[SC-Help] Re: THEHOTTESTTHINGAROUND.COM - "Consumer Research Corp"SPAM

[Berny]

following this up to .spamcop where it probably belongs

sorry for the repeat in .help I got lazy

"Ellen" <nobody at spamcop.net> wrote in message
news:d6ct26$lj3$2 at news.spamcop.net...
>
>
> "Steve Johnson" <steevian at yahoo.com> wrote in message
> news:mailman.0.1116317184.169.spamcop-help at news.spamcop.net...
> >
> > Hello Ellen,
> >
> > Can you please tell me where you were able to find this info and if you
> know who to
> > talk to at "XO.com" I would appreaciate that info also, I haven't had
much
> luck with
> > them, they gave me a big laugh and 'click' on the phone last time.
>
> The information came from checking route-views using telnet:
>
> http://www.routeviews.org/
>
> You can try http://www.fixedorbit.com/search.htm altho I have found them
to
> be inaccurate from time to time as they don't seem to update as often as
> they should. Once you get the AS number from fixedorbit, you can use this
> url to pull up the details from the cidr-report -- just change the number
> after the AS in the url to the one you are interested in:
>
> http://www.cidr-report.org/cgi-bin/as-report?as=AS2828&view=4637
>
> halfway down the page is a list of the ranges announced by the ASN. So you
> would want to use that to check to see if the block was really announced
by
> the ASN or if fixedorbit was out of date. There is probably a less painful
> way to do this but as I just telnet into route-views I don't know what
that
> is. You can also try one or more of the looking glass sites -- just
remember
> that the results you are getting are for that looking glass only; here is
a
> link to a bunch of them:
>
> http://www.traceroute.org/#Looking Glass
>
> So for example you could try the  qwest USA one and put in the IP and
select
> BGP for the query type. You might want to try a few of them geographically
> scattered to make sure that you got complete information. You can then
look
> up the ASNs at fixedorbit to see who they belong to or use ARIN/RIPE/etc
to
> look up that information. In any case you need to sanity check the
> information that  you have gathered.
>
>
> >
> > The listing at SPAMHAUS
> http://www.spamhaus.org/sbl/sbl.lasso?query=SBL12587 refers
> > to a different range, are you suggesting "Quang Dangtran - Whoa Medical"
> is
> > responsible for this?
>
> yes
>
> The Rokso listing is for the /20:
> Address Range 69.67.64.0 - 69.67.79.255What I rerouted was
> 69.67.72.0/2169.67.72.0 - 69.67.79.255Which is a subset of the /20.I  see
> 69.67.64.0/21 as being announced by AS701 which is mci.com. XO should be
> well aware of what is happening -- there are over 3000 reports for the
last
> week for 69.67.72.0/24.
>
> >
> > Any idea on who "Roger Graves DATAMONITOR-BUSSINESS-INFORMATION" is??
>
> nope, no idea -- I tend to not be able to keep track of the names and
> aliases of all those spammers as I am, in general, very bad at retaining
> names. A select few however I have no problem with :-)
>
>
> Ellen
>
>