whois Hijacking |
Chris Tibaldo
- RackSource |
AS30040,
AS10741 |
| 192.189.206.0/24 |
SAIC-ITER San Diego Co-Center |
ITER - www.iter.org
[current investigation] |
Domain Reregistered |
Hijacking Danger |
Very Likely
Whois Hijacking |
Taner Halicioglu
- 3SHEEP |
N/A |
| 196.4.167.0/24 |
Juta Information Network |
Jutastat (pty) Ltd
www.juta.co.za |
Hijacker Info Removed |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
| 198.133.130.0/24 |
SAIC-ITER San Diego Co-Center |
ITER - www.iter.org
[current investigation] |
Network Marked Invalid by
ARIN |
Hijacking Danger |
Very Likely
Whois Hijacking |
Taner Halicioglu
- 3SHEEP |
N/A |
| 198.133.167.0/24 |
Kudzu Computing |
unknown (possibly was kudzu.net) |
IP Block Deleted from
Whois |
Recent |
Probable
Whois Hijacking |
Taner Halicioglu
- 3SHEEP |
AS8121 |
| 198.135.69.0/24 |
E-Systems,
ECI Division |
Raytheon Systems
www.raytheon.com |
Network Marked Invalid by
ARIN |
Hijacking Danger |
Very Likely
Whois Hijacking |
Taner Halicioglu
- 3SHEEP |
N/A |
198.175.161.0/24 |
Lam Research Corp |
LAM Research Corp www.lamrc.com |
Whois Restored to proper
owner |
Recent |
Confirmed
Whois Hijacking |
MLEADS |
AS29994 |
| 198.175.234.0/24 |
Sharp Electronics Corporation |
Sharp Electronics
sharpelectronics.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Justin Sellers -
3SHEEP |
N/A |
198.178.249.0/24
198.178.250.0/23 |
Global Datacomm Systems |
Stuart Blake Tener |
(?) Domain Reregistered |
Hijacking Danger |
Confirmed
Whois Hijacking |
VMX/AdvisTech |
AS22938 |
| 198.182.182.0/24 |
Industrial Computer
Corporation |
Teradyne Inc
www.teradyne.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
AS16631 |
198.185.165.0/24
198.185.166.0/24 |
Merkert Enterprises Inc |
NONE (company currently being liquidated) |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
N/A |
| 198.186.134.0/24 |
Sharp Electronics Corporation |
Sharp Electronics
sharpelectronics.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Justin Sellers -
3SHEEP |
N/A |
198.190.131.0/24
198.190.132.0/24 |
Merkert Enterprises Inc |
NONE (company currently being liquidated) |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
N/A |
| 198.199.171.0/24 |
Merkert Enterprises Inc |
NONE (company currently being liquidated) |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
N/A |
| 198.204.0.0/21 |
GHR Services |
GHR Systems
www.ghrsystems.com |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
VMX/AdvisTech |
AS8143
|
| 199.26.176.0/24 |
Blue Granite Software |
NONE (company out of business since 2002)
Was: aceeng.com |
IP Block Deleted from
Whois |
Recent |
Probable
Whois Hijacking |
Omachonu
Ogali -
Information
Wave |
AS5042 |
| 199.60.128.0/20 |
TSC Shannock Corp |
Standard Broadcasting Corporation Limited
standardradio.com / sri.ca |
Network Marked Invalid by
ARIN |
Possible |
Very Likely
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
AS16631 |
| 199.60.102.0/24 |
Henning Associates |
William Henning |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Web Design House /
Starlan |
AS26857 |
| 199.74.235.0/24 |
Micro Integration Services |
NONE (company out of business since 1998)
Was: mis-mis.com |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
Omachonu
Ogali -
Information
Wave |
AS5042 |
199.79.160.0/23
199.79.162.0/24 |
Broderbund Software |
Riverdeep Inc
www.riverdeep.net |
Network Marked Invalid by
ARIN |
Possible |
Probable
Whois Hijacking |
Jon Christopherson
|
N/A |
| 199.88.185.0/22 |
International Trade Administration |
U.S. Dept of Commerce
www.doc.gov |
Whois Info
Unchanged |
Recent |
Unauthorized Announcements |
unknown - see
this reference |
AS13953 |
199.120.163.0/24
199.120.164.0/24 |
DSC Communications |
Alcatel
www.alcatel.com |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
INGS/Five-Elements |
AS26891 |
|
199.120.254.0/24 |
Atlanta Development Center, Inc |
NONE (company out of business since 1998) |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
Web Design House /
Starlan |
AS26857 |
| 199.166.200.0/22 |
ISISNET |
Baha Baydar
(was isisnet.com) |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
INGS Five-Elements |
AS26891 |
199.201.151.0/24
199.201.152.0/24 |
PRC Commercial Systems |
Northrop Grumman northropgrumman.com
(was LittonPRC prc.com) |
Network Marked Invalid by
ARIN |
Possible |
Confirmed
Whois Hijacking |
INGS/Five-Elements |
AS26891 |
|
199.245.138.0/24 |
BA Consulting |
Jeremy Allison
(@samba.org) |
IP block admin email
account used by hijacker |
Hijacking Danger |
Confirmed
Whois Hijacking |
unknown - see
this reference (possible links to RackSource) |
AS30080 |
| 199.248.199.0/24 |
Market Enterprises, Inc |
NONE (company currently being liquidated) |
IP Block Deleted from
Whois |
Recent |
Confirmed
Whois Hijacking |
Sasha Eysymontt
- 3SHEEP |
N/A |
| 201.118.64.0/20 |
LACNIC |
NONE (this ip block was never assigned) |
No whois record existed |
Recent |
Unauthorized Announcements |
[current investigation] |
AS19151 |
| 203.2.112.0/21 |
GEC Marconi Systems |
Marconi Corporation
www.marconi.com |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
Laurence Fagan |
AS21844
AS25847 |
| 203.4.160.0/24 |
Video Data Service |
Hotkey Internet
www.hotkey.net.au |
Whois modified by
hijackers |
Active |
Probable
Whois Hijacking |
Davestech - David Michael |
AS9826,
AS3491 |
| 203.15.67.0/24 |
Ampolex Limited |
ExxonMobil
www.mobil.com |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
Laurence Fagan |
AS21844 |
| 203.19.146.0/24 |
HCS Australia |
unknown
(was hcsaust.com.au) |
Whois modified by
hijackers |
Hijacking Danger |
Probable
Whois Hijacking |
Laurence Fagan |
AS25847 |
| 203.22.104.0/23 |
Ampolex Limited |
ExxonMobil
www.mobil.com |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
Laurence Fagan |
AS25847 |
| 203.24.88.0/23 |
Logical Solutions
Pty Ltd |
Fujitsu - Australia
www.fujitsu.com.au |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
Laurence Fagan |
AS25847 |
| 203.25.208.0/20 |
Vodafone Pty Ltd |
Vodafone - Australia
www.vodafone.com.au |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
Laurence Fagan |
AS25847 |
| 203.26.80.0/24 |
Motorola Wireless Data Group |
Motorolla - Australia
www.motorola.com.au |
Whois modified by
hijackers |
Hijacking Danger |
Very Likely
Whois Hijacking |
GSD/MTIF
Group |
AS703
(AS701) |
| 203.26.226.0/23 |
Source Pacific |
[current investigation] |
Whois modified by
hijackers |
Hijacking Danger |
Probable
Whois Hijacking |
Laurence Fagan |
AS21844 |
| 203.27.251.0/24 |
Scientific Education Supplies |
Scientific Educational Supplies Pty Ltd
www.ses.com.au |
|