Has spam factory dakotacom.net moved from ACSI to Alternet ?

Mon Nov 17 21:41:25 UTC 1997

[In the message entitled "Has spam factory dakotacom.net moved from ACSI to Alternet ?" on Nov 17, 16:21, John R Levine writes:]
> I've been receiving buckets of spam from dakotacom.net, as many as 90 per 
> day.  They've been connected to ACSI for many months.
> 
> ACSI has a new anti-spam AUP that went into effect today.  Today I see that
> traceroutes to Dakotacom go through Alternet and
> medic-net-gw.customer.ALTER.NET.  But the route looks odd, maybe a leak
> rather than a new real route. 
> 
> I don't speak BGP (my multi-homed ISP does that for me), so can anyone see
> who's announcing 207.201.204.0/255.255.252.0 ?  ACSI?  Alternet?  Both? 

You have to look at the bigger picture.

Dakotacom, who I suspect is not quite as innocent as they seem, is
trying to distance themselves from gtwinc.com - the source of the
spam (207.101.213.0/24).

gtwinc.com seems to be off the air at this time.

  1 bungi-tlg-gw.sf.tlg.net (140.174.166.37) [AS 3915] 24 msec 16 msec 8 msec
  2 bordercore1-hssi0-0.SanFrancisco.mci.net (166.48.13.249) [AS 3563] 16 msec 1
2 msec 12 msec
  3 core7.SanFrancisco.mci.net (204.70.4.93) [AS 3561] 264 msec 20 msec 12 msec
  4 mae-west3-nap.SanFrancisco.mci.net (204.70.10.246) [AS 3561] 360 msec 52 mse
c 56 msec
  5 mae-west.acsi.net (198.32.136.79) 44 msec 36 msec 60 msec
  6 tucson-az-1-a12-0.acsi.net (206.222.97.8) [AS 6467] 292 msec 320 msec 272 ms
ec
  7 dakotacom.net.tucson-az-1.acsi.net (206.222.101.238) [AS 6467] 288 msec 44 m
sec 48 msec
  8  *  *  *

but they do still seem to use dakotacom's gateway.

I poked dakota a couple of times, to see if they were still planning on 
disconnecting them.  Hard to say.  Dakota is now advertising their
space through AS701, and AS8105.

*  207.201.192.0/18 192.41.177.108         0             0 6467 i
*>                  192.41.177.108         0             0 6467 i
*                   157.130.33.113     50026             0 701 6467 i
* i207.201.193.0    157.130.192.97     51123    100      0 701 7079 i
*>                  157.130.33.113     50032             0 701 7079 i
* i207.201.194.0    157.130.192.97     51123    100      0 701 7079 i
*>                  157.130.33.113     50032             0 701 7079 i
* i207.201.200.0/23 198.32.136.79        105    100      0 6467 6983 i
*                   192.41.177.108                       0 6467 6983 i
*>                  192.41.177.108                       0 6467 6983 i
*                   157.130.33.113     50026             0 701 6467 6983 i
* i207.201.204.0/22 157.130.192.97     51119    100      0 701 8105 i
*>                  157.130.33.113     50021             0 701 8105 i
* i207.201.208.0/22 157.130.192.97     51119    100      0 701 8105 i
*>                  157.130.33.113     50021             0 701 8105 i
* i207.201.212.0    157.130.192.97     51119    100      0 701 8105 i
*>                  157.130.33.113     50021             0 701 8105 i
*>i207.201.213.0    207.126.96.3         105   1000      0 7777 i
*

That's the state of the moment...

-- 
Dave Rand
dlr at bungi.com
http://www.bungi.com