[SpamCop-List] Re: SpamCop can't find the WhoIs data for this spammer ...

[Mike Easter]

George Langford, Sc.D. wrote:
> Here's the SpamCop tracker:
>
http://www.spamcop.net/sc?id=z795033362za709250ce1effda85e5adebc4640c621z
>
> I've received a bunch of these recently.
> It'd be nice to shut 'em down.
>
> And here's what the QuickReport said, in part:
>> whois 204.124.240.254 at whois.arin.net ... nothing found
>> host 204.124.240.254 ... no name
>
> And so SpamCop devnulled the report[s] ...

arin doesn't provide a tech contact and/or the tech contact PF85-ARIN
doesn't have an email addy.

SC can't do anything but devnull that.  Which is just 'fine' - the IP
gets counted, but it still isn't listed anywhere.

If you want to notify yourself or as an additonal notified, I think I
would go after the ASN rather than the nameservice, but you could check
on both of them.

The ASN can be determined from whois.radb.net or whois.cymru.com -- it
turns out that is AS4323 which is TW Telecom abuse at twtelecom.net

There's also mention of level3

whois -h whois.radb.net 204.124.240.254 ...
route:         204.124.240.0/22
descr:         Proxy-registered route object
origin:        AS4323
remarks:       Please contact routing at Level3.net if you have any
remarks:       questions regarding this object.

whois -h whois.cymru.com 204.124.240.254 ...
ASN     | IP               | Name
4323    | 204.124.240.254  | TWTC - Time Warner Telecom

> And ReverseDNS gets:
>> IP Address 204.124.240.0 resolves to: 204-124-240-0.gen.twtelecom.net
>
> So the connection is apparent, even though ReverseDNS on
> 204.124.240.254 fails to resolve.
>
> Looks like the problem is incomplete WhoIs records for the NetRange:
> 204.124.240.0 - 204.124.243.255
>
> Have I got this right ?  Has EasyWhoIs got a leg up on CompleteWhoIs ?
> And is the correct abuse addy: abuse at twtelecom.net ?

I like it.

-- 
Mike Easter
kibitzer, not SC admin