The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. SLC Security is now owned and operated by Jigsaw Security Enterprise. We are currently in process and as such this blog will eventually be taken offline and merged with Jigsaw Security resources.
Sunday, October 19, 2014
Today's Naughty List - 19 Oct 2014
It appears as though publishing the offenders has had an impact as the number of attempts we are now seeing is diminishing.
| 71.6.165.200 |  United States (USA) | California | San Diego | ||
| 77.241.99.130 |  Norway (NOR) | Rogaland | Sola | ||
| 165.165.41.94 |  South Africa (ZAF) | Gauteng | Johannesburg |
How external indicators can help investigators confirm an intrusion - A look at UPS
One of the worst things that we have noted recently is many companies complain when their domains and IP information shows up on blacklist. They are quick to contact you to get their entries removed but not so quick to take an in depth look at why they ended up on the blacklist in the first place.
One particular incident that comes to mind is the recent hacking that occurred at UPS store locations. About 10 days prior to the incident we started seeing UPS store locations on our blacklist. We did not know why they were showing up at first but it would become very clear much later. These host were attacking other third party entities and we started getting reports of all sorts of possible issues from port scans, spam, malware hosting, brute force attacks and other reports of malicious intent from the UPS store locations. At the time neither UPS or our organization realized what was occurring. All we noted was an uptick in activity from UPS store locations. Without hesitation we started seeing UPS and related domains showing up on blacklist and malware identification sites.
Keep in mind now that this was a full 10 days before UPS admitted that their store locations were compromised when we first noted the activity. We cannot go into the methodology we use to block or not block a domain but we can tell you that out of 174 data points we started seeing UPS on more and more our sources and our automated system finally blocked UPS domains once our threshold was met.
Immediately customers started complaining about not getting delivery notifications and not being able to access UPS resources. Many customers chose to unblock UPS not knowing that they were opening up themselves to additional threats. Some customers did not realize that farther attacks were coming. When the attacks came they were caught off guard.
This incident brought to light the problem that business owners are facing in securing their infrastructure. The balance between being able to function and being able to function during a security incident. Several of the companies that white listed UPS contacted us after the fact for information even though we have sent out an advisory prior that outlined the problem, and what was being done about it.
Predictive Algorithms
The key to knowing what is happening in advance of a threat is recognizing the symptoms. While we had no visibility into UPS directly as they are not a customer we did have visibility into 178+ other sources of information that yielded clues as to what was occurring. It seems that every time there is a breach there are certain tell-tale signs that are common. By looking for these signs we are able to easily make a determination on what the problem is at an organization that we don't have direct visibility into.
So what other companies in this space do similar things? One company that comes to mind is Cyveillance. Cyveillance is very good about scouring data sources and notifying you of information that pertains to your particular company or organization. What they are not good at is predictive analysis to determine what may happen. Cyveillance simply notifies you after the fact whereas we are notifying companies of activity prior to the issue becoming public. By noticing activity ahead of time we are able to notify the company much quicker as the indicators are coming in real-time into our intelligence platform.
One company that does have insight into predictive analysis would be Dell SecureWorks (DSW). DSW actually undertakes passive monitoring (similar to what we do) when they are alerted to an issue. They are very good at things like taking care of botnet issues, malware propagation and virus deconstruction. We do many of the same types of investigations but we do it based on data that we are able to access outside organizations. Our exact methods are not being disclosed but we will tell you that we utilize open source and do analysis on common elements such as domain names, IP addresses and MD5 hashes of suspected hackers, networks or files.
Getting notified of problems before there is an issue is what our system is designed to do. Utilizing open source software means anybody that knows how to extract entity information from feeds, build indexes on occurrences based on information of interest and creating alerting, analysis and forwarding technology to get the alerts in the hands of an analyst. The additional piece of this is providing feeds of information to your customers in which they can determine for themselves if something such as the number of news articles on a topic is high, or the number of external entities reporting problems from the companies address space has moved outside of their normal baseline.
We won't give you the secret's to how the system operates but we can tell you that it is operating based on some very unconventional analysis in advanced distributed and cloud computing environments specific to the task at hand.
So organizations we ask you to keep tabs on what others are reporting on your organization and try and understand why. There may be keys and clues to problems out there that you really should know about. Realize the the US Government contacted UPS first to alert them to an issue. The happened 9 days after UPS first appeared on our block list.
Conclusion
So understand that in the case of UPS we were correct to block them. We knew something wasn't quite right from the data that we were analyzing from our feeds. Before removing an entity from a blacklist make sure you understand the who, what, when, where and how they were put on the list in the first place. Without knowing these key indicators you can't really make an informed decision on the appropriate action to take. If all looks good you can take them off of your block list but make sure you understand the risk in doing so.
References:
http://www.cnet.com/news/the-ups-store-is-hacked-user-data-possibly-compromised/
http://www.pcmag.com/article2/0,2817,2463826,00.asp
http://www.entrepreneur.com/article/236714
One particular incident that comes to mind is the recent hacking that occurred at UPS store locations. About 10 days prior to the incident we started seeing UPS store locations on our blacklist. We did not know why they were showing up at first but it would become very clear much later. These host were attacking other third party entities and we started getting reports of all sorts of possible issues from port scans, spam, malware hosting, brute force attacks and other reports of malicious intent from the UPS store locations. At the time neither UPS or our organization realized what was occurring. All we noted was an uptick in activity from UPS store locations. Without hesitation we started seeing UPS and related domains showing up on blacklist and malware identification sites.
Keep in mind now that this was a full 10 days before UPS admitted that their store locations were compromised when we first noted the activity. We cannot go into the methodology we use to block or not block a domain but we can tell you that out of 174 data points we started seeing UPS on more and more our sources and our automated system finally blocked UPS domains once our threshold was met.
Immediately customers started complaining about not getting delivery notifications and not being able to access UPS resources. Many customers chose to unblock UPS not knowing that they were opening up themselves to additional threats. Some customers did not realize that farther attacks were coming. When the attacks came they were caught off guard.
This incident brought to light the problem that business owners are facing in securing their infrastructure. The balance between being able to function and being able to function during a security incident. Several of the companies that white listed UPS contacted us after the fact for information even though we have sent out an advisory prior that outlined the problem, and what was being done about it.
Predictive Algorithms
The key to knowing what is happening in advance of a threat is recognizing the symptoms. While we had no visibility into UPS directly as they are not a customer we did have visibility into 178+ other sources of information that yielded clues as to what was occurring. It seems that every time there is a breach there are certain tell-tale signs that are common. By looking for these signs we are able to easily make a determination on what the problem is at an organization that we don't have direct visibility into.
So what other companies in this space do similar things? One company that comes to mind is Cyveillance. Cyveillance is very good about scouring data sources and notifying you of information that pertains to your particular company or organization. What they are not good at is predictive analysis to determine what may happen. Cyveillance simply notifies you after the fact whereas we are notifying companies of activity prior to the issue becoming public. By noticing activity ahead of time we are able to notify the company much quicker as the indicators are coming in real-time into our intelligence platform.
One company that does have insight into predictive analysis would be Dell SecureWorks (DSW). DSW actually undertakes passive monitoring (similar to what we do) when they are alerted to an issue. They are very good at things like taking care of botnet issues, malware propagation and virus deconstruction. We do many of the same types of investigations but we do it based on data that we are able to access outside organizations. Our exact methods are not being disclosed but we will tell you that we utilize open source and do analysis on common elements such as domain names, IP addresses and MD5 hashes of suspected hackers, networks or files.
Getting notified of problems before there is an issue is what our system is designed to do. Utilizing open source software means anybody that knows how to extract entity information from feeds, build indexes on occurrences based on information of interest and creating alerting, analysis and forwarding technology to get the alerts in the hands of an analyst. The additional piece of this is providing feeds of information to your customers in which they can determine for themselves if something such as the number of news articles on a topic is high, or the number of external entities reporting problems from the companies address space has moved outside of their normal baseline.
We won't give you the secret's to how the system operates but we can tell you that it is operating based on some very unconventional analysis in advanced distributed and cloud computing environments specific to the task at hand.
So organizations we ask you to keep tabs on what others are reporting on your organization and try and understand why. There may be keys and clues to problems out there that you really should know about. Realize the the US Government contacted UPS first to alert them to an issue. The happened 9 days after UPS first appeared on our block list.
Conclusion
So understand that in the case of UPS we were correct to block them. We knew something wasn't quite right from the data that we were analyzing from our feeds. Before removing an entity from a blacklist make sure you understand the who, what, when, where and how they were put on the list in the first place. Without knowing these key indicators you can't really make an informed decision on the appropriate action to take. If all looks good you can take them off of your block list but make sure you understand the risk in doing so.
References:
http://www.cnet.com/news/the-ups-store-is-hacked-user-data-possibly-compromised/
http://www.pcmag.com/article2/0,2817,2463826,00.asp
http://www.entrepreneur.com/article/236714
The Problem in Limiting a Penetration Test
When approached by a business recently we were given a list of servers that the company did not want us to audit during the penetration testing phase of the audit. While this is not uncommon the shear number of servers on the list raised some questions. Most of the servers at the organization were billing systems and systems that stored customer records. Normally this is exactly the type of servers we want to check to make sure they are secure. The business justification in this case was that the servers were too sensitive to the corporate operations and that if any of the servers were inadvertently taken offline during the penetration testing that the company would lose money to the tune of up to $1 million per hour.
After completing the rest of the audit we had a sit down meeting with the management team and they would not budge on the rules of the engagement. In addition to this limitation they also stated that we were not to test any of their phone system during the audit. We agreed to play by their rules but we reminded them that hackers don't have to play by a set of rules and that by not testing these systems they would not know if there were problems that may be identified by the enemy at a later time. The company decided to assume the risk.
17 days after the penetration testing was completed the company detected strange activity on one of their systems. We were asked to do live forensics on the system and we immediately detected applications running in memory that were not supposed to be there. Luckily through troubleshooting we were able to confirm that the files in memory were not malicious but the increased memory utilization of the update processes (for a very popular program) were the cause of large amounts of memory being available on the system to the critical applications that were running on the system. 4 days after this discovery they company requested that the additional systems be audited.
I want to remind companies that hackers don't play by rules. They don't care if a critical system crashes or if your customer database is taken offline. In fact that's the very goal of some hackers out there. The only thing they want to do is disrupt your business and some hackers will take that as a win. When doing penetration testing it's important for the team to test systems as safely as possible but the risk of having a system go offline during testing is a real concern for business. It would be best to have this occur in a controlled maintenance window as opposed to a busy time of the day where those systems are bringing in revenue.
If a company limits the scope of testing they also limit the usefulness of the audit report. It's not possible to have the best of both worlds in this case and a controlled crash is a much better outcome than a loss of income due to a hacker discovering an unpatched system during a critical time. Get the most of your audit and make sure you have all areas tested completely and documented accurately. Then if something happens in the future at least you will know the risk associated with a particular system or platform.
If you are dead set on setting rules set time based rules for the audit. Review the test plan and understand what the auditors will be doing to test your security and at a minimum don't change your day to day operations just because you are going through an audit. You want to make sure your team is adequately prepared to deal with the results whatever they may be.
After completing the rest of the audit we had a sit down meeting with the management team and they would not budge on the rules of the engagement. In addition to this limitation they also stated that we were not to test any of their phone system during the audit. We agreed to play by their rules but we reminded them that hackers don't have to play by a set of rules and that by not testing these systems they would not know if there were problems that may be identified by the enemy at a later time. The company decided to assume the risk.
17 days after the penetration testing was completed the company detected strange activity on one of their systems. We were asked to do live forensics on the system and we immediately detected applications running in memory that were not supposed to be there. Luckily through troubleshooting we were able to confirm that the files in memory were not malicious but the increased memory utilization of the update processes (for a very popular program) were the cause of large amounts of memory being available on the system to the critical applications that were running on the system. 4 days after this discovery they company requested that the additional systems be audited.
I want to remind companies that hackers don't play by rules. They don't care if a critical system crashes or if your customer database is taken offline. In fact that's the very goal of some hackers out there. The only thing they want to do is disrupt your business and some hackers will take that as a win. When doing penetration testing it's important for the team to test systems as safely as possible but the risk of having a system go offline during testing is a real concern for business. It would be best to have this occur in a controlled maintenance window as opposed to a busy time of the day where those systems are bringing in revenue.
If a company limits the scope of testing they also limit the usefulness of the audit report. It's not possible to have the best of both worlds in this case and a controlled crash is a much better outcome than a loss of income due to a hacker discovering an unpatched system during a critical time. Get the most of your audit and make sure you have all areas tested completely and documented accurately. Then if something happens in the future at least you will know the risk associated with a particular system or platform.
If you are dead set on setting rules set time based rules for the audit. Review the test plan and understand what the auditors will be doing to test your security and at a minimum don't change your day to day operations just because you are going through an audit. You want to make sure your team is adequately prepared to deal with the results whatever they may be.
Today's Naughty List 18 Oct 2014
| 41.82.83.253 |  Senegal (SEN) | n/a | n/a | ||
| 67.23.248.228 | United States (USA) | Florida | Orlando | ||
| 175.44.58.223 |  China (CHN) | Fujian | Fuzhou | ||
| 173.254.255.131 | United States (USA) | California | Los Angeles | ||
| 217.196.22.150 |  Kazakstan (KAZ) | n/a | n/a | ||
| 173.254.255.134 | United States (USA) | California | Los Angeles | ||
| 217.118.93.100 |  Russian Federation (RUS) | Chuvashia | Cheboksary | ||
| 58.22.156.124 | China (CHN) | Fujian | Fuzhou | ||
| 175.42.86.54 | China (CHN) | Fujian | Fuzhou | ||
| 180.251.158.83 |  Indonesia (IDN) | Sumatera Utara | Makassar | ||
| 27.159.235.101 | China (CHN) | Fujian | Fuzhou | ||
| 181.66.157.110 |  Peru (PER) | n/a | n/a |
Saturday, October 18, 2014
HEADLINE: Health data thefts a continuing problem
We saw this headline today and we could not agree more. It appears through our research and the research of other firms that health related data is selling for a premium over credit card and other PII. It's no surprise the healthcare, insurance and medical establishments are large targets for hackers and malicious actors.
While we continue to see more breach data and news every day the good news is that people are starting to become aware. There are several data breach mandatory notification bills pending in congress and the number of businesses asking for audits is increasing. We remind clients that audits alone won't stop you from being attacked. What is required is proper training for your personnel, the correct security configurations in software and hardware devices, monitoring software, highly trained security monitoring staff and continued training and upgrades to security infrastructure.
While this headline caught our attention we should remind people that intellectual data theft occurs more often than actual data breaches yet companies fail to protect themselves against this threat. A company needs good people, a good security plan and procedures, auditing, training, monitoring and the right hardware and software to assist them in securing their valued data. And don't think that networks are the only place hackers attack. Don't forget to secure PBX systems, Personnel from social network attacks through verification procedures, cell phone and mobile devices through software and proper policy and anything else that could possibly be used to move data out of your organization. You do have a policy on thumb drives right? We know of one company that will fire on the spot any employee that is caught with any type of device capable of storing data (that includes cell phones, thumb drives, recordable media and cameras).
Maybe it's time the rest of us started protecting our data as this company does. What do you think?
While we continue to see more breach data and news every day the good news is that people are starting to become aware. There are several data breach mandatory notification bills pending in congress and the number of businesses asking for audits is increasing. We remind clients that audits alone won't stop you from being attacked. What is required is proper training for your personnel, the correct security configurations in software and hardware devices, monitoring software, highly trained security monitoring staff and continued training and upgrades to security infrastructure.
While this headline caught our attention we should remind people that intellectual data theft occurs more often than actual data breaches yet companies fail to protect themselves against this threat. A company needs good people, a good security plan and procedures, auditing, training, monitoring and the right hardware and software to assist them in securing their valued data. And don't think that networks are the only place hackers attack. Don't forget to secure PBX systems, Personnel from social network attacks through verification procedures, cell phone and mobile devices through software and proper policy and anything else that could possibly be used to move data out of your organization. You do have a policy on thumb drives right? We know of one company that will fire on the spot any employee that is caught with any type of device capable of storing data (that includes cell phones, thumb drives, recordable media and cameras).
Maybe it's time the rest of us started protecting our data as this company does. What do you think?
BREACH: SourceBooks.com and putmeinthestory.com
Today’s disclosure comes from online book seller, Sourcebooks. This is a
company that was founded by Dominique Raccah in 1987 and has grown
steadily since then. Unfortunately it does not appear that their
information security had managed to keep current.
It appears that we have a case of web security failing and another shopping cart getting compromised by unknown attackers.
SOURCE:
http://www.csoonline.com/article/2835291/data-breach/sourcebooks-suffers-credit-card-data-breach.html
Type: Business
Area: Online
First Noted: 18 Oct 2014 (Breach was earlier)
Location: Greenville, NC
Total Records:70+
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
It appears that we have a case of web security failing and another shopping cart getting compromised by unknown attackers.
SOURCE:
http://www.csoonline.com/article/2835291/data-breach/sourcebooks-suffers-credit-card-data-breach.html
Type: Business
Area: Online
First Noted: 18 Oct 2014 (Breach was earlier)
Location: Greenville, NC
Total Records:70+
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)
NEWS: One of the largest credit card hackers is identified
A notorious hacker known as “Rescator” is at the center of a major stolen credit card trading ring, a new report reveals.
Rescator is also connected to the 2013 credit card hack that affected up to 70 million Target hackers. His username is found in the source code of Kaptoxa, the malware program that hackers used to to gain access to Target’s point of sale systems and steal the credit card data.
QUOTE:
But it’s not just the SWIPED card site that Rescator operates on. He also runs his own illegal marketplaces for card data, including rescator.so, rescator.cc, rescator.la, among others.
Rescator is also connected to the 2013 credit card hack that affected up to 70 million Target hackers. His username is found in the source code of Kaptoxa, the malware program that hackers used to to gain access to Target’s point of sale systems and steal the credit card data.
QUOTE:
But it’s not just the SWIPED card site that Rescator operates on. He also runs his own illegal marketplaces for card data, including rescator.so, rescator.cc, rescator.la, among others.
NEWS: Facebook Can Tell You If Your Passwords Have Been Stolen Without Knowing What They Are
Note: It is interesting that Facebook is taking the same route that we are when it comes to notifying individuals of issues. We are working on solutions to be able to notify people when their information becomes public or is disclosed. Hopefully they give us some good ideas that we can incorporate in doing so.
ARTICLE:
Facebook believes you shouldn't have to worry about hacked web passwords.
It's there to protect you, it says.
After the news that hackers obtained 7 million Dropbox passwords by hacking a third-party service that works with Dropbox, Facebook says it has a plan to alert you if your password gets stolen.
Security engineer Chris Long says Facebook has been crawling around websites where hackers sell and expose passwords. Since most people use the same username/password combination for multiple websites, Facebook checks if any of the hacked passwords are used for Facebook accounts.
Read the full article at the source
ARTICLE:
Facebook believes you shouldn't have to worry about hacked web passwords.
It's there to protect you, it says.
After the news that hackers obtained 7 million Dropbox passwords by hacking a third-party service that works with Dropbox, Facebook says it has a plan to alert you if your password gets stolen.
Security engineer Chris Long says Facebook has been crawling around websites where hackers sell and expose passwords. Since most people use the same username/password combination for multiple websites, Facebook checks if any of the hacked passwords are used for Facebook accounts.
Read the full article at the source
Friday, October 17, 2014
STATS: Patient Data Disclosures as of 17 Oct 2014
And these are only the ones we know about.
We will continue to show the stats based on our OSINT-X data. As you can see 2014 is the year of the data breach. This chart shows only patient disclosures. Data Breach numbers are quite higher.
Today's Naughty List 17 Oct 2014
| IP | Country | Region | City | ||
|---|---|---|---|---|---|
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 109.202.9.80 | Russian Federation (RUS) | Altaisky krai | Barnaul | ||
| 122.52.136.58 |  Philippines (PHL) | n/a | n/a | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 62.1.239.200 |  Greece (GRC) | n/a | n/a | ||
| 65.111.183.31 | United States (USA) | Florida | Miami | ||
| 74.7.105.67 | United States (USA) | Texas | Dallas | ||
| 78.93.239.190 |  Saudi Arabia (SAU) | n/a | n/a | ||
| 81.198.214.48 |  Latvia (LVA) | Riga | Riga | ||
| 85.52.165.157 |  Spain (ESP) | n/a | n/a | ||
| 88.44.103.177 |  Italy (ITA) | n/a | n/a | ||
| 89.137.17.19 |  Romania (ROU) | n/a | n/a | ||
| 89.137.17.19 | Romania (ROU) | n/a | n/a | ||
| 91.236.75.99 |  Poland (POL) | n/a | n/a | ||
| 95.97.99.43 |  Netherlands (NLD) | n/a | n/a |
NEWS: Whisper App is Being Accused of Privacy Breach
Uncertainties are now circulating over the privacy of the new online social network application Whisper.
The Whisper is a new application has its roots in Southern California. It enables people to post messages anonymously.
This feature, however, is now taking negative feedbacks from some groups and other technology enthusiasts. They doubt on what Whisper has taken pride of which is the anonymity of the one posting the message.
In a report from The New York Times, it cited a report that The Guardian has accused Whisper of actually recording the data location of the users. Accordingly, even if there is no data locator, Whisper still enables to collect the area of its users.
References:
In Article
http://www.hallels.com/articles/9916/20141017/whisper-app-is-being-accused-of-privacy-breach.htm
The Whisper is a new application has its roots in Southern California. It enables people to post messages anonymously.
This feature, however, is now taking negative feedbacks from some groups and other technology enthusiasts. They doubt on what Whisper has taken pride of which is the anonymity of the one posting the message.
In a report from The New York Times, it cited a report that The Guardian has accused Whisper of actually recording the data location of the users. Accordingly, even if there is no data locator, Whisper still enables to collect the area of its users.
References:
In Article
http://www.hallels.com/articles/9916/20141017/whisper-app-is-being-accused-of-privacy-breach.htm
NEWS: Warren County Public Schools system hacked via DATABREACHES.NET via OSINT-X Newswires
A Warren County Public Schools student gained access to electronic files that contain personally identifiable information.
See the original article here:
http://www.databreaches.net/ky-warren-county-public-schools-system-hacked/
See the original article here:
http://www.databreaches.net/ky-warren-county-public-schools-system-hacked/
NEWS: Police: Traffic stop near Houston may be break in Home Depot data breach case via KTRK
A traffic stop in just north of Houston may be a major break in a massive Home Depot data breach.
According to Patton Village police, on Saturday, officers pulled over a vehicle near Highway 59 and State Highway 242 that they say was traveling 10 miles per hour over the speed limit.
Two men inside the vehicle were from Michigan. During the traffic stop, officers noticed some information from the pair wasn't adding up.
They say the men were in possession of what they believed to be criminal instruments that, after a preliminary investigation, were determined to be related to the Home Depot data breach that got national attention a couple months ago.
Both men were arrested and charged with possession of criminal devices. They're currently in the Montgomery County Jail.
SOURCE:
http://abc13.com/business/police-traffic-stop-near-houston-may-be-break-in-data-breach-case/353961/
Includes video news report.
According to Patton Village police, on Saturday, officers pulled over a vehicle near Highway 59 and State Highway 242 that they say was traveling 10 miles per hour over the speed limit.
Two men inside the vehicle were from Michigan. During the traffic stop, officers noticed some information from the pair wasn't adding up.
They say the men were in possession of what they believed to be criminal instruments that, after a preliminary investigation, were determined to be related to the Home Depot data breach that got national attention a couple months ago.
Both men were arrested and charged with possession of criminal devices. They're currently in the Montgomery County Jail.
SOURCE:
http://abc13.com/business/police-traffic-stop-near-houston-may-be-break-in-data-breach-case/353961/
Includes video news report.
Thursday, October 16, 2014
Today's Naughty List 16 Oct 2014
Today's naughty list
Where are they from?
Where are they from?
| 195.56.77.65 |  Europe (EU) | n/a | n/a | ||
| 88.44.103.177 | Italy (ITA) | n/a | n/a | ||
| 65.111.183.31 | United States (USA) | Florida | Miami | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 195.56.77.65 | Europe (EU) | n/a | n/a | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 88.44.103.177 | Italy (ITA) | n/a | n/a | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 94.102.49.237 | Netherlands (NLD) | n/a | n/a | ||
| 94.102.49.237 | Netherlands (NLD) | n/a | n/a | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 88.249.121.158 |  Turkey (TUR) | Mugla | Mugla | ||
| 85.52.165.157 | Spain (ESP) | n/a | n/a | ||
| 88.249.121.158 | Turkey (TUR) | Mugla | Mugla | ||
| 81.198.214.48 | Latvia (LVA) | Riga | Riga | ||
| 81.198.214.48 | Latvia (LVA) | Riga | Riga | ||
| 88.249.121.158 | Turkey (TUR) | Mugla | Mugla | ||
| 85.52.165.157 | Spain (ESP) | n/a | n/a | ||
| 78.93.239.190 | Saudi Arabia (SAU) | n/a | n/a | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg | ||
| 165.165.41.94 | South Africa (ZAF) | Gauteng | Johannesburg |
Subscribe to:
Posts (Atom)