Re: spammer from outer space? (routing error)

[Ingo Flaschberger <if () xip at>]

Dear Peter,

> But whois keeps telling me:
>
> ReferralServer: whois://whois.apnic.net
>
> NetRange:   125.0.0.0 - 125.255.255.255
> CIDR:       125.0.0.0/8
> NetName:    APNIC-125
> NetType:    Allocated to APNIC
> Comment:    This IP address range is not registered in the ARIN database.
> Comment:    For details, refer to the APNIC Whois Database via
> Comment:    WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl

> So I should never have seen a packet from them?

you have only queried arin ip database, which is not the only one.
The right one is apnic in this case (asia region).

ripe-whois -h  WHOIS.APNIC.NET 125.187.32.144
% [whois.apnic.net node-1]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      125.176.0.0 - 125.191.255.255
netname:      XPEED
country:      KR
descr:        POWERCOM
descr:        ************************************************
descr:        If you would like to find assignment
descr:        information in detail please refer to
descr:        the KRNIC Whois Database at
descr:        http://whois.nic.or.kr/english/index.html
descr:        ************************************************
admin-c:      HM127-AP
tech-c:       HM127-AP
status:       Allocated Portable
changed:      hostmaster () nic or kr 20060621
mnt-by:       MNT-KRNIC-AP
source:       APNIC


bye,
        Ingo