NSA Resources For Rapid Targeting and Routing Analysis

A Cryptome DVD is offered by Cryptome. Donate $25 for a DVD of the Cryptome 10+-years archives of 39,000 files from June 1996 to December 2006 (~4.1 GB). Click Paypal or mail check/MO made out to John Young, 251 West 89th Street, New York, NY 10024. Archives include all files of cryptome.org, cryptome2.org, jya.com, cartome.org, eyeball-series.org and iraq-kill-maim.org. Cryptome offers with the Cryptome DVD an INSCOM DVD of about 18,000 pages of counter-intelligence dossiers declassified by the US Army Information and Security Command, dating from 1945 to 1985. No additional contribution required -- $25 for both. The DVDs will be sent anywhere worldwide without extra cost.

2 June 2007

nsa-ip-blocks.htm   + More NSA IP Blocks in CIDR Format Update         May 28, 2007

A sends:

Subject: NSA Resources For Rapid Targeting and Routing Analysis
Date: Sat,  2 Jun 2007 08:53:31 +0200 (CEST)

In order to send ICMP or TCP packets (or spoofed UDP packets), "pinging" for rapid 
acquisition and analysis of a target IP's packet traffic routing data at the Internet 
IXP-level, NSA has primarily used, starting earlier than early 2006, the following 
IP ranges, with identification information where available, for initial rapid target 
"pings." Other resources for subsequent tracking of a target's IP packet traffic have 
been previously reported via Cryptome.org.

NetRange:   216.218.128.0 - 216.218.255.255
CIDR:       216.218.128.0/17
Hurricane Electric
760 Mission Court
Fremont CA 94539
US
DNS:
ns3.he.net [216.218.132.2]sandy.thehideout.net.
ns2.he.net [216.218.131.2]sandy.thehideout.net
ns1.he.net [216.218.130.2]sandy.thehideout.net. 
Previously, while using the name of "FAST COLOCATION SERVICES," with an address in 
Wasilla AK (Alaska), USA; DNS was:
sandy2.thehideout.net [72.52.64.32]
sandy.thehideout.net [72.52.64.32]

Interestingly enough, NSA has made active use (through means of acquisition for which 
is unknown) the following Chinese (PRC) (APNIC assigned) IP resources:

218.27.0.0 - 218.27.255.255
CIDR/Netmask:218.27.0.0/16
CNCGROUP Jilin province network
Address: NO.3535,Renmin Street, ChangChun ,
Jilin province , 130021 , P.R. China
DNS:
ns.jlccptt.net.cn [202.98.0.68]
ns2.jljlptt.net.cn [202.98.5.68]

220.189.242.0 - 220.189.242.7
YUEQING-CONSTRUCTION-CENTER
Wenzhou,Zhejiang CN
DNS:
ns.zjnbptt.net.cn [202.96.104.18]	
dns-noc.zjhzptt.net.cn [202.96.103.36]

220.166.64.0 - 220.166.65.255
CHINANET SICHUAN
address:     No.72,Wen Miao Qian Str Chengdu SiChuan PR China
DNS:
ns2.sc163.net [61.139.79.28]
ns1.sc163.net [61.139.79.18]

61.220.0.0 - 61.227.255.255
Chunghwa Telecom Co., Ltd.
Taipei 100, Taiwan/R.O.C.
DNS:
ipdns2.hinet.net [168.95.1.14]
ipdns1.hinet.net [168.95.192.14]

Periodically, NSA uses IP resources leased from:
61.78.0.0 - 61.85.255.255
KOREA TELECOM
DNS:
rev2.kornet.net [211.216.50.180]	
rev1.kornet.net [211.216.50.170]