Jump to content

Bad Whois Lookup: 69.64.32.0 - 69.64.63.255


cwg
 Share

Recommended Posts

If you look at the lookup data returned by ARIN gotten by the spamcop engine:

$ whois 69.64.49.34[at]whois.arin.net

$ whois 69.64.49.34[at]whois.arin.net

[whois.arin.net]
#
# Query terms are ambiguous.  The query is assumed to be:
#	 "n 69.64.49.34"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=69.64.49.34?showDetails=true&showARIN=false&ext=netref2
#

NetRange:	   69.64.32.0 - 69.64.63.255
CIDR:		   69.64.32.0/19
OriginAS:	   AS30083
NetName:		HSI-1
NetHandle:	  NET-69-64-32-0-1
Parent:		 NET-69-0-0-0-0
NetType:		Direct Allocation
RegDate:		2003-07-30
Updated:		2012-05-10
Ref:			http://whois.arin.net/rest/net/NET-69-64-32-0-1

OrgName:		Hosting Solutions International, Inc.
OrgId:		  SERVE-6
Address:		210 North Tucker Blvd.
Address:		Suite 910
City:		   Saint Louis
StateProv:	  MO
PostalCode:	 63101
Country:		US
RegDate:		2003-04-15
Updated:		2012-05-10
Comment:		Please forward abuse complaints to abuse[at]hostingsolutionsint.com
Ref:			http://whois.arin.net/rest/org/SERVE-6

OrgNOCHandle: SWI19-ARIN
OrgNOCName:   Wintz, Sascha 
OrgNOCPhone:  +1-314-480-6840 
OrgNOCEmail:  s.wintz[at]hostingsolutionsinternational.com
OrgNOCRef:	http://whois.arin.net/rest/poc/SWI19-ARIN

OrgTechHandle: SWI19-ARIN
OrgTechName:   Wintz, Sascha 
OrgTechPhone:  +1-314-480-6840 
OrgTechEmail:  s.wintz[at]hostingsolutionsinternational.com
OrgTechRef:	http://whois.arin.net/rest/poc/SWI19-ARIN

OrgAbuseHandle: HAD15-ARIN
OrgAbuseName:   HSI Abuse Department
OrgAbusePhone:  +1-314-266-3638 
OrgAbuseEmail:  abuse[at]hostingsolutionsint.com
OrgAbuseRef:	http://whois.arin.net/rest/poc/HAD15-ARIN

RAbuseHandle: HAD15-ARIN
RAbuseName:   HSI Abuse Department
RAbusePhone:  +1-314-266-3638 
RAbuseEmail:  abuse[at]hostingsolutionsint.com
RAbuseRef:	http://whois.arin.net/rest/poc/HAD15-ARIN

RTechHandle: SWI19-ARIN
RTechName:   Wintz, Sascha 
RTechPhone:  +1-314-480-6840 
RTechEmail:  s.wintz[at]hostingsolutionsinternational.com
RTechRef:	http://whois.arin.net/rest/poc/SWI19-ARIN

RNOCHandle: SWI19-ARIN
RNOCName:   Wintz, Sascha 
RNOCPhone:  +1-314-480-6840 
RNOCEmail:  s.wintz[at]hostingsolutionsinternational.com
RNOCRef:	http://whois.arin.net/rest/poc/SWI19-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

You assume that it's correct, there is an abuse email address, and it goes to abuse[at]hostingsolutionsint.com according to the info.

However, parsing anything which fetches abuse[at]hostingsolutionsint.com from the database, you get:

Report: z5443662884z2480650927477402285c75105d553be1z

Tracking link: http://fundacionchwinqlal.com.gt/~fundac/directlogistics/ConsignmentNumber=2979939.htm
[report history]
Resolves to 69.64.49.34
Routing details for 69.64.49.34
[refresh/show] Cached whois for 69.64.49.34 : abuse[at]hostingsolutionsint.com
Using abuse net on abuse[at]hostingsolutionsint.com
abuse net hostingsolutionsint.com = postmaster[at]hostingsolutionsint.com, abuse[at]server4you.de, abuse[at]intergenia.de, abuse[at]hostingsolutionsint.com
Using best contacts postmaster[at]hostingsolutionsint.com abuse[at]server4you.de abuse[at]intergenia.de abuse[at]hostingsolutionsint.com
postmaster[at]hostingsolutionsint.com redirects to abuse[at]hostingsolutionsint.com
Reports disabled for abuse[at]hostingsolutionsint.com
Reports disabled for abuse[at]server4you.de
Using abuse#server4you.de[at]devnull.spamcop.net for statistical tracking.
Reports disabled for abuse[at]intergenia.de
Using abuse#intergenia.de[at]devnull.spamcop.net for statistical tracking.
Reports disabled for abuse[at]hostingsolutionsint.com
Using abuse#hostingsolutionsint.com[at]devnull.spamcop.net for statistical tracking.

And you get annoyed. There appears to be nobody that wants to deal with it.

But wait, there's more. In the returned data, there's another email address: s.wintz[at]hostingsolutionsinternational.com

But wait some more, I contacted the registrar for hostingsolutionsint.com (PSI-USA Inc. DNS Service Center) about this, and got back this reply:

Dear Sir or Madam,

thats because the domain has been deleted today.

Best regards,

- - - - -

PSI-USA, Inc.

ICANN Accredited Registrar

Sarah Salim

Maximilianstr. 6

93047 Regensburg

Germany

Tel. +49 941 595 590

Fax. +49 941 595 79050

E-mail: contact[at]psi-usa.info

18.12.2012 17:01 - colin glenn schrieb:

Hallo, folgende Daten wurden am 18.12.2012 um 17:00 Uhr erfasst: PHPSESSID: 6ca70321603b9ef0634d80715d7c56ff auth: 6679 nachname: g vorname: c name: plz: ort: land: fon: fax: email: mklar[at]wtixfm.com Nachricht: hostingsolutionsint.com has no valid contact information listed agree: ja

So, using the actual ARIN WhoIs interface, I looked, and sure enough, it does list abuse[at]hostingsolutionsint.com as the abuse address:

Name	HSI Abuse Department
Handle	HAD15-ARIN
Company	Hosting Solutions Int'l, Inc.
Street	210 North Tucker Blvd.
Suite 910
City	St. Louis
State/Province	MO
Postal Code	63101
Country	US
Registration Date	2012-05-10
Last Updated	2012-05-10
Comments	
Phone	+1-314-266-3638 (Office)
Email	abuse[at]hostingsolutionsint.com
RESTful Link	http://whois.arin.net/rest/poc/HAD15-ARIN
See Also	Related organizations.

But if you check the page for Tech:

Name	Wintz , Sascha
Handle	SWI19-ARIN
Company	Hosting Solutions International, Inc
Street	210 North Tucker Blvd.
Suite 910
City	St. Louis
State/Province	MO
Postal Code	63101
Country	US
Registration Date	2003-07-07
Last Updated	2011-12-06
Comments	please send abuse complaints to abuse[at]hostingsolutionsinternational.com
Phone	+1-314-480-6840 (Office)
Email	s.wintz[at]hostingsolutionsinternational.com
RESTful Link	http://whois.arin.net/rest/poc/SWI19-ARIN
See Also	Related organizations.

Ha!

Name change: abuse[at]hostingsolutionsinternational.com

Bad updating over at ARIN.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...