Pretty sure that we traced to a service DiviNetworks that uses "unused" IP space/bandwidth and tracks Invalid DNS queries. Thanks for all of the input and assistance, special thanks to William Herrin who pointed this out. -- Christopher Tyler Senior Network Engineer MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Solutions 1091 W. Kathryn Street Nixa, MO 65714 (417) 851-1107 x. 9002 www.totalhighspeed.com ----- Original Message -----
From: "Christopher Morrow" <morrowc.lists@gmail.com> To: "Sabri Berisha" <sabri@cluecentral.net> Cc: "nanog" <nanog@nanog.org> Sent: Friday, June 19, 2020 12:58:46 PM Subject: Re: Google captcha issue
On Fri, Jun 19, 2020 at 1:44 PM Sabri Berisha <sabri@cluecentral.net> wrote:
----- On Jun 19, 2020, at 9:40 AM, William Herrin bill@herrin.us wrote:
Hi,
Do you, or perhaps your upstream have such a contract?
I'd be pretty unhappy if someone that I'm paying for transit spoofs traffic with my IP space as the source.
I don't think william's description is 'spoofing', it's perhaps: "Manufacturing hosts on the fly"
is still skeezy though ;(