Bill Cole wrote:
On 28 Jan 2016, at 8:54, Michelle Sullivan wrote:
[...]
Only the first is currently found in a the collection of authoritative
nameservers for dnsbl.sorbs.net, but all of them have symmetric PTR/A
records, implying that they aren't some sort of poisoning artifact.
Also, the last 3 are in small blocks allocated by SoftLayer to GFI
Software, the former owner of SORBS.
Where do you see GFI? Nothing should show GFI (all the SL stuff is
owned by Proofpoint)
Tell that to SL, e.g.:
$ /opt/local/bin/whois 174.36.198.233
[... ARIN record elided ...]
Found a referral to rwhois.softlayer.com:4321.
%rwhois V-1.5:003fff:00 rwhois.attcloudarchitect.com (by Network
Solutions, Inc. V-1.5.9.6)
network:Class-Name:network
network:ID:NETBLK-SOFTLAYER.174.36.192.0/18
network:Auth-Area:174.36.192.0/18
network:Network-Name:SOFTLAYER-174.36.192.0
network:IP-Network:174.36.198.232/30
network:IP-Network-Block:174.36.198.232-174.36.198.235
network:Organization;I:GFI Software
Hehe... out of date rwhois server... you expect anything else? :P
(GFI were out of the picture 1 Jul 2011...! )
--
Michelle Sullivan
http://www.mhix.org/
