Email viruses from NTL accounts
Trent SC
I'm being inundated here from the same IP address (82.13.45.60) and I must
have reported it a dozen times or more over the last 2 weeks, with no
obvious response from them. I'm beginning to get seriously pissed at
them...
Mike Tullett
<news:43351b4c$0$49769$ed2e...@ptn-nntp-reader04.plus.net>
I'm wondering if it should be Virgin you report to as that translates to
[82.13.45.60]
Hostname: client-82-13-45-60.brhm.adsl.virgin.net
However, I'm pretty clueless about the relationship between NTL and Virgin
as I use neither.
--
Mike Coleraine 55.13°N 6.69°W posted 24/09/2005 09:43:48 UTC
Trent SC
>> accounts?
>> I'm being inundated here from the same IP address (82.13.45.60) and I
>> must
>> have reported it a dozen times or more over the last 2 weeks, with no
>> obvious response from them. I'm beginning to get seriously pissed at
>> them...
>
> I'm wondering if it should be Virgin you report to as that translates to
>
> [82.13.45.60]
> Hostname: client-82-13-45-60.brhm.adsl.virgin.net
>
> However, I'm pretty clueless about the relationship between NTL and Virgin
> as I use neither.
This is what I got from www.ripe.net:
inetnum: 82.0.0.0 - 82.31.255.255
org: ORG-NI9-RIPE
netname: UK-NTLI-20030228
descr: NTL Internet
descr: PROVIDER LIR
country: GB
admin-c: NNMC1-RIPE
tech-c: NNMC1-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS5089-MNT
mnt-routes: AS5089-MNT
source: RIPE # Filtered
organisation: ORG-NI9-RIPE
org-name: NTL Internet
org-type: LIR
address: NTL House
Bartley Wood Business Park
address: RG27 9UP
address: Hook, Hampshire
address: United Kingdom
phone: +44 148 387 5105
phone: +44 125 675 3583
fax-no: +44 1483 875 150
fax-no: +44 1256 753 701
e-mail: planninginforma...@ntl.com
admin-c: NNMC1-RIPE
admin-c: BP1066-RIPE
admin-c: MH22007-RIPE
admin-c: EE1705-RIPE
admin-c: CM1377-RIPE
admin-c: NR731-RIPE
mnt-ref: AS5089-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered
role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester
address: Hampshire
address: SO21 2QA
remarks: -------------------------------------------------------
remarks: For abuse notifications please -
remarks: file an online case @ http://www.ntlworld.com/netreport
remarks: +44 1633 710142 (Voicemail Only)
remarks: -------------------------------------------------------
remarks: For peering issues/requests please -
remarks: email : pee...@ntli.net
remarks: -------------------------------------------------------
admin-c: MH22007-RIPE
admin-c: NR731-RIPE
admin-c: CW1083-RIPE
tech-c: MH22007-RIPE
tech-c: CW1083-RIPE
admin-c: NR731-RIPE
nic-hdl: NNMC1-RIPE
mnt-by: AS5089-MNT
e-mail: planninginforma...@ntl.com
source: RIPE # Filtered
% Information related to '82.12.0.0/14AS5089'
route: 82.12.0.0/14
descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
source: RIPE # Filtered
Chip
<mike.tullett1....@ntlworld.com> spake thusly in
uk.telecom.broadband:
[snip]
>I'm wondering if it should be Virgin you report to as that translates to
>
>[82.13.45.60]
>Hostname: client-82-13-45-60.brhm.adsl.virgin.net
>
>However, I'm pretty clueless about the relationship between NTL and Virgin
>as I use neither.
Virgin.net are now a 'wholly owned subsidiary' of NTL I believe. I use
virgin, and everything gets routed through NTL as you'd expect.
To the OP: Try abuse at virgin.net possibly with a cc to NTL.
Zombified PCs are probably low on their priority list but it may cause
some response.
HTH
--
We are just an advanced breed of monkeys on a minor planet of a very
average star. But we can understand the Universe. That makes us something
very special.
- Stephen Hawking
Jock Mackirdy
wrote:
Have you considered the possibility of address spoofing? My incoming
spam/virus email traffic dropped from 90% of my email to virtually zero about
a couple of months ago. Most of the viruses seemed to originate with someone
who eventually got their PC fixed.
--
Jock Mackirdy
Bedford
Trent SC
>> accounts?
>> I'm being inundated here from the same IP address (82.13.45.60) and I
>> must
>> have reported it a dozen times or more over the last 2 weeks, with no
>> obvious response from them. I'm beginning to get seriously pissed at
>> them...
>
> Have you considered the possibility of address spoofing? My incoming
> spam/virus email traffic dropped from 90% of my email to virtually zero
> about
> a couple of months ago. Most of the viruses seemed to originate with
> someone
> who eventually got their PC fixed.
Where in my post did I mention the sender's email address? I did, however,
refer to the originating IP address. What I do know from the virus which
I've been receiving (16 today) that it spoofs the email address - as so many
do - but not the header data, from which I took the IP address.
Trent SC
"Chip" <chipmu...@excite.com> wrote in message
news:d7taj15vpnt3g61gl...@news.virgin.net...
Spin Dryer
Wrong answer Jock. Who mentioned email addresses ? The OP stated the
IP address.
The user is on the virgin network, which is actually part of the NTL
system.
Both Virgin and NTL are pretty much useless when it comes to abuse
addressing. In fact, it probably wont be long until NTL goes the same
way as Telewest and have their address space listed in SPEWS.
stephen
news:VA.0000023...@ntlworld.com...
NTL implemented spam filtering over the last few months, so i think this
isnt anything to do with the original query.
as an aside - you may want to alter the options on your NTL email
account(s) - the default is to bin anything suspect
since there may be some false positives - the simplest option is to alter
the options so they are marked but still sent (NTL put [SPAM] in the
subject) then do your own filtering in the email client.
>
> --
>
> Jock Mackirdy
> Bedford
--
Regards
stephe...@xyzworld.com - replace xyz with ntl
Tony Hogarty
In a word no. I ended up filtering the IP address at the router as I was
getting so many.
--
Regards
Tony
(Take out the garbage to reply)