[SC-Help] Re: Please help with upstream
MikeE at ster.invalid
Thu Apr 29 17:03:50 EDT 2004
Miss Betsy wrote:
> From what I understand from my research is that the IP address I
> looked up is a direct allocation (no parent) to IJ in Fl. However,
> the IJ in OK has a parent (UUnet).
> But they both have the same name servers. And that is my question:
> How can they both be using the same name servers and maybe also why?
Well, I don't want to overwhelm you with information from arin, and it
is going to wrap badly here [nevermind, I think I fixed it], but I'll
show you what arin has on Internet Junction Corporation and I think [I'm
sure] these are all the same thing, even tho' some of them have OK
addies and some of them have FL addies of registration, they are all
about Eric Feinstein.
I've taken out some identifying numbers and replaced some with xxx to
make these lines shorter but still keep lead identifiers like inju &
thjn & fon & uu. I'm going to replace every instance of Internet
Junction Corporation after the first two with IJC to make the lines
whois -h whois.arin.net internet junction corporation ...
Internet Junction Corporation (INJU)
Internet Junction Corporation (THJN)
IJC FON-xxx 18.104.22.168 - 22.214.171.124
IJC INJU 126.96.36.199 - 188.8.131.52
IJC INJU-2BLK 184.108.40.206 - 220.127.116.11
IJC FON-xxx 18.104.22.168 - 22.214.171.124
IJC FON-xxx 126.96.36.199 - 188.8.131.52
IJC FON-xxx 184.108.40.206 - 220.127.116.11
IJC UU-xxx 18.104.22.168 - 22.214.171.124
IJC UU-xxx 126.96.36.199 - 188.8.131.52
IJC UU-xxx 184.108.40.206 - 220.127.116.11
IJC UU-xxx 18.104.22.168 - 22.214.171.124
IJC UU-xxx 126.96.36.199 - 188.8.131.52
IJC UU-xxx 184.108.40.206 - 220.127.116.11
IJC UU-xxx 18.104.22.168 - 22.214.171.124
IJC UU-xxx 126.96.36.199 - 188.8.131.52
IJC UU-xxx 184.108.40.206 - 220.127.116.11
IJC UU-xxx 18.104.22.168 - 22.214.171.124
IJC UU-xxx 126.96.36.199 - 188.8.131.52
IJC UU-xxx 184.108.40.206 - 220.127.116.11
IJC UU-xxx 18.104.22.168 - 22.214.171.124
IJC UU-xxx 126.96.36.199 - 188.8.131.52
> And is it a good reporting plan - if stuck - to send a report to the
> abuse desk of the IP address of the name server even though the spam
> did not come from that IP address?
Falling back on the nameservers is often a good strategy for different
kinds of reasons. Sometimes the nameservice is the only thing which is
meaningful. Occasionally the nameservice is weird too.
> Or do they usually resolve (and I
> may not be using that word correctly) to the same abuse address (the
> way this one did although one with a parent and the other not)?
Something which has as many IPs as ijc is going to pretty much control
its own destiny; and if they are going to ignore notifies about virm
propagations, your ability to do anything about it is very limited.
Realize that some providers 'can't' [which of course means won't, but
they are convinced it is can't] do anything about their propagators.
And, there is no 'punishment' for not doing so. There isn't a virus cop
blocklist, and given the trouble it would be to fix the problem, they
just aren't going to.
kibitzer, not SC admin
More information about the SpamCop-Help