- NANOG - lists.nanog.org

Re: Megaupload.com seized
by Michael Painter 20 Jan '12

20 Jan '12

james(a)smithwaysecurity.com wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC Huh? "65. It was further part of the Conspiracy that the content available onMegaupload.com and Megavideo.com was provided by known and unknown members of theMega Conspiracy, including several of the defendants, who uploaded infringing copies of copyrighted works onto computer servers leased by the Mega Conspiracy in North America tofurther the reproduction and distribution of copyrighted works; in particular, copyright infringingcontent was hosted by the Conspiracy on various servers in Toronto, Canada; Los Angeles,California; and Ashburn, Virginia (the last of which is in the Eastern District of Virginia)."

2 1

Re: Megaupload.com seized
by Ryan Gelobter 20 Jan '12

20 Jan '12

Most of there servers were located in the US. According to the indictment Megaupload leases about 25 petabytes of data storage from Carpathia to store content. They have over 1,000 servers and more than 525 of them are located in Virginia with Carpathia. They were paying Cogent around $1 million a month for bandwidth or hosting services. The U.S. District Court in Alexandria, Va., ordered the seizure of 18 domain names associated with the alleged Mega conspiracy. http://bit.ly/wx9DBE (google cache of justice.gov) Megastuff.com, Megaworld.com, Megaclicks.com, Megastuff.info, Megaclicks.org, Megaworld.mobi, Megastuff.org, Megaclick.us, Mageclick.com, HDmegaporn.com, Megavkdeo.com ,Megaupload.com, Megaupload.org, Megarotic.com On Thu, Jan 19, 2012 at 5:53 PM, james(a)smithwaysecurity.com < james(a)smithwaysecurity.com> wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC > > ----- Reply message ----- > From: "Paul Graydon" <paul(a)paulgraydon.co.uk> > To: <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 7:27 pm > > > On 01/19/2012 12:41 PM, Ryan Gelobter wrote: > > The megaupload.com domain was seized today, has anyone noticed > significant > > drops in network traffic as a result? > > > > http://www.scribd.com/doc/78786408/Mega-Indictment > > > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… > Ars Technica are implying it was quite a source of bandwidth usage within > companies. I'm curious, are any interesting charts on an ISP side? > > > http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate… > >

1 0

Megaupload.com seized
by Ryan Gelobter 20 Jan '12

20 Jan '12

The megaupload.com domain was seized today, has anyone noticed significant drops in network traffic as a result? http://www.scribd.com/doc/78786408/Mega-Indictment http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar…

6 5

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

Yes that's right, just would of slowed down the process. Sent from my HTC ----- Reply message ----- From: "Ishmael Rufus" <sakamura(a)gmail.com> To: "james(a)smithwaysecurity.com" <james(a)smithwaysecurity.com> Cc: <paul(a)paulgraydon.co.uk>, <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 7:56 pm That doesn't stop the power of our US government. On Thu, Jan 19, 2012 at 5:53 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC > > ----- Reply message ----- > From: "Paul Graydon" <paul(a)paulgraydon.co.uk> > To: <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 7:27 pm > > > On 01/19/2012 12:41 PM, Ryan Gelobter wrote: >> The megaupload.com domain was seized today, has anyone noticed significant >> drops in network traffic as a result? >> >> http://www.scribd.com/doc/78786408/Mega-Indictment >> http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… > Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? > > http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate… >

1 0

Re: Megaupload.com seized
by Ishmael Rufus 19 Jan '12

19 Jan '12

That doesn't stop the power of our US government. On Thu, Jan 19, 2012 at 5:53 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC > > ----- Reply message ----- > From: "Paul Graydon" <paul(a)paulgraydon.co.uk> > To: <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 7:27 pm > > > On 01/19/2012 12:41 PM, Ryan Gelobter wrote: >> The megaupload.com domain was seized today, has anyone noticed significant >> drops in network traffic as a result? >> >> http://www.scribd.com/doc/78786408/Mega-Indictment >> http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… > Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? > > http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate… >

1 0

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

Wow, what suprised the servers were, all located offshore. Sent from my HTC ----- Reply message ----- From: "Paul Graydon" <paul(a)paulgraydon.co.uk> To: <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 7:27 pm On 01/19/2012 12:41 PM, Ryan Gelobter wrote: > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate…

1 0

Re: Megaupload.com seized
by Ishmael Rufus 19 Jan '12

19 Jan '12

It's your typical FBI raid operation. Arrest everyone and seize all electronics. Then ask questions, weeks later. On Thu, Jan 19, 2012 at 5:44 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > You guys serous, when did the order come in to sezie the domain? > > Sent from my HTC > > ----- Reply message ----- > From: "Ryan Gelobter" <ryan.g(a)atwgpc.net> > To: "NANOG" <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 6:41 pm > > > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar…

1 0

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

You guys serous, when did the order come in to sezie the domain? Sent from my HTC ----- Reply message ----- From: "Ryan Gelobter" <ryan.g(a)atwgpc.net> To: "NANOG" <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 6:41 pm The megaupload.com domain was seized today, has anyone noticed significant drops in network traffic as a result? http://www.scribd.com/doc/78786408/Mega-Indictment http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar…

1 0

Re: Megaupload.com seized
by Scott Weeks 19 Jan '12

19 Jan '12

On Jan 19, 2012, at 5:41 PM, Ryan Gelobter wrote: > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… ----------------------------------------------------------------- ------------ derek(a)derekivey.com wrote: -------------- From: Derek Ivey <derek(a)derekivey.com> Interesting… it looks like they seized the servers and didn't touch DNS. -bash-3.00$ nslookup megaupload.com Non-authoritative answer: Name: megaupload.com Address: 174.140.154.22 Name: megaupload.com Address: 174.140.154.23 Name: megaupload.com Address: 174.140.154.24 Name: megaupload.com Address: 174.140.154.20 Name: megaupload.com Address: 174.140.154.21 DNS still points to Mega Upload's IPs. --------------------------------------------------------------- Collecting client IP addresses to send notices to? >;-) I notice other IPs in the range ( for example, .223 and .123) say the same thing about UDP/53. scott ku# nmap -P0 -sU -p U:53 174.140.154.22 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.21 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.20 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.223 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.123 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -A 174.140.154.20 All 1000 scanned ports on 174.140.154.20 are filtered Too many fingerprints match this host to give specific OS details

1 0

Whois 172/12
by Ted Fischer 19 Jan '12

19 Jan '12

Hi all, Tearing what's left of my hair out. A customer is getting scanned by a host claiming to be "172.0.1.216". I know this is bogus, but I want to go back to the customer with as much authoritative umph as I can (heaven forbid they just take my word). I'm pretty sure I read somewhere once that 172/12 was "reserved" or something like that. All I can find now is that 172/8 is "administered by ARIN". Lots of information on 172.16/12, but not a peep about 172/12. If anybody could provide some insight as to the allocation/non-allocation of this block, it would be much appreciated. Thanks. Ted Fischer

15 17