WARNING: Whois mining operation (probably spam related).
Starting about 6am eastern time, we began getting several hundred hits per second from IP address 195.188.22.6 to our WHOIS server. It appears that they were running a rather well endowed dictionary against the database. Beware - these are spammers (I know the address very well). Check your logs if you have any email servers or whois databases. This is a jerk from England who is a known fraudster.
On Sun, Feb 03, 2002 at 02:34:46AM -0600, nanog@adns.net said:
Starting about 6am eastern time, we began getting several hundred hits per second from IP address 195.188.22.6 to our WHOIS server.
It appears that they were running a rather well endowed dictionary against the database.
Beware - these are spammers (I know the address very well). Check your logs if you have any email servers or whois databases.
This is a jerk from England who is a known fraudster.
==== [sfrancis@silverlight:~]$ whois -r 195.188.22.6 <snip> descr: Please forward abuse issues descr: to abuse@blueyonder.co.uk <snip> ==== http://help.blueyonder.co.uk/rules/aup.html If this guy is obviously spamming, or data mining in preparation for spamming, it seems that blueyonder.co.uk could be contacted to have his access yanked. Failing that, cableinet.net could be contacted to have blueyonder.co.uk yanked. Of course, you may have already tried this and received little/no cooperation. *sigh* -- Scott Francis darkuncle@ [home:] d a r k u n c l e . n e t Systems/Network Manager sfrancis@ [work:] t o n o s . c o m GPG public key 0xCB33CCA7 illum oportet crescere me autem minui
Blueyonder / Cableinet are both owned and ran by Telewest - a cable company, its probably a cable modem customer... On Sun, 3 Feb 2002, Scott Francis wrote:
On Sun, Feb 03, 2002 at 02:34:46AM -0600, nanog@adns.net said:
Starting about 6am eastern time, we began getting several hundred hits per second from IP address 195.188.22.6 to our WHOIS server.
It appears that they were running a rather well endowed dictionary against the database.
Beware - these are spammers (I know the address very well). Check your logs if you have any email servers or whois databases.
This is a jerk from England who is a known fraudster.
==== [sfrancis@silverlight:~]$ whois -r 195.188.22.6 <snip> descr: Please forward abuse issues descr: to abuse@blueyonder.co.uk <snip> ====
http://help.blueyonder.co.uk/rules/aup.html
If this guy is obviously spamming, or data mining in preparation for spamming, it seems that blueyonder.co.uk could be contacted to have his access yanked. Failing that, cableinet.net could be contacted to have blueyonder.co.uk yanked.
Of course, you may have already tried this and received little/no cooperation. *sigh*
-- Stephen J. Wilcox IP Services Manager, Opal Telecom http://www.opaltelecom.co.uk/ Tel: 0161 222 2000 Fax: 0161 222 2008
On Sun, 3 Feb 2002, Scott Francis wrote:
On Sun, Feb 03, 2002 at 02:34:46AM -0600, nanog@adns.net said:
Starting about 6am eastern time, we began getting several hundred hits per second from IP address 195.188.22.6 to our WHOIS server.
It appears that they were running a rather well endowed dictionary against the database.
Beware - these are spammers (I know the address very well). Check your logs if you have any email servers or whois databases.
This is a jerk from England who is a known fraudster.
==== [sfrancis@silverlight:~]$ whois -r 195.188.22.6 <snip> descr: Please forward abuse issues descr: to abuse@blueyonder.co.uk <snip> ====
http://help.blueyonder.co.uk/rules/aup.html
If this guy is obviously spamming, or data mining in preparation for spamming, it seems that blueyonder.co.uk could be contacted to have his access yanked. Failing that, cableinet.net could be contacted to have blueyonder.co.uk yanked.
Of course, you may have already tried this and received little/no cooperation. *sigh*
Good luck dealing with blueyonder - they won't accept complaints sent by means other than their webform. _____________________________________________________________________________ Tony Rowley rowley@netaxs.com |"No oath, no pledge, no vow greater than Netaxs Internet Services | this: to never give up." Philadelphia PA USA | - Kevin Smith
participants (4)
-
John Palmer (NANOG Acct) -
Scott Francis -
Stephen J. Wilcox -
Tony Rowley