Re: NANOG Spam?

[William Allen Simpson <william.allen.simpson () gmail com>]

Christian Seitz <chris () in-berlin de> wrote:
> In article <44AC3493.6010705 () gmail com> you wrote:
>
> > oarwind.info.
> > AS      | IP               | Registry | AS Name
> > 6724    | 81.169.143.178   | ripencc  | STRATO Strato AG
>
> How did you resolve this? Is there something wrong with
> my DNS or did you make a mistake resolving the adress?
>
> oarwind.info            A       218.22.43.22
>
> inetnum:      218.22.0.0 - 218.23.255.255
> netname:      CHINANET-AH
> country:      CN
> descr:        CHINANET Anhui province network
> descr:        Data Communication Division
> descr:        China Telecom
> admin-c:      CH93-AP
> tech-c:       AT318-AP
> status:       ALLOCATED PORTABLE
> mnt-by:       APNIC-HM
> mnt-lower:    MAINT-CHINANET-AH
> changed:      hm-changed () apnic net 20060322
> source:       APNIC
At the time of resolution 3 days ago, multiple persons on this list
resolved it to Strato.de.   h613092.serverkompetenz.net (81.169.143.178)

Apparently, it has since moved to China.  That's the kind of thing that
happens while you took a long weekend.

Are you in a position to quarantine the German server?  Or otherwise
aid in investigating the problem?  Such as getting German law
enforcement to confiscate the server as compromised and containing
personal identity theft?