Hijacked IPs

CompleteWhois
Hijacked IPs
Bogon IPs
Invalid Whois Data
Statistics
Other Projects
Premium Services
Mail Lists
About CompleteWhois
Search Website
Feedback

If you would like to receive information on major updates to completewhois and related projects, please enter your email below to be added to our announcements mail list:

Hijacked List Hijackers Disputes Site Updates Hijacked Q&A Status Codes Report Form

This webpage is a completewhois side-project that deals with investigations of hijacked ip blocks. If you do not know what hijacked ips or even if you do know but are visiting this webpage for a first time, we strongly advise you read "Hijacked IPs Q/A" which explains in detail what hijacked IPs are and what can be done about it. 

We also maintain separate list of "hijackers" on this page - this has the same ip blocks listed here but grouped by hijackers and it is a recommended webpage to see after this one for those who are on this website for the first time. If you are searching for particular information you can also use our search engine (which includes ability to search in all hijacked ip block investigation evidence files)

If you believe particular large ip block (directly allocated or assigned by RIR) may be hijacked and is not  used by proper company currently, you can report it on this form (also use the same form if you have any new information regarding blocks already listed below, but if you directly represent the company listed as having hijacked or used ip block below and it was never hijacked, and its use and reported whois  changes were done per your request, then use the disputes procedures to challenge this listing)

Regarding various status codes and how we decide if particular ip block is listed here or not, please see this "status code" page.
Available here is text-only file that includes ip blocks from below with active, possible, hijacking-danger status, and we also provide ability to check if ip is in that above file by dns at hijacked.dnsiplists.completewhois.com, for more information about it, please see this page

Separately in this file you can find exactly which ip blocks from the ones in the list below are actively used on the net right now (updated daily)

IP Block and
link to results of our investigation
Organization Name Listed in Whois
(or to which it was assigned originally if not currently listed)
Proper Owner for this  IP block Current Whois Status Hijacking
Activity
Type of hijacking Responsible Hijacker Groups and/or  Recent Users of IP Block ASNs that are or were improperly announcing  
IP block*
24.227.0.0/19 Auburn Cable Vision Inc Adelphia Cable
www.adelphia.net
Domain Reregistered  Past Unintentional
Whois Hijacking
IP block used properly,  but domain is reregistered N/A
34.0.0.0/8 Halliburton Company Halliburton Oil Company
www.halliburton.com
Whois Restored to proper owner Past Confirmed
Whois Hijacking
RouteX LTD / Gordon Lantz  N/A
64.79.128.0/19 WorkNet Communications NuVox Communications
www.nuvox.com
IP Block Deleted from Whois Recent Probable
Whois Hijacking
VMX/AdvisTech AS13768, AS14492

66.51.128.0/20
Novo Networks Novo Networks (Dallas) www.novonetworks.net IP Block Deleted from Whois Active Probable
Whois Hijacking
JIBH.NET AS23401, AS8001
66.135.64.0/19 First Internet NONE (company out of business from  2003)
  Was: firstnethou.com 
IP Block Deleted from Whois Hijacking Danger Probable
Whois Hijacking
VMX/AdvisTech AS21844
128.13.0.0/16 DSI-South US Military - DoD NIC
(was ARPANET project)
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech AS15188
131.157.0.0/16 Librascope Corporation Lockheed Martin
www.lmco.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech AS20290
132.220.0.0/16 Sobeco Group, Inc Mourneu Sobeco
www.morneausobeco.ca
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
unknown - see this reference N/A
132.232.0.0/16 BIS Mackintosh Strategy Analytics
strategyanalytics.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Brad Martin - Reversed Networks AS16631
134.33.0.0/16 Codex Corporation Motorola
www.mot.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech AS8143,
AS27255
137.171.0.0/16 Systems Center Inc Computer Associates
www.ca.com
IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
VMX/AdvisTech

AS13419

138.121.0.0/16 Ready Systems Mentor Graphics
www.mentorg.com
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
VMX/AdvisTech AS27595, AS16631, AS10912,
AS26978
138.252.0.0/16 SMORGONS Consolidated Industries Smorgon Industries / Smorgon Steel Group Ltd
smorgonsteel.com.au
Marked  Invalid then transferred to APNIC whois.  Possible Very Likely
Whois Hijacking
unknown - see this reference unknown
139.81.0.0/16 GLI unknown
(was gli.com)
Network Marked Invalid by ARIN Active Probable
Whois Hijacking
James Dyer - VMX/AdvisTech
(used by Global Compass
AS22653
141.196.0.0/16 Ferranti International NONE (company out of business since 1993) Hijacker Info Removed.  IP block transferred to RIPE whois.  Possible Probable
Whois Hijacking
links to VMX/AdvisTech

AS8143

142.105.0.0/16 Dominion Textile Galey & Lord Industries
www.gnlpromo.com
IP Block Deleted from Whois Active Very Likely
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTechSA)

AS26797


142.247.0.0/16
MDS Labs, Ltd MDS INC
www.mdsintl.com
Whois partially restored On-Alert Confirmed
Whois Hijacking
Empire Towers,
Uplink Networks / Speedmatrix
AS29893
143.49.0.0/16 Inform Ltd unknown (INFORUM building in Atlanta) Network Marked Invalid by ARIN Possible Probable
Whois Hijacking
VMX/AdvisTech

AS8143

144.2.0.0/16 Publico B.V. Audax  Publishing
www.audax.nl 
Hijacker Info Removed Possible Very Likely
Whois Hijacking
VMX/AdvisTech

AS8143

144.128.0.0/16 DSI-Europe US Military - DoD NIC
(was ARPANET project)
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech AS15188
144.176.0.0/15 Trafalgar House Group Aker Kvaerner
www.akerkvaerner.com
Whois changed to new owner Past Confirmed
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech)
144.179.0.0/16
144.180.0.0/15
Trafalgar House
Group
Aker Kvaerner
www.akerkvaerner.com
Whois changed to new owner Past Confirmed
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech)
146.20.0.0/16 Erie Forge and Steel Erie Forge and Steel
www.erieforge.com
- now owned by -
Park Corporation
See also whemco.com
Network Marked Invalid by ARIN Active Confirmed
Whois Hijacking
Omachonu Ogali - 
Information Wave
AS5042,
AS6216,
AS20473,
AS23131,
AS12277,
and more...
146.100.0.0/16 Zust-Ambrosetti

Zust-Ambrosetti
www.zust.it

Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
unknown - see this reference
(ip block used by Nlayer)
AS4474
147.111.0.0/16 Trioving A/S Trioving AS
www.trioving.no
Marked  Invalid then transferred to RIPE whois.  Possible Confirmed
Whois Hijacking
VMX/AdvisTech AS7438
148.3.0.0/16 IT Southern Limited Fujitsu Services - UK
(formerly ICN.NET)
Marked  Invalid then transferred to RIPE whois.  Possible Confirmed
Whois Hijacking
Web Design House/ Starlan
(possibly actual hijackng done by Nick Geyer - VMX/AdvisTech
AS26857, AS27526
150.112.0.0/16 IDIAP IDIAP - www.idiap.ch Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Steve Rubin - Layer42 Networks AS8121
152.147.0.0/16 Housing and Construction Victoria Department of Human Services - Victoria, AU
www.dhs.vic.gov.au
Network Marked Invalid by ARIN Recent Unauthorized Announcements Xingchao Network Communications - Beijing
part of China Netcom network
AS9929
155.73.0.0/16 Borealis A/S Borealis A/S
borealisgroup.com
Hijacker Info Removed Recent Very Likely
Whois Hijacking
VMX/AdvisTech
AS8143
157.112.0.0/16 Systems Clipper Inc. Systems Clipper Inc.
www.clipper.co.jp
Whois Restored to proper owner Recent Confirmed
Whois Hijacking
Empire Towers AS7018
157.156.0.0/16 VMX INC Avaya - www.avaya.com IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
VMX/AdvisTech AS27255
157.237.0.0/16 SIMRAD Simrad
www.simrad.com
Whois Restored to proper owner Past Confirmed
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech)

AS26797

158.181.0.0/16 Trafalgar House
Group
Aker Kvaerner
www.akerkvaerner.com
IP Block Deleted from Whois Past Confirmed
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech)
159.2.0.0/16 CIS Corp CIS Corporation
www.ciscorporation.com 
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Gordon Lantz - RouteX LTD AS23184
160.116.0.0/16 Affiliated Computing  unknown
(was acs.co.za)
Hijacker Info Removed Possible Probable
Whois Hijacking
VMX/AdvisTech AS8143
160.122.0.0/16 Tredcor Ltd. Tredcor Ltd / Trentyre
www.tredcor.co.za
www.trentyre.co.za
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Hijacking done by people at
VMX/AdvisTech
(ip block used by Max Sutter)
AS3561,
AS22938
162.73.0.0/16 Information Technology Molson Breweries
www.molson.com
Whois Restored to proper owner Past Confirmed
Whois Hijacking
VMX/AdvisTech AS8143
162.141.0.0/16 James River Corporation of VA Georgia-Pacific
www.gp.com
Network Marked Invalid by ARIN Recent Unauthorized Announcements unknown - see this reference AS2828
166.88.0.0/16 Caribineros 
De Chile
Carabineros de Chile
www.carabineros.cl
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Steve Rubin - Layer42 Networks AS8121
167.179.0.0/16 Tower Group Ltd Tower Group Limited
www.towerlimited.com
Whois Restored to proper owner Recent Confirmed
Whois Hijacking
VMX/AdvisTech

AS8143

167.212.0.0/16 Shark Information Systems Inc ADP
www.adp.com
Hijacker Info Removed Possible Very Likely
Whois Hijacking
Nick Geyer - VMX/AdvisTech
(ip block used by Netwave)
AS26522
169.141.0.0/16 Thomson Trading Services Thomson Corporation
www.thomson.com
Whois Restored to proper owner Recent Confirmed
Whois Hijacking
VMX/AdvisTech AS3356
170.67.0.0/16 OMC - Hospital Information Systems OU  Medical Center www.oumedcenter.com Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Josh Harris / MassiveISP.Net (links to VMX/AdvisTech)

AS28706,
AS13419

170.208.0.0/16 ISD Los Angeles County
www.co.la.ca.us
Whois Restored to proper owner Past Confirmed
Whois Hijacking
James Dyer - VMX/AdvisTech
(ip block used by Atrivo)
AS27595
192.67.16.0/24 Macknife Macknife
www.macknife.org
POC Marked Invalid by ARIN but not removed Possible Very Likely
Whois Hijacking
unknown (hijacking possibly related to VMX/AdvisTech) AS18747
192.83.107.0/24 EPM INC EPM INC
www.epm-inc.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech

AS8143


192.107.49.0/24
Computer General Electronic Design unknown (company likely out of business by 1995)
 domain was: cged.co.uk
IP Block Deleted from Whois Possible Probable
Whois Hijacking
unknown - see this reference
(possible links to RackSource)
AS30080
192.150.201.0/24 Grumman Systems Support Northrop Grumman northropgrumman.com Network Marked Invalid by ARIN On-Alert Confirmed
Whois Hijacking
Chris Tibaldo - RackSource N/A
192.150.240.0/24 Grumman Systems Support Northrop Grumman northropgrumman.com Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Chris Tibaldo - RackSource N/A
192.153.43.0/24 Grumman Systems Support Northrop Grumman northropgrumman.com Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Chris Tibaldo - RackSource AS10741
192.160.34.0/24 Zacson Corporation NONE (company out of business since 2000)
 domain was: zacson.com
Network Marked Invalid by ARIN Active Probable
Whois Hijacking
Chris Tibaldo - RackSource AS30040,
AS10741
192.189.206.0/24 SAIC-ITER San Diego Co-Center ITER - www.iter.org
[current investigation]
Domain Reregistered  Hijacking Danger Very Likely
Whois Hijacking
Taner Halicioglu - 3SHEEP N/A
196.4.167.0/24 Juta Information Network Jutastat (pty) Ltd
www.juta.co.za
Hijacker Info Removed Possible Very Likely
Whois Hijacking
VMX/AdvisTech

AS8143

198.133.130.0/24 SAIC-ITER San Diego Co-Center ITER - www.iter.org
[current investigation]
Network Marked Invalid by ARIN Hijacking Danger Very Likely
Whois Hijacking
Taner Halicioglu - 3SHEEP N/A
198.133.167.0/24 Kudzu Computing unknown (possibly was kudzu.net) IP Block Deleted from Whois Recent Probable
Whois Hijacking
Taner Halicioglu - 3SHEEP AS8121
198.135.69.0/24 E-Systems,
ECI Division
Raytheon Systems
www.raytheon.com
Network Marked Invalid by ARIN Hijacking Danger Very Likely
Whois Hijacking
Taner Halicioglu - 3SHEEP N/A

198.175.161.0/24
Lam Research Corp LAM Research Corp www.lamrc.com Whois Restored to proper owner Recent Confirmed
Whois Hijacking
MLEADS AS29994
198.175.234.0/24 Sharp Electronics Corporation Sharp Electronics
sharpelectronics.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Justin Sellers - 3SHEEP N/A
198.178.249.0/24
198.178.250.0/23
Global Datacomm Systems Stuart Blake Tener (?) Domain Reregistered Hijacking Danger Confirmed
Whois Hijacking
VMX/AdvisTech AS22938
198.182.182.0/24 Industrial Computer Corporation

Teradyne Inc
www.teradyne.com

Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Sasha Eysymontt - 3SHEEP AS16631
198.185.165.0/24
198.185.166.0/24
Merkert Enterprises Inc NONE (company currently being liquidated) IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
Sasha Eysymontt - 3SHEEP N/A
198.186.134.0/24 Sharp Electronics Corporation Sharp Electronics
sharpelectronics.com
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Justin Sellers - 3SHEEP N/A
198.190.131.0/24
198.190.132.0/24
Merkert Enterprises Inc NONE (company currently being liquidated) IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
Sasha Eysymontt - 3SHEEP N/A
198.199.171.0/24 Merkert Enterprises Inc NONE (company currently being liquidated) IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
Sasha Eysymontt - 3SHEEP N/A
198.204.0.0/21 GHR Services

GHR Systems
www.ghrsystems.com

Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
VMX/AdvisTech

AS8143

199.26.176.0/24 Blue Granite Software NONE (company out of business since 2002)
 Was: aceeng.com
IP Block Deleted from Whois Recent Probable
Whois Hijacking
Omachonu Ogali - 
Information Wave
AS5042
199.60.128.0/20 TSC Shannock Corp Standard Broadcasting Corporation Limited
standardradio.com / sri.ca
Network Marked Invalid by ARIN Possible Very Likely
Whois Hijacking
Sasha Eysymontt - 3SHEEP AS16631
199.60.102.0/24 Henning Associates William Henning Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Web Design House / Starlan AS26857
199.74.235.0/24 Micro Integration Services NONE (company out of business since 1998)
 Was: mis-mis.com
IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
Omachonu Ogali - 
Information Wave
AS5042
199.79.160.0/23
199.79.162.0/24
Broderbund Software Riverdeep Inc
www.riverdeep.net
Network Marked Invalid by ARIN Possible Probable
Whois Hijacking

Jon Christopherson

N/A
199.88.185.0/22 International Trade Administration U.S. Dept of Commerce
www.doc.gov
Whois Info
Unchanged
Recent Unauthorized Announcements unknown - see this reference AS13953
199.120.163.0/24
199.120.164.0/24
DSC Communications Alcatel
www.alcatel.com
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
INGS/Five-Elements AS26891
199.120.254.0/24 Atlanta Development Center, Inc NONE (company out of business since 1998) Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
Web Design House / Starlan AS26857
199.166.200.0/22 ISISNET Baha Baydar
(was isisnet.com)
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
INGS Five-Elements AS26891
199.201.151.0/24
199.201.152.0/24
PRC Commercial Systems Northrop Grumman northropgrumman.com
(was LittonPRC prc.com)
Network Marked Invalid by ARIN Possible Confirmed
Whois Hijacking
INGS/Five-Elements AS26891
199.245.138.0/24 BA Consulting Jeremy Allison
(@samba.org)
IP block admin email account used by hijacker Hijacking Danger Confirmed
Whois Hijacking
unknown - see this reference (possible links to RackSource) AS30080
199.248.199.0/24 Market Enterprises, Inc NONE (company currently being liquidated) IP Block Deleted from Whois Recent Confirmed
Whois Hijacking
Sasha Eysymontt - 3SHEEP N/A
201.118.64.0/20 LACNIC  NONE (this ip block was never assigned) No whois record existed Recent Unauthorized Announcements [current investigation] AS19151
203.2.112.0/21 GEC Marconi Systems Marconi Corporation
www.marconi.com
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
Laurence Fagan AS21844
AS25847
203.4.160.0/24 Video Data Service Hotkey Internet
www.hotkey.net.au
Whois modified by hijackers Active Probable
Whois Hijacking
Davestech - David Michael AS9826,
AS3491
203.15.67.0/24 Ampolex Limited ExxonMobil
www.mobil.com
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
Laurence Fagan AS21844
203.19.146.0/24 HCS Australia unknown 
(was hcsaust.com.au)
Whois modified by hijackers Hijacking Danger Probable
Whois Hijacking
Laurence Fagan AS25847
203.22.104.0/23 Ampolex Limited ExxonMobil
www.mobil.com
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
Laurence Fagan AS25847
203.24.88.0/23 Logical Solutions 
Pty Ltd
Fujitsu - Australia
www.fujitsu.com.au
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
Laurence Fagan AS25847
203.25.208.0/20 Vodafone Pty Ltd Vodafone - Australia
www.vodafone.com.au
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
Laurence Fagan AS25847
203.26.80.0/24 Motorola Wireless Data Group Motorolla - Australia
www.motorola.com.au
Whois modified by hijackers Hijacking Danger Very Likely
Whois Hijacking
GSD/MTIF Group AS703
(AS701)
203.26.226.0/23 Source Pacific [current investigation] Whois modified by hijackers Hijacking Danger Probable
Whois Hijacking
Laurence Fagan AS21844
203.27.251.0/24 Scientific Education Supplies Scientific Educational Supplies Pty Ltd
www.ses.com.au