On Tue, 2010-09-07 at 10:02 -0700, John Hardin wrote: > On Tue, 7 Sep 2010, Per Jessen wrote: > > > John Hardin wrote: > > > >>> Sorry to mislead. SPAM was caught by spamassassin. > >>> How can I get this guy stopped? > >>> IP addresses are: 67.50.37.35,.36,.69,.75 > >> > >> Ah. Yes, that's a different question. > >> > >> (1) Find out who owns those network addresses. > >> > >> Use tools like http://enc.com.au/itools/inetnum.php and > >> http://enc.com.au/itools/person.php to do that. > > > > whois will also tell you. > > True, but at the time I was composing that message both command-line whois > and several US-based web UIs were returning a "unable to return results > due to high traffic" message. >
John, I missed the beginning of this post so I guess you originally sent
it. Anyway here is a way you can track this down:
first telnet to whois.cymru.com port 43:
which gives you:
67.50.37.35
AS | IP | AS Name
7385 | 67.50.37.35 | INTEGRATELECOM - Integra Telecom, Inc.
Then telnet to whois.ra.net port 43:
telnet whois.ra.net 43
Trying 198.108.0.8...
Connected to radb3.merit.edu (198.108.0.8).
Escape character is '^]'.
as7385
aut-num: AS7385
as-name: Integra
descr: INTEGRA TELECOM
admin-c: Network Services
tech-c: Network Services
import: from AS12003
action pref=1;
accept ANY AND NOT {0.0.0.0/0}
import: from AS3549
action pref=1;
accept ANY AND NOT {0.0.0.0/0}
import: from AS22899
accept <^AS22154+$> AND NOT {0.0.0.0/0}
import: from AS2914
action pref=1;
accept ANY AND NOT {0.0.0.0/0}
import: from AS7911
action pref=1;
accept ANY AND NOT {0.0.0.0/0}
import: from AS13857
accept <^AS13857+$> AND NOT {0.0.0.0/0}
import: from AS18463
accept <^AS18463+$> AND NOT {0.0.0.0/0}
import: from AS4587
accept <^AS4587+$> AND NOT {0.0.0.0/0}
import: from AS22154
accept <^AS22154+$> AND NOT {0.0.0.0/0}
import: from AS22899
accept <^AS22154+$> AND NOT {0.0.0.0/0}
import: from AS26676
accept <^AS26676+$> AND NOT {0.0.0.0/0}
import: from AS19441
accept <^AS19441+$> AND NOT {0.0.0.0/0}
import: from AS29984
accept <^AS29984+$> AND NOT {0.0.0.0/0}
import: from AS30629
accept <^AS30629+$> AND NOT {0.0.0.0/0}
import: from AS32810
accept <^AS32810+$> AND NOT {0.0.0.0/0}
import: from AS33338
accept <^AS33338+$> AND NOT {0.0.0.0/0}
import: from AS36740
accept <^AS36740+$> AND NOT {0.0.0.0/0}
import: from AS16933
accept <^AS16933+$> AND NOT {0.0.0.0/0}
import: from AS32879
accept <^AS32879+$> AND NOT {0.0.0.0/0}
import: from AS39986
accept <^AS39986+$> AND NOT {0.0.0.0/0}
export: to AS2914
announce AS-INTEGRA
export: to AS3549
announce AS-INTEGRA
export: to AS4587
announce ANY
export: to AS6993
announce AS-INTEGRA
export: to AS7911
announce AS-INTEGRA
export: to AS13857
announce ANY
export: to AS18463
announce ANY
export: to AS22154
announce ANY
export: to AS22899
announce AS-INTEGRA
export: to AS26676
announce ANY
export: to AS19441
announce ANY
export: to AS29984
announce ANY
export: to AS32810
announce ANY
export: to AS33338
announce ANY
export: to AS36740
announce ANY
export: to AS16933
announce ANY
export: to AS32879
announce ANY
export: to AS39986
announce ANY
export: to AS12003
announce AS-INTEGRA7385
export: to AS3549
announce AS-INTEGRA7385
export: to AS22899
announce AS-INTEGRA7385
mnt-by: MAINT-AS7385
changed: randy.roo...@integratelecom.com 20060726
source: RADB
person: Network Services
address: 15200 NBN Way
address: Blue Ridge Summit, PA 17214
phone: +1-301-459-3132
e-mail: networksupp...@hudsonps.com
nic-hdl: NES4-LEVEL3
changed: kelly.macen...@level3.como 20100518
source: LEVEL3
Then telnet whois.radb.net 43
telnet whois.radb.net 43
Trying 198.108.0.18...
Connected to whois.radb.net (198.108.0.18).
Escape character is '^]'.
MAINT-AS7385
mntner: MAINT-AS7385
descr: Maintainer for AS7385
admin-c: Data Engineering
tech-c: Data Engineering
upd-to: b...@integra.net
mnt-nfy: b...@integra.net
auth: CRYPT-PW HIDDENCRYPTPW
auth: MAIL-FROM steven.raym...@integratelecom.com
auth: MAIL-FROM kenneth.mcint...@integratelecom.com
auth: MAIL-FROM b...@integra.net
auth: MAIL-FROM craig.heidger...@integratelecom.com
auth: MAIL-FROM randy.roo...@integratelecom.com
auth: MAIL-FROM edward.arne...@integratelecom.com
auth: MAIL-FROM tony.radz...@integratelecom.com
auth: MAIL-FROM rick.rand...@integratelecom.com
remarks: Integra Telecom AS7385 maintainer object
notify: engineeringd...@integratelecom.com
mnt-by: MAINT-AS7385
changed: steven.raym...@integratelecom.com 20090626
source: RADB
Is this any help?
--
Chris
KeyID 0xE372A7DA98E6705C
signature.asc
Description: This is a digitally signed message part
