I check these things at
http://www.spamcop.net/w3m?action=checkblock&ip=69.95.44.90.

It is "Choice One Communications", which you probably already knew.  But the
ip you gave is theirs (I think) not the original villian's.

This spamcop page is open to non-spamcop users, in fact I found out about it
because they were blocking some of our messages because of the headers
included an ip number that belongs to our isp, not us.  But since they are
messing us up by blocking our legitimate messages, I don't feel guilty about
using their page as a tool to check any suspicious ip# I see in a message
header when I am deciding whether to open a message or not.

----- Original Message ----- 
From: "Greg Stigers" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Tuesday, December 06, 2005 15:05
Subject: [HP3000-L] Sober sender's IP address


> We have three users who have gotten 864 Sober.X viral email, all from the
> same IP address.
> Received: from bdfbn.gov ([69.95.44.90]) by mail.munged.com with Microsoft
> SMTPSVC(6.0.3790.1830); Tue, 29 Nov 2005 10:47:40 -0500
>
> Unfortunately, whois tells me:
> NetRange:   69.95.0.0 - 69.95.191.255
> CIDR:       69.95.0.0/17, 69.95.128.0/18
> Not surprisingly, my attempts to reach someone at the service provider have
> fallen on deaf hears, not that I expected much else. Is there some clever
> way to track down who might own the IP address in question?
>
> Greg Stigers
>
> * To join/leave the list, search archives, change list settings, *
> * etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
>

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *