[SC-Help] Re: Please help with upstream

[Mike Easter]

Miss Betsy wrote:
> From what I understand from my research is that the IP address I
> looked up is a direct allocation (no parent) to IJ in Fl.  However,
> the IJ in OK has a parent (UUnet).
>
> But they both have the same name servers.  And that is my question:
> How can they both be using the same name servers and maybe also why?

Well, I don't want to overwhelm you with information from arin, and it
is going to wrap badly here [nevermind, I think I fixed it], but I'll
show you what arin has on Internet Junction Corporation and I think [I'm
sure] these are all the same thing, even tho' some of them have OK
addies and some of them have FL addies of registration, they are all
about Eric Feinstein.

I've taken out some identifying numbers and replaced some with xxx to
make these lines shorter but still keep lead identifiers like inju &
thjn & fon & uu.  I'm going to replace every instance of Internet
Junction Corporation after the first two with IJC to make the lines
shorter.

whois -h whois.arin.net internet junction corporation ...
Internet Junction Corporation (INJU)
Internet Junction Corporation (THJN)
IJC  FON-xxx 63.166.26.0 - 63.166.27.255
IJC  INJU 209.216.64.0 - 209.216.95.255
IJC  INJU-2BLK 66.234.64.0 - 66.234.79.255
IJC  FON-xxx 65.161.65.0 - 65.161.65.255
IJC  FON-xxx 65.161.66.0 - 65.161.67.255
IJC  FON-xxx 65.161.136.0 - 65.161.143.255
IJC  UU-xxx 206.72.152.0 - 206.72.152.255
IJC  UU-xxx 209.137.8.0 - 209.137.9.255
IJC  UU-xxx 209.137.6.0 - 209.137.7.255
IJC  UU-xxx 207.100.8.0 - 207.100.8.255
IJC  UU-xxx 207.22.166.0 - 207.22.166.255
IJC  UU-xxx 207.100.76.0 - 207.100.76.255
IJC  UU-xxx 207.100.227.0 - 207.100.227.255
IJC  UU-xxx 207.100.203.0 - 207.100.203.255
IJC  UU-xxx 209.4.40.0 - 209.4.47.255
IJC  UU-xxx 209.4.16.0 - 209.4.23.255
IJC  UU-xxx 209.4.204.0 - 209.4.205.255
IJC  UU-xxx 209.4.202.0 - 209.4.203.255
IJC  UU-xxx 207.100.240.0 - 207.100.240.255
IJC  UU-xxx 207.100.244.0 - 207.100.245.255

> And is it a good reporting plan - if stuck - to send a report to the
> abuse desk of the IP address of the name server even though the spam
> did not come from that IP address?

Falling back on the nameservers is often a good strategy for different
kinds of reasons.  Sometimes the nameservice is the only thing which is
meaningful.  Occasionally the nameservice is weird too.

> Or do they usually resolve (and I
> may not be using that word correctly) to the same abuse address (the
> way this one did although one with a parent and the other not)?

Something which has as many IPs as ijc is going to pretty much control
its own destiny;  and if they are going to ignore notifies about virm
propagations, your ability to do anything about it is very limited.

Realize that some providers 'can't' [which of course means won't, but
they are convinced it is can't] do anything about their propagators.
And, there is no 'punishment' for not doing so.  There isn't a virus cop
blocklist, and given the trouble it would be to fix the problem, they
just aren't going to.

-- 
Mike Easter
kibitzer, not SC admin