[SpamCop-List] Re: abuse@mci.com / abuse#mci.com@devnull.spamcop.net - Make up it's mind...

[Mike Easter]

cwg wrote:
> 1343380059 ( http://salconsuming.com/ ) To: abuse at mci.com
> 1343380054 ( 206.113.181.88 ) To: abuse at mci.com

> 1343379569 ( http://suchotline.com/ ) To:
> abuse#mci.com at devnull.spamcop.net 1343379567 ( 163.125.38.93 ) To:
> abuse#mci.com at devnull.spamcop.net

Just picking 2 of them for the contrast.

206.113.181.88  !=  163.125.38.93

whois -h whois.arin.net 206.113.181.88 ...
UUNET Technologies, Inc.  206.112.0.0 - 206.115.255.255
   abuse at mci.com
MJK HOLDINGS, INC. 206.113.176.0 - 206.113.191.255
Salt Lake Group, 206.113.176.0 - 206.113.191.255
Internet Access Group, Inc. 206.113.181.0 - 206.113.181.255

So, mci is accepting that one.  But not the 163 one.


whois -h whois.arin.net 163.125.65.10 ...
Creative Friendly Technologies 163.125.0.0 - 163.125.255.255
Success Marketing Associates, 163.125.65.0 - 163.125.65.255

Reports routes for 163.125.65.10:
routeid:12889026 163.125.0.0 - 163.125.255.255
to:abuse#mci.com at devnull.spamcop.net
Administrator interested in all reports

Thursday, January 13, 2005 11:00:02 AM -0800
[Note added by 216.127.43.94 (sam.julianhaight.com)]
Hijacked block (?) as per John Reid.


Personally, my approach to  163.125.65.10  no rDNS which is spamhaused
as the /16 SBL5131
http://www.spamhaus.org/SBL/sbl.lasso?query=SBL5131  "An old spamhaus
netblock back from the dead (hijacked?)" rokso Andrew Westmoreland

would be to notify admin/techs for the possibly bogus structure above
and the routing, if I could figure it out.  radb and cymru [zero] handle
it differently, and so does spamhaus [AS15531].  According to radb &
spamhaus, I would notify the people in the radb information pile and let
them sort it out.

whois -h whois.radb.net 163.125.65.10 ...
route:              163.125.0.0/16
descr:              GBLX-US-BGP
origin:             AS15531
mnt-by:             MAINT-AS3549
changed:            mjames at gblx.net 20010327
source:             RADB

route:      163.125.0.0/16
descr:      SBC Irvine IDC-2
origin:     AS16966
remarks:    Irvine Class-B Buzzfind
notify:     ken.patterson at sbc.com
notify:     roy.bartram at sbc.com
mnt-by:     MAINT-AS16967
changed:    ken.patterson at sbc.com 20030212
source:     RADB

route:        163.125.0.0/16
descr:        Internet Networking Solutions
origin:       AS13488
mnt-by:       ASN-CIBERLYNX-DB-FL
changed:      netadm at ciberlynx.net 20030429
source:       SAVVIS

route:         163.125.0.0/16
descr:         Colo International, Inc
               11109 Nashville Dr
               Cooper city, FL 33026
               US
origin:        AS25754
mnt-by:        MNT-COLOINTL
changed:       msculnick at colointernational.com 20030909
source:        ARIN


-- 
Mike Easter
kibitzer, not SC admin