Jeroen van Aart
jeroen at mompl.net
Fri Aug 31 18:38:30 UTC 2012
The below email exchange may be of interest to some of you. The
practical upshot is that it appears "the 18.104.22.168/22 range was
hijacked and should be included into the DROP list".
As an interesting aside, quoting a friend:
"the original company (that performed dangerous waste utilization) may
have been a shady thing in and of itself (..) what most companies
calling themselves "ecoservice" (with variations) do is take money for
"safe utilisation" of hazardous waste, and then dump it in some old
quarry out in the remote (or not so remote) corner of a forest or other
natural area (..) they always have criminal links and protection from
corrupts officials (often co-owners) and security/law enforcement services"
> From: Jeroen van Aart
> there is
> nothing but crap coming from 22.214.171.124/24. Amongst other things
> attempts to spam (through) wordpress sites.
> inetnum: 126.96.36.199 - 188.8.131.52
> netname: Donekoserv
> descr: DonEkoService Ltd
Don - name of the nearby large river.
"EkoService" means ecological service.
> country: RU
> org: ORG-DS41-RIPE
> person: Haralevich Piotr
> address: novocherkassk, ul stremyannaya d.6
> mnt-by: MNT-DONECO
> phone: +74951000000
changed: admin at donecoserv.ru 20101117
The company performed dangerous waste utilization:
But domains donecoserv.ru and donekoservis.ru don't exist anymore.
11 router02.spbbm18.ru.edpnet.net (184.108.40.206) 65.979 ms 65.971 ms
12 220.127.116.11.static.edpnet.net (18.104.22.168) 88.868 ms 47.809 ms
13 22.214.171.124 (126.96.36.199) 48.235 ms 48.546 ms 48.664 ms
14 ajursrv.parohod.biz (188.8.131.52) 47.957 ms 47.752 ms 47.606 ms
15 mail.rx-helps.com (184.108.40.206) 48.206 ms 48.302 ms 48.237 ms
SPb (Sankt-Peterburg) is 1500 km from Novocherkassk.
parohod.biz also is in Sankt-Peterburg, they offer SEO (which I consider
spamming websites and search engines).
| January 3, 2011
| inetnum: 220.127.116.11 18.104.22.168
| netname: Donekoserv
| descr: DonEkoService Ltd
| country: RU
| org: ORG-DS41-RIPE
| organisation: ORG-DS41-RIPE
| org-name: DonEko Service
| org-type: OTHER
| address: novocherkassk, ul stremyannaya d.6
| e-mail: admin at bulletproof-web.com
Therefore, the 22.214.171.124/22 range was hijacked
and should be included into the DROP list.
More information about the NANOG