Jump to content

Question about finding upstream providers


sentinel.hawk
 Share

Recommended Posts

Hey, I've been sending abuse emails to providers for quite a while and some haven't had much luck but was tipped off to possibly finding upstream providers via the CIDR reports. I know doing a regular tracert isn't as efficient or accurate as the CIDR; but can anyone give an idea about how accurate it would be to research CIDRs to find upstream providers if answers don't come from the initial whois information?

Link to comment
Share on other sites

The whole upstream provider thing has the appearance of an arcane art (or maybe it's just the application of the third of Clarke's Laws to a tech-no like me) - but perhaps a recent example of some analysis and comment provided by Mike Easter over in the newsgroups might illustrate to either encourage or dissuade:

http://zeta.cesmail.net/pipermail/scspamco...ary/005801.html

Now I have seen that robtex provides all sorts of stuff on lookups, including "maps" showing adjacencies and so-on with hyperlinks, like http://www.robtex.com/dns/miningnews.net.html

Also SenderBase lookups will show some domain and network info with hyperlinks like

http://www.senderbase.org/senderbase_queri...=miningnews.net

(and whois lookup is provided - also provided through robtex)

And sure, you can track through CIDR reports, like

http://bgp.potaroo.net/index-cidr.html

and get allocations/AS Adjancency Reports and information like

http://www.cidr-report.org/cgi-bin/as-repo...55&view=2.0

I'm sure it is all feasible but as to the relative accuacy? Well, we certainly know much whois data is fictitious, missing or practically unavailable in spamdom's domains (and abuse.net contacts for the same are useless *at best* - maybe counter-productive) but the upstream detail should be relatively reliable.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...