On 28 Jan 2016, at 8:54, Michelle Sullivan wrote:
[...]
Only the first is currently found in a the collection of
authoritative
nameservers for dnsbl.sorbs.net, but all of them have symmetric PTR/A
records, implying that they aren't some sort of poisoning artifact.
Also, the last 3 are in small blocks allocated by SoftLayer to GFI
Software, the former owner of SORBS.
Where do you see GFI? Nothing should show GFI (all the SL stuff is
owned by Proofpoint)
Tell that to SL, e.g.:
$ /opt/local/bin/whois 174.36.198.233
[... ARIN record elided ...]
Found a referral to rwhois.softlayer.com:4321.
%rwhois V-1.5:003fff:00 rwhois.attcloudarchitect.com (by Network
Solutions, Inc. V-1.5.9.6)
network:Class-Name:network
network:ID:NETBLK-SOFTLAYER.174.36.192.0/18
network:Auth-Area:174.36.192.0/18
network:Network-Name:SOFTLAYER-174.36.192.0
network:IP-Network:174.36.198.232/30
network:IP-Network-Block:174.36.198.232-174.36.198.235
network:Organization;I:GFI Software
network:Street-Address:15300 Weston Parkway, Suite 104
network:City:Cary
network:State:NC
network:Postal-Code:27513
network:Country-Code:US
network:Tech-Contact;I:sysadm...@softlayer.com
network:Abuse-Contact;I:ab...@gfi.com
network:Admin-Contact;I:IPADM258-ARIN
network:Created:2010-02-22 10:26:09
network:Updated:2015-04-18 20:06:14
network:Updated-By:ipad...@softlayer.com
%ok
