[SC-Help] KREONET replies re a suspected Kornet IP, 203.251.45.194 (new contact info: being@kt.co.kr)

[David Butler]

Wow,  a VERY helpful new contact in Korea from KREONET.  His response and my
reply below. Should the cache be updated to reflect this?

I will resist crossposting to .routing until I have more, regardless.

I guess my efforts at broadcasting to every Kornet email and Peer/unpstream
is paying off.

;-)

David


*******************************************************
Thank you for your assistance! What company is kt.co.kr ?

The IP shows as being kornet and kreonet on the lookups I did.

If you can forward the abuse contacts for that ISP, I would be grateful, as
well as for any information on what IP ranges they service!

Thanks,

David


--- CERT-KREONET <cert at kreonet2.net> wrote:
> Hello ob1db at yahoo.com,
>
> Thank you for reporting the spam incident to Kreonet.
>
> By the way, the host 203.251.45.194  is not serviced by Kreonet,
>
> but is a host assigned to (being at kt.co.kr) .
>
> Therefore I am forwarding your message to the  (being at kt.co.kr) admin
> contact.
>
> With Kind Regards,
>
> --
> Soo-Jin Jang
> CERT-KREONET
>
>
>
> ----- Original Message ----- 
> From: <ob1db at yahoo.com>
> To: <kams-1536082-1-rep at abuse.kornet.net>; <abuse at abuse.kornet.net>;
> <ip at ns.kornet.net>; <domain at ns.kornet.net>; <abuse at kreonet.re.kr>;
> <abuse at krnic.net>; <chungnm1 at soback.kornet.net>; <abuse at bora.net>;
> <abuse at hitel.net>
> Sent: Sunday, February 15, 2004 7:34 AM
> Subject: spammer from your email servers
>
>
> spammer from your email servers
>
> Tracking ip 203.251.45.194
> Routing details for 203.251.45.194
> [refresh/show] Cached whois for 203.251.45.194 : abuse at kornet.net
> being at kt.co.kr ip at ns.kornet.net
> Using abuse net on abuse at kornet.net
> abuse net kornet.net = support at kornet.net, postmaster at kornet.net,
> abuse at kornet.net, spamrelay at certcc.or.kr
>
>
> NS-Delegation for 203.251.45.*: (*.)
>
> 45.251.203.in-addr.arpa -> ns.kornet.net
> 45.251.203.in-addr.arpa -> ns2.kornet.net
> 251.203.in-addr.arpa    -> kr2nd.hitel.net
> 251.203.in-addr.arpa    -> usns.dacom.co.kr
> 251.203.in-addr.arpa    -> ns.krnic.net
> 251.203.in-addr.arpa    -> ns.kreonet.re.kr
> 251.203.in-addr.arpa    -> kr2nd.kornet.net
> 251.203.in-addr.arpa    -> kr2ld.dacom.co.kr
>
>  Abuse-Whois kornet.net: (45.251.203.in-addr.arpa;
> 45.251.203.in-addr.arpa...)
> [Cached]
> [whois.abuse.net]
> abuse at kornet.net (for kornet.net)
> postmaster at kornet.net (for kornet.net)
> spamrelay#certcc.or.kr (for kornet.net)
> support#kornet.net (for kornet.net)
>
>
>  Abuse-Whois hitel.net: (251.203.in-addr.arpa)
> [Cached]
> [whois.abuse.net]
> Postmaster at sni08.hitel.net (for hitel.net)
> postmaster at hitel.net (for hitel.net)
> abuse at hitel.net (for hitel.net)
>
>
>  Abuse-Whois dacom.co.kr: (251.203.in-addr.arpa; 251.203.in-addr.arpa)
> [Cached]
> [whois.abuse.net]
> abuse at bora.net (for dacom.co.kr)
> spamrelay#certcc.or.kr (for dacom.co.kr)
>
>
>  Abuse-Whois krnic.net: (251.203.in-addr.arpa)
> [Cached]
> [whois.abuse.net]
> postmaster at krnic.net (default, no info)
>
>
>  Abuse-Whois kreonet.re.kr: (251.203.in-addr.arpa)
> [Cached]
> [whois.abuse.net]
> abuse at kreonet.re.kr (for kreonet.re.kr)
> spamrelay#certcc.or.kr (for kreonet.re.kr)