|
North American Network Operators Group Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical Re: CalPOP contact? HTTP CONNECT scanning
On Thu, Sep 04, 2003 at 05:29:17PM -0400, Kai Schlichting wrote: > On 9/3/2003 at 8:17 PM, "Jeroen Massar" <[email protected]> wrote: > > As people are complaining all around about ISP's, > > here is my small question. Who has a _working_ contact at > > "CalPOP" (216.240.128.0/19 and others). It is not in puck :( > > If anybody has a working one please mail it me offlist so > > that the following long version of the problem can be solved. > > Is there anything alive at CalPOP that doesn't try > > to abuse open proxies for massively spamming hotmail ? > [Spam-L] BLOCK,MISC: WHO'S SPAMMING YOU? (2003-08-27) Top 40 Proxy-Hijacker-Friendly Nets > http://www.monkeys.com/phl/top-20030827.post > 10. 216.240.140(4) level3.net - calpop.com (Los Angeles, CA) > days.cblock=2 > 29. 216.240.149(3) level3.net - calpop.com (Los Angeles, CA) > days.cblock=5 > We consider them a 'possibly rogue operator' at this point. We have > numerous logged instances of unlawful trespass from their IP space - > mail or attempted mail to spamtraps - and real uglyness like > 66.250.115.0/24 (no longer announced by them) housing the > proxy-scanning criminals at nextdatacorp.com/ newengineroom.com. Never > a darn word from them, except auto-replies. Their appearance in RFG's > "top-40" list is definitely paving the way for death-by-ASN-filter > (joining 90+ others). I've received responses from Calpop in recent memory. They do seem to be taking a turn for the worse, however. Whether this is due to malice, lack of clue, or some combination remains to be seen. (We had some of those blocks swipped to us from WAY back and it took forever to get them removed). Last I checked, the phone number listed (+1-213-351-1355) worked. A call over there might be helpful. If anyone from Level3 is around, now would be a good time to smack some clue into them. > ARIN has marked the contact info for AS 7796 as invalid - BACK IN > MAY(!) - and "Network Operations Account" <nocc-at-webvision.com> > has confirmed to us that they (AS 13374) are not the registrant of > that ASN, but CalPOP is. CalPOP has certainly had every opportunity > to correct the false record(s) in question with ARIN by now. 7796 *was* webvision at one point, although they're no longer using this ASN.[1] Calpop obtained some of Webvision's assets after Webvision closed their facility in Torrance. I can only assume that ARIN did require them to re-justify the usage before allowing them to transfer the allocation, but it's still a little sketchy, as Webvision is still in business. I'm pretty sure that Kamron Hejazi hasn't worked there in ages, and [email protected] hasn't been a valid address for quite some time. I did get a response from ken-at-calpop.com about this issue, although he didn't quite seem to understand why it mattered that the ASN had an invalid contact. To be fair, Webvision COULD fix this problem if they wanted to, since they could easily reactivate the address and change the POC for 7796. > The fact that their upstreams are or have been: > - Level3 (known spammer-tolerant, complaint-ignorant, deliberately hiding > customers in their IP space without SWIP/rwhois) > - rogue operator AS 22298 (ewan1.com) > (RIS says they are gone since 2003-08-25) > - Cogent (known spammer-tolerant, complaint-ignorant) > (RIS says they are gone since 2003-08-06) I did see some slight signs of life there at one point. However, it does seem that they're either totally rogue, totally clueless, or some combination of the two at this point. [1] Incidentally, Webvision dropped pretty far into the spam sewer by the end; their whole /19 was listed in SPEWS, which sucked for us, since we had about 6-8 /24's out of that. -- "Since when is skepticism un-American? Dissent's not treason but they talk like it's the same..." (Sleater-Kinney - "Combat Rock")
|