Re: Atrivo/Intercage

[Rich Kulawiec <rsk () gsp org>]

On Wed, Sep 24, 2008 at 07:12:31PM -0500, William Pitcock wrote:
> That said, they should have dropped Esthost before it got that big, but
> they didn't.

Didn't you notice that the quoted material was from *three years ago*?

And this problem didn't begin three years ago, either.  For example:


> From furioun () spin it Fri Dec  5 09:53:14 EST 2003
> Article: 1141964 of news.admin.net-abuse.email
> From: furio ercolessi <furioea () spin it>
> Newsgroups: news.admin.net-abuse.email
> Subject: AS27595 (Atrivo) here no more
> Date: 5 Dec 2003 09:29:30 GMT
> Organization: Spin Internetworking
> Message-ID: <bqpj5q$6ra$1 () half spin it>
> Reply-To: furioun () spin it
> NNTP-Posting-Host: photon.spin.it
>
> After several months of spam support including routing of hijacked IP 
> blocks, without apparent traces of non-abuse related IP traffic, our 
> backbone is now stopping the exchange of IP packets with AS27595, 
> currently announcing the following blocks:
>
>    Network            DNSBL       Upstreams
> ---------------               -----   ------------------
> 65.124.21.0/24                        4474
> 66.250.145.0/24               S2489   22934
> 67.130.99.0/24                        4474
> 69.1.78.0/24          S2783   4474, 22934
> 69.31.64.0/20         S2453   4474
> 69.31.76.0/22         S2453   4474, 30371
> 69.50.160.0/20                S2489   4474, 22934, 30371
> 69.50.176.0/20                S2489   4474, 22934, 30371
>
> AS4474   Global Village Communication, Inc.
> AS22934  E Broadband Now Inc.
> AS30371  nLayer Communications, Inc.
>
> We are currently considering an extension of this measure to the
> three entities above, which also seem to appear repeatedly in connection 
> with network abuses and with very little, if any, legitimate traffic
> with our customers.
>
> furio ercolessi
> Spin.it 

---Rsk