I do get some results from an online whois or two - https://ipinfo.io/AS19111 nbty.com is registered with Markmonitor so presumably they’re legit enough and large enough to afford brand protection. “Natures Bounty Inc” sounds like a reasonable name for a vendor of vitamins. ASNumber: 19111 ASName: NBTY19111 ASHandle: AS19111 RegDate: 2016-02-01 Updated: 2016-02-01 Ref: https://whois.arin.net/rest/asn/AS19111 OrgName: NBTY, Inc. OrgId: NATURE-24 Address: 60 Orville Drive City: Bohemia StateProv: NY PostalCode: 11716 Country: US RegDate: 2000-11-20 Updated: 2016-01-20 Ref: https://whois.arin.net/rest/org/NATURE-24 OrgAbuseHandle: MRO234-ARIN OrgAbuseName: Roberts, Marlon OrgAbusePhone: +1-631-200-5305 OrgAbuseEmail: mroberts@nbty.com OrgAbuseRef: https://whois.arin.net/rest/poc/MRO234-ARIN OrgTechHandle: MRO234-ARIN OrgTechName: Roberts, Marlon OrgTechPhone: +1-631-200-5305 OrgTechEmail: mroberts@nbty.com OrgTechRef: https://whois.arin.net/rest/poc/MRO234-ARIN OrgNOCHandle: MRO234-ARIN OrgNOCName: Roberts, Marlon OrgNOCPhone: +1-631-200-5305 OrgNOCEmail: mroberts@nbty.com OrgNOCRef: https://whois.arin.net/rest/poc/MRO234-ARIN 12.13.211.0/24<https://ipinfo.io/AS19111/12.13.211.0/24> AT&T Services, Inc. 256 12.154.146.0/24<https://ipinfo.io/AS19111/12.154.146.0/24> NBTY, INC 256 12.154.150.0/24<https://ipinfo.io/AS19111/12.154.150.0/24> NBTY, INC 256 12.180.219.0/24<https://ipinfo.io/AS19111/12.180.219.0/24> NBTY, INC 256 12.35.230.0/24<https://ipinfo.io/AS19111/12.35.230.0/24> NBTY, INC 256 144.121.136.0/24<https://ipinfo.io/AS19111/144.121.136.0/24> The Nature's Bounty Co. 256 63.116.19.0/24<https://ipinfo.io/AS19111/63.116.19.0/24> NBTY GLOBAL INC 256 From: NANOG <nanog-bounces@nanog.org> Date: Thursday, 6 February 2020 at 7:02 AM To: nanog@nanog.org <nanog@nanog.org> Subject: Tell me about AS19111 1800vitamins.org has a web site at 12.180.219.234 which looks like they would sell me vitamins should I or my dog need any. Routeviews tells me that IP is in AS19111, routed via AS7018. AS7018 is AT&T which isn't surprising for a 12/8 address, but ARIN says AS19111 doesn't exist. Huh? Signed, Confused -- Regards, John Levine, johnl@taugh.com, Primary Perpetrator of "The Internet for Dummies", Please consider the environment before reading this e-mail. https://jl.ly