North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: RIPE Down or DOSed ?
- From: Kai Schlichting
- Date: Fri Feb 28 16:51:12 2003
On 2/27/2003 at 9:58 PM, firstname.lastname@example.org wrote:
> NetRange: 18.104.22.168 - 22.214.171.124
> CIDR: 126.96.36.199/18
> NetName: WHOLE-2
> NetHandle: NET-69-6-0-0-1
> Parent: NET-69-0-0-0-0
> NetType: Direct Allocation
> NameServer: NS1.WHOLESALEBANDWIDTH.COM
> NameServer: NS2.WHOLESALEBANDWIDTH.COM
> Where are the swips? The rest of that record makes no mention of an
> rwhois server. Doing a bunch of whois requests for IPs in that block, I
> found only one swip (for a /21). I realize the ARIN regs don't seem to
> require that reassignment info be made available to the public (just to
> ARIN), but using your innocent customers (if there are any) as a shield to
> hide your spammer customers is just wrong. Should I block 188.8.131.52/24
> from sending email into my systems? 184.108.40.206/18?
Correct answer: the /18, and then some.
Oh, how you wished you hadn't posted this to the list (and Cc:'d
wholesalebandwidth.com on it), but chosen reply-to-poster :)
Random example from this block appearing in my rejects:
http://www.openrbl.org/lookup?i=220.127.116.11 or: "I see red!"
Extended answer directly from my auto-complaint override map:
'as:26956' => 'as:17054,isp:cogent', # netfreeinc.com/wholesalebandwidth.com - rogue AS
'as:11938' => 'email@example.com,isp:verio', # wholesalebandwidth.com - rogue AS
'as:17054' => 'firstname.lastname@example.org,isp:genuity,email@example.com,isp:gblx', # e-xpedient.com - rogue AS?
Anything announced out of 26956 and 11938 goes straight to the sendmail
access file here, and given the various pointers from OTHER rogues back
to 17054, e-xpedient.com routes will be there RSN, too.
And if you thought /18 is a big block in spammer-hand, go check out various
DNSBLs for listings and the history of AS's announcing portions of: