The “/MediaSentry:P2P” is clearly non-official information, probably added by Surfer himself. Indeed, this article is pretty poor because it doesn’t separate facts from speculation and doesn’t clearly tell how each piece of information was determined. How were the IP addresses determined? Did you just pick any that send a packet to your machine?

Your best option is to go to whois.domaintools.com and use that to lookup WHOIS information. It’s much easier than doing the same manually with the whois tool, especially as it recurses automatically.

I don’t know whether 174.136.192.0/18 is MediaSentry/Defender but there’s definitely coming a lot of P2P spam from this range currently.

There’s actually little news here. Most if not all ranges are already well-known.

Also surfer must be using some bad/outdated WHOIS server or tool because 92.227.217.34 actually resolves. Again, just use whois.domaintools.com or dnsstuff.com.

Last but not least, if you’re computer reboots just because you don’t ban some IP address range, then you have some serious security issue with your computer and/or your operating system. Wouldn’t surprise me though if that was caused by a bug in PG2 itself. I don’t quite understand how the trojans ended up on your filesystem. I doubt that’s really related to the reboot because if anyone can go that far, you’d end up with a rootkit instead.

MediaSentry:64.125.152.0-64.125.152.255
MediaSentry:64.125.154.0-64.125.154.255
MediaSentry:64.125.182.0-64.125.182.255
MediaSentry:209.66.116.0-209.66.116.255
MediaSentry:209.133.73.0-209.133.73.31
MediaSentry:209.133.121.0-209.133.122.255
MediaSentry:209.133.126.64-209.133.126.95
MediaSentry:209.249.10.96-209.249.10.127
MediaSentry:209.249.36.0-209.249.36.255
MediaSentry:209.249.45.0-209.249.47.255
MediaSentry:209.249.114.0-209.249.114.255
MediaSentry:209.249.244.0-209.249.244.255

I would imagine because he received “HanseNet Telekommunikation/MediaSentry:P2P” and “TELECOMUNICACOES DE SAO PAULO/MediaDefender:P2P” respectively in the traceroute results of those addresses. I can’t imagine why these fields would identify them if they weren’t using the IPs at the time the results were generated.

Now, I realize you’re of the opinion that MediaDefender activities should be disregarded, but surfer’s including them. Personally, I think it certainly doesn’t hurt to do this.

I hope you mean this in the way “Bell Canada”, “Bell TV”, “Bell Internet”, and “Bell Mobility” are (supposedly) “not the same thing”.

MediaDefender does own MediaSentry now.
For the purposes of the topic on this page, findings for BOTH should be considered.

Suavemente, Inc. – MediaDefender:174.136.237.0-174.136.237.255
Suavemente, Inc. – MediaDefender:174.136.239.0-174.136.239.255
Suavemente, Inc. – MediaDefender:174.136.241.0-174.136.241.255
Suavemente, Inc. – MediaDefender:174.136.243.0-174.136.243.255
Suavemente, Inc. – MediaDefender:174.136.245.0-174.136.245.255
Suavemente, Inc. – MediaDefender:174.136.247.0-174.136.247.255
Suavemente, Inc. – MediaDefender:174.136.249.0-174.136.249.255
Suavemente, Inc. – MediaDefender:174.136.251.0-174.136.251.255
Suavemente, Inc. – MediaDefender:174.136.253.0-174.136.253.255
Suavemente, Inc. – MediaDefender:174.136.255.0-174.136.255.255
Abovenet – MediaSentry:209.249.10.96-209.249.10.127
Abovenet – MediaSentry:209.249.36.0-209.249.36.255
DarkStar Management Ltd:207.7.136.0-207.7.136.255
Unitedlayer, Inc. – DarkStar Management Ltd:67.221.161.128-67.221.161.255
Unitedlayer, Inc. – DarkStar Management Ltd:67.221.175.0-67.221.175.255
Open Hosting Ltd – DarkStar Management Ltd:89.238.149.130-89.238.149.255
Open Hosting Ltd – DarkStar Management Ltd:89.238.150.0-89.238.150.255
Open Hosting Ltd – DarkStar Management Ltd:89.238.151.0-89.238.151.127
Open Hosting Ltd – DarkStar Management Ltd:89.238.155.0-89.238.155.255
Open Hosting Ltd – DarkStar Management Ltd:89.238.156.0-89.238.156.255

and if you EVER move out of your mom’s basement, you will realize nobody uses ‘n00b’ anymore, retard.

stw

If you’re so “high on the food chain”, then ACT LIKE IT!
If there’s actually anything wrong with the information supplied so far, then just explain what that is.

I’m probably even higher than you on your imaginary food chain, yet, the queries surfer has pasted appear quite normal to me, regardless of what software gernerated them, and a few return headers contain reference to MediaDefender. And surfer did say he was posting more later.

You’ve got a obvious hard-on for surfer for some reason.
All you’re doing is ranting and demanding verification, which is really the next logical step anyway.
You haven’t offered anything constructive yourself on anything here, including why surfer should be discredited.

Bottom line: If you’ve got something useful to say from your vantage of “higher knowledge”, then say that, instead of being an outright ass.

One factor keeps me seriously watching this is – Suavemente.
That’s a very “dirty” company that makes its living by pretending to be different providers, hiding spammers and trojan distributors, and anyone else who wants to pay for a constantly-rotating IP origin, without regard to purpose. Naturally, tracing and proving transmissions from one particular user takes time and a certain amount of diligence. (One of the reasons most of us think the evidence extracted by MediaSentry should never have been accepted to prosecute an individual downloader is because it never contains the REPEATED instances of that one user in question. MediaSentry’s activities, however, will undoubtedly keep creating new instances as they continue to join torrent streams.)

I took the time to make a few screenshots and simple things like traceroutes and established connections using a TCP viewer, however I cannot confirm they are handing out trojans etc as thats not normally their objective, but who knows…

“And MediaSentry is currrently using:… blah, blah blah..
Sun May 24 2009 11:41:23.833 xxx -Blck- local:0 ->
174.136.245.48:10409 tcp4 ‘xxxxxxxx (15767)’ (Suavemente/
MediaDefender:P2P) : fiberconnection.demarc.cogentco.com”

Then he should substantiate it.

Been around the block. I’m higher up the food chain than this droid.

Surfer = rhetoric.

Who here hasn’t bought some shells or bounces or what-ever you wish to call it to either get bots or for other?

Surfer, that’s who.

Any voodoo IP according to this guy is the cartels.

Let me know when he deserves to be a bot master instead of a n00b.

I smell fear. among other stuff.

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL70118

Bear in mind, if Suavemente routinely claims to have removed these spammers, only to rotate the addresses in this block and allow them to continue, then I’m sure they’re pretty open to hiding someone like MediaSentry, for the right money.

Surfer’s point was that the activity was coming from Suavemente in the US.
Your WHOIS confirms this. I’m not sure what you’re trying to say. Nobody’s been saying the IP blocks belong to MediaSentry, if that’s what you’re contesting, but somebody has to provide them with the connection base, which Sauvemente obviously does. (As they do for so many “questionable companies” .

It’s no surprise to me that a “provider” like Suavemente would be involved, either knowingly or otherwise. They’ve been quite active in all sorts of underground internet activities….

http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK8310
(”under the radar” hosting seems to be their thing.)

Great article. Can’t wait for the next voodoo kiddie stuff you come up with that shows or proves anything.

174.136.245.47 is from United States(US) in region North America

Whois query for 174.136.245.47…

Results returned from whois.arin.net:

OrgName: Suavemente, INC.
OrgID: SUAVE-1
Address: 8675 Avenida Costa Norte Suite A
City: San Diego
StateProv: CA
PostalCode: 92154
Country: US

ReferralServer: rwhois://rwhois.suavemente.net:4321/

NetRange: 174.136.192.0 – 174.136.255.255
CIDR: 174.136.192.0/18
OriginAS: AS14572
NetName: SUAVEMENTE-SAN-DIEGO
NetHandle: NET-174-136-192-0-1
Parent: NET-174-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.SUAVEMENTE.NET
NameServer: NS2.SUAVEMENTE.NET
Comment: Please send all abuse reports to
Comment: suave-abuse@suavemente.net
RegDate: 2008-11-04
Updated: 2008-12-02

RAbuseHandle: SNO26-ARIN
RAbuseName: Suavemente Network Operations
RAbusePhone: +1-866-713-6594
RAbuseEmail: suave-noc@suavemente.net

RNOCHandle: SNO26-ARIN
RNOCName: Suavemente Network Operations
RNOCPhone: +1-866-713-6594
RNOCEmail: suave-noc@suavemente.net

RTechHandle: SNO26-ARIN
RTechName: Suavemente Network Operations
RTechPhone: +1-866-713-6594
RTechEmail: suave-noc@suavemente.net

OrgAbuseHandle: SNO26-ARIN
OrgAbuseName: Suavemente Network Operations
OrgAbusePhone: +1-866-713-6594
OrgAbuseEmail: suave-noc@suavemente.net

OrgNOCHandle: SNO26-ARIN
OrgNOCName: Suavemente Network Operations
OrgNOCPhone: +1-866-713-6594
OrgNOCEmail: suave-noc@suavemente.net

OrgTechHandle: SNO26-ARIN
OrgTechName: Suavemente Network Operations
OrgTechPhone: +1-866-713-6594
OrgTechEmail: suave-noc@suavemente.net

# ARIN WHOIS database, last updated 2009-05-25 19:10
# Enter ? for additional hints on searching ARIN’s WHOIS database.

http://www.suavemente.net/

Let me know when you can substantiate anything, aside from what the kiddie app tells you.

…stw!
: )

As long as people everywhere keep making more noise and refusing to buy their product, we may very well see them fade away some day.