UPDATE 2014-03-29: fixed broken links to the gzip’d CSV and MySQL files.
In EXCLUSIVE: Leaked “RSA dump” appears authentic at Risky.biz I read that on August 15th 2011 the “RSA Employee #15666” dump was posted here. I have no opinion on its authenticity. Please read the post at Risky.biz for analysis; I merely provide additional data and stats here.
The original dump contains 870 entries consisting of:
2. IP address
I enriched the data by adding:
3. my own lookup of the A-record for (1)
4. my own lookup of the PTR-record for (2)
5. GeoIP data for (1) = country, state, city, zip, GPS, organization
6. IP2ASN mapping for (1) = ASN, network description via whois.cymru.com
All lookups were run from an IP address in AS1103 (SURFNET-NL) on August 18th 2011 at 20:00-21:30 UTC+2. I mention the latter because the DNS/AS situation may have been deliberately changed since the dump was publicly posted (August 15th) or announced (August 18th).
Here is the enriched dump (SSL cert sig should be 01:00:00:00:00:01:1C:9E:A3:54:3F):
DO NOT TRUST MY DATA. VERIFY IT. If the data or stats are wrong, please inform me (Twitter: @mrkoot or e-mail: koot=>uva.nl). I will change this blogpost to reflect advancing insight.