[45503] in North American Network Operators' Group
Re: WARNING: Whois mining operation (probably spam related).
daemon@ATHENA.MIT.EDU (Tony Rowley)
Sun Feb 3 06:59:46 2002
Date: Sun, 3 Feb 2002 06:58:34 -0500 (EST)
From: Tony Rowley <rowley@netaxs.com>
To: Scott Francis <darkuncle@darkuncle.net>
Cc: "John Palmer (NANOG Acct)" <nanog@adns.net>, nanog@merit.edu
In-Reply-To: <20020203105350.GA54311@darkuncle.net>
Message-ID: <Pine.SUN.3.95.1020203065643.25633A-100000@access.netaxs.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Errors-To: owner-nanog-outgoing@merit.edu
On Sun, 3 Feb 2002, Scott Francis wrote:
> On Sun, Feb 03, 2002 at 02:34:46AM -0600, nanog@adns.net said:
> >
> > Starting about 6am eastern time, we began getting several hundred hits per
> > second from IP address 195.188.22.6 to our WHOIS server.
> >
> > It appears that they were running a rather well endowed dictionary against
> > the database.
> >
> > Beware - these are spammers (I know the address very well). Check your logs
> > if you have any email servers or whois databases.
> >
> > This is a jerk from England who is a known fraudster.
> ====
> [sfrancis@silverlight:~]$ whois -r 195.188.22.6
> <snip>
> descr: Please forward abuse issues
> descr: to abuse@blueyonder.co.uk
> <snip>
> ====
>
> http://help.blueyonder.co.uk/rules/aup.html
>
> If this guy is obviously spamming, or data mining in preparation for
> spamming, it seems that blueyonder.co.uk could be contacted to have his
> access yanked. Failing that, cableinet.net could be contacted to have
> blueyonder.co.uk yanked.
>
> Of course, you may have already tried this and received little/no
> cooperation. *sigh*
Good luck dealing with blueyonder - they won't accept complaints sent by
means other than their webform.
_____________________________________________________________________________
Tony Rowley rowley@netaxs.com |"No oath, no pledge, no vow greater than
Netaxs Internet Services | this: to never give up."
Philadelphia PA USA | - Kevin Smith
