I cant prove 100% this is media defender but I can prove it by the balance of probabilities, media defender used to use a 72 range and a 38 range then they shifted a few months ago to a new 174 range the other ranges disapearing on the exact day as the new one arrived, also a traceroute reveals the last step before the 174 IP was a media defender IP last used to set up a sting video upload site that failed, this then ties the changes and new IP together, the latest IP range to be active is the small whitaker that appears on a few old emule block-lists for anti p2p2 activities, but on our network is a flooder in the main and all the primary dos attacks occur when they finds its floding attempts blocked, the initial trigger is a chat list request but they will as another poster mentioned continue throught your time online to disrupt the primary network.
once again as the whittaker IP is active on the same day the 174 range closed down, this then indicates its media defender and likley the whittaker company whos range is vastly larger, sublets a small portion to media defender or they have a proxy deal as media defender have used such services many times all to hide their original server IP's.
Lets be clear here so no one is confused, the blocklist team will only ever block network attackers and as the network is checked many times a day we do not need to block millions of IP's "just in case", the range thats attacking is being blocked nothing more and nothing less.
