Re: SETI public: List Security (Ljk Viruss)

New Message Reply Date view Thread view Subject view Author view Attachment view

From: David Woolley (david_at_djwhome.demon.co.uk)
Date: Fri Sep 24 2004 - 15:05:21 PDT

  • Next message: LARRY KLAES: "SETI public: Fw: [NOVA] "Origins""

    > I'm not sure the worm is really coming from Larry; many viri spoof

    I hadn't realised it was his address being spoofed. All I saw was
    Ljk, whereas the real posts say LARRY KLAES.

         From: "Ljk" <ljk4_at_msn.com>

    It does look like they all originate from one (dial-up or DHCP) ISP:

    192.116.129.216
    192.116.129.131
    192.116.129.150 twice

    so an abuse report is probably in order.

    They seem to be in Israel. The last two resolvable addresses tracing
    towards them are:

    212.199.73.114.forward.012.net.il
    80.179.100.9.ispeednet.net

    Searching further (RIPE database), the abuse contact is
    abuse-gilat_at_012.net.il. It seems to be a satellite ISP, maybe
    appropriate given the number of SETI false positives from satellites:

    address: Gilat Satcom
    address: 21D Yagia Kapaim st. Petach-Tikva, Israel
    phone: +972 3 9255000
    fax-no: +972 3 9217938

    Source: <http://www.ripe.net/perl/whois?form_type=simple&full_query_string=&searchtext=192.116.129.150&do_search=Search>

  • Next message: LARRY KLAES: "SETI public: Fw: [NOVA] "Origins""
    New Message Reply Date view Thread view Subject view Author view Attachment view

    This archive was generated by hypermail 2.1.6 : Fri Sep 24 2004 - 15:36:54 PDT