[In the message entitled "Has spam factory dakotacom.net moved from ACSI to Alternet ?" on Nov 17, 16:21, John R Levine writes:]
I've been receiving buckets of spam from dakotacom.net, as many as 90 per day. They've been connected to ACSI for many months.
ACSI has a new anti-spam AUP that went into effect today. Today I see that traceroutes to Dakotacom go through Alternet and medic-net-gw.customer.ALTER.NET. But the route looks odd, maybe a leak rather than a new real route.
I don't speak BGP (my multi-homed ISP does that for me), so can anyone see who's announcing 207.201.204.0/255.255.252.0 ? ACSI? Alternet? Both?
You have to look at the bigger picture. Dakotacom, who I suspect is not quite as innocent as they seem, is trying to distance themselves from gtwinc.com - the source of the spam (207.101.213.0/24). gtwinc.com seems to be off the air at this time. 1 bungi-tlg-gw.sf.tlg.net (140.174.166.37) [AS 3915] 24 msec 16 msec 8 msec 2 bordercore1-hssi0-0.SanFrancisco.mci.net (166.48.13.249) [AS 3563] 16 msec 1 2 msec 12 msec 3 core7.SanFrancisco.mci.net (204.70.4.93) [AS 3561] 264 msec 20 msec 12 msec 4 mae-west3-nap.SanFrancisco.mci.net (204.70.10.246) [AS 3561] 360 msec 52 mse c 56 msec 5 mae-west.acsi.net (198.32.136.79) 44 msec 36 msec 60 msec 6 tucson-az-1-a12-0.acsi.net (206.222.97.8) [AS 6467] 292 msec 320 msec 272 ms ec 7 dakotacom.net.tucson-az-1.acsi.net (206.222.101.238) [AS 6467] 288 msec 44 m sec 48 msec 8 * * * but they do still seem to use dakotacom's gateway. I poked dakota a couple of times, to see if they were still planning on disconnecting them. Hard to say. Dakota is now advertising their space through AS701, and AS8105. * 207.201.192.0/18 192.41.177.108 0 0 6467 i *> 192.41.177.108 0 0 6467 i * 157.130.33.113 50026 0 701 6467 i * i207.201.193.0 157.130.192.97 51123 100 0 701 7079 i *> 157.130.33.113 50032 0 701 7079 i * i207.201.194.0 157.130.192.97 51123 100 0 701 7079 i *> 157.130.33.113 50032 0 701 7079 i * i207.201.200.0/23 198.32.136.79 105 100 0 6467 6983 i * 192.41.177.108 0 6467 6983 i *> 192.41.177.108 0 6467 6983 i * 157.130.33.113 50026 0 701 6467 6983 i * i207.201.204.0/22 157.130.192.97 51119 100 0 701 8105 i *> 157.130.33.113 50021 0 701 8105 i * i207.201.208.0/22 157.130.192.97 51119 100 0 701 8105 i *> 157.130.33.113 50021 0 701 8105 i * i207.201.212.0 157.130.192.97 51119 100 0 701 8105 i *> 157.130.33.113 50021 0 701 8105 i *>i207.201.213.0 207.126.96.3 105 1000 0 7777 i * That's the state of the moment... -- Dave Rand dlr@bungi.com http://www.bungi.com