Yeah, I see the singular one for our AS. =) We've know it for some time, but older lady is somewhat reluctant to spend money on getting someone to look at it. I spoke to her today and she has two machines, one new, one old. She's going to turn the old one off and hope that we won't see any more Shadowserver reports for it. Frank -----Original Message----- From: Andrew Fried [mailto:andrew.fried@gmail.com] Sent: Thursday, July 05, 2012 4:26 PM To: nanog@nanog.org Subject: Domain changer statistics by ASN As many of you probably know, the replacement nameservers operated on behalf of the FBI for the Domain Changer Working Group (DCWG) are scheduled to go down Sunday morning (GMT). Yesterday, July 4th, was a holiday in the US, and as such the US based activity hitting the DCWG nameservers was uncharacteristically low. The numbers seen in the rest of the world were normal. I'm attaching a report that shows the number of unique ip addresses that were seen hitting the DCWG nameservers from the 4th based on ASN. If you control one of the ASNs seen in the list please remind your folks that these numbers need to come down by Sunday. if you find this of use, I can regenerate new reports later this afternoon with data from the 5th. Andy -- Andrew Fried andrew.fried@gmail.com