CP spam, how can I track this IP - GoFuckYourself.com

Shoehorn! · 06-20-2005, 10:42 AM

Don't know if this is really accurate information or not, but this CP email has this "transaction" information in it.

* * * Transaction Posted! Payment batch #: 40485692 9 E y N* * *
--------------------------------------------------
Someone (possibly you) originating from 205.33.117.77 has requested
this information to be sent to your e-mail.
R1273740:09F1V9K2
16 .es
86377527983292782756
07
Mon, 20 Jun 2005 23:00:03 +0500
5645 18562

Can anyone trace that IP or do anything with that information?

Shoehorn! · 06-20-2005, 10:43 AM

By the way that isn't my IP.

RuthB · 06-20-2005, 10:46 AM

http://www.arin.net/whois/ try this site for IP tracing.

From the looks of it, this is the information you get from the IP you provided.

Search results for: 205.33.117.77
OrgName: DoD Network Information Center
OrgID: DNIC
Address: 7990 Science Applications Ct
Address: M/S CV 50
City: Vienna
StateProv: VA
PostalCode: 22183-7000
Country: US

NetRange: 205.0.0.0 - 205.117.255.255
CIDR: 205.0.0.0/10, 205.64.0.0/11, 205.96.0.0/12, 205.112.0.0/14, 205.116.0.0/15
NetName: JMCIS-BLOCK
NetHandle: NET-205-0-0-0-1
Parent: NET-205-0-0-0-0
NetType: Direct Allocation
NameServer: NCC.NCTS.NAVY.MIL
NameServer: GATE.NCTS.NAVY.MIL
NameServer: NS1.NOSC.MIL
Comment: DOD Network Information Center
Comment: Space and Naval Warfare Systems
Comment: Washington, DC 20363-5100 US
RegDate:
Updated: 2004-09-20

TechHandle: LS529-ARIN
TechName: Slade, Lawana
TechPhone: +1-850-452-7562
TechEmail: [email protected]

OrgTechHandle: MIL-HSTMST-ARIN
OrgTechName: Network DoD
OrgTechPhone: +1-703-676-1051
OrgTechEmail: [email protected]

# ARIN WHOIS database, last updated 2005-06-19 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database
--------------------------------------

Looks like the Department of Defence?

Shoehorn! · 06-20-2005, 10:59 AM

Quote:

Originally Posted by WEGRuth

Looks like the Department of Defence?

Thanks for the info. Although it really wouldn't surprise me all that much if it turned out to be true and someone at the DOD was buying CP. Remember that FBI agent that got caught doing the same thing last week?

SplitInfinity · 06-20-2005, 12:33 PM

Reply to the email... I dont think anyone will get it, but just in case...

Embed a hidden 1x1 transparent pixel image into the email, but make sure it is
loaded in the html off of your server... (that is, dont "attach it", but embded it in html)...

When the images loads from your server after they get the reply email you sent them, log the ip that they check it from as they have to have a web browser to view
the image so you may get a better IP to track that way.

(Note: the ip will show up in your web server logs so name the file uniquely so no one else will ever be able to load it)

Theo · 06-20-2005, 01:21 PM

Probably we received the same. Was it a blue message? I reported it to ASACP.

SplitInfinity · 06-20-2005, 05:54 PM

Good reporting it to ASACP. :-)

06-20-2005, 10:42 AM	#1
Shoehorn! Die With Your Boots On Join Date: Oct 2003 Location: Hawaii Posts: 22,872	CP spam, how can I track this IP Don't know if this is really accurate information or not, but this CP email has this "transaction" information in it. * * * Transaction Posted! Payment batch #: 40485692 9 E y N* * * -------------------------------------------------- Someone (possibly you) originating from 205.33.117.77 has requested this information to be sent to your e-mail. R1273740:09F1V9K2 16 .es 86377527983292782756 07 Mon, 20 Jun 2005 23:00:03 +0500 5645 18562 Can anyone trace that IP or do anything with that information? __________________

06-20-2005, 10:43 AM	#2
Shoehorn! Die With Your Boots On Join Date: Oct 2003 Location: Hawaii Posts: 22,872	By the way that isn't my IP. __________________

06-20-2005, 10:46 AM	#3
RuthB Let's Get Paxumized! Industry Role: Join Date: May 2005 Location: Vancouver, Canada Posts: 7,247	http://www.arin.net/whois/ try this site for IP tracing. From the looks of it, this is the information you get from the IP you provided. Search results for: 205.33.117.77 OrgName: DoD Network Information Center OrgID: DNIC Address: 7990 Science Applications Ct Address: M/S CV 50 City: Vienna StateProv: VA PostalCode: 22183-7000 Country: US NetRange: 205.0.0.0 - 205.117.255.255 CIDR: 205.0.0.0/10, 205.64.0.0/11, 205.96.0.0/12, 205.112.0.0/14, 205.116.0.0/15 NetName: JMCIS-BLOCK NetHandle: NET-205-0-0-0-1 Parent: NET-205-0-0-0-0 NetType: Direct Allocation NameServer: NCC.NCTS.NAVY.MIL NameServer: GATE.NCTS.NAVY.MIL NameServer: NS1.NOSC.MIL Comment: DOD Network Information Center Comment: Space and Naval Warfare Systems Comment: Washington, DC 20363-5100 US RegDate: Updated: 2004-09-20 TechHandle: LS529-ARIN TechName: Slade, Lawana TechPhone: +1-850-452-7562 TechEmail: [email protected] OrgTechHandle: MIL-HSTMST-ARIN OrgTechName: Network DoD OrgTechPhone: +1-703-676-1051 OrgTechEmail: [email protected] # ARIN WHOIS database, last updated 2005-06-19 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database -------------------------------------- Looks like the Department of Defence? __________________ Send & Receive Mass Global Payments - Mass P2P/Wire/EFT/SEPA - Adult Industry Friendly - Award Winning Payment Service - Fast, Reliable & Secure! Paxum ...... Paxum Bank Email: [email protected] ~ Telegram: PaxumRuth

06-20-2005, 12:33 PM	#5
SplitInfinity Confirmed User Join Date: Dec 2002 Location: San Diego, CA Posts: 3,047	Reply to the email... I dont think anyone will get it, but just in case... Embed a hidden 1x1 transparent pixel image into the email, but make sure it is loaded in the html off of your server... (that is, dont "attach it", but embded it in html)... When the images loads from your server after they get the reply email you sent them, log the ip that they check it from as they have to have a web browser to view the image so you may get a better IP to track that way. (Note: the ip will show up in your web server logs so name the file uniquely so no one else will ever be able to load it)

06-20-2005, 01:21 PM	#6
Theo HAL 9000 Industry Role: Join Date: May 2001 Posts: 34,515	Probably we received the same. Was it a blue message? I reported it to ASACP.

06-20-2005, 05:54 PM	#7
SplitInfinity Confirmed User Join Date: Dec 2002 Location: San Diego, CA Posts: 3,047	Good reporting it to ASACP. :-)