researchtoolssurveys Factory


The Case of the Disconnected Spammer, 2004-01-18

On Jan 18th, our DNS root server measurements showed a sudden increase in traffic. It lasted for a little more than two days. Note in the graph below that about 12 hours after the initial spike, there is another increase. The second increase is mostly in MX, AAAA, and A6 records. The AAAA/A6 queries are for [a-m], because those records timed out of the clients caches after not getting any responses for 12 hours.

The high number of MX queries should be a tip-off to what was going on here...

These graphs show that a single /24 network is responsible for a significant amount of the traffic. About 1700 queries/second averaged over the first 17 hours of Jan 19th! Or 35% of all queries received during that period.

This is a much higher rate than we normally see from abusive sources. I wonder how many different hosts are involved?

> tcpdump -n -i em0 -c 100000 src net 207.244.46 | awk '{print $2}' | sort | uniq


I wonder if they have reverse DNS set up correctly?

> host domain name pointer
> host domain name pointer
> host domain name pointer
> host domain name pointer
> host domain name pointer


Let's see who this network belongs to:

> whois -a
Chattanooga Data Connection, Inc. CHATDATA (NET-207-244-0-0-1)
Success Marketing Associates, LLC CDC-LEASED-IAG-40 (NET-207-244-40-0-1)

Success Marketing, you say?

> whois -a NET-207-244-40-0-1

OrgName:    Success Marketing Associates, LLC
OrgID:      SMAL-3
Address:    701 N. Green Valley Parkway
Address:    Suite 200
City:       Henderson
StateProv:  NV
PostalCode: 89074
Country:    US

NetRange: -
NetName:    CDC-LEASED-IAG-40
NetHandle:  NET-207-244-40-0-1
Parent:     NET-207-244-0-0-1
NetType:    Reassigned
RegDate:    2005-01-10
Updated:    2005-01-10

OrgTechHandle: IPMAN10-ARIN
OrgTechName:   IP Manager
OrgTechPhone:  +1-800-477-1477

Hm, a network recently registered with ARIN? We sent a friendly email to After a short wait, here is the reply:

Hi. This is the qmail-send program at
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

This address no longer accepts mail.

You're not the only one who's sorry...

Let's try their ISP:

> whois -a NET-207-244-0-0-1

OrgName:    Chattanooga Data Connection, Inc.
OrgID:      CHAT
Address:    PO Box 5269, 2003 Amnicola Hwy.
City:       Chattanooga
StateProv:  TN
PostalCode: 37406
Country:    US

NetRange: -
NetName:    CHATDATA
NetHandle:  NET-207-244-0-0-1
Parent:     NET-207-0-0-0-0
NetType:    Direct Allocation
RegDate:    1996-11-06
Updated:    2002-02-08

TechHandle: CNO2-ARIN
TechName:   Network Operations Center
TechPhone:  +1-423-266-3369

We phoned 423-266-3369. An automated system gives us three choices: one for tech support, two for accounting information, three for sales. Tech support should be able to help.

Sadly, no. The woman we spoke with insisted that I call back and speak with someone in sales, because they are "in the other building." I am not making this up!

Maybe goes to a more clueful person than the one who answers tech support calls. We sent another message to I didn't bounce, but we haven't received a reply yet. Probably shouldn't be surprised since they can't even run a web site.

At this point we wondered if Chattanooga Data Connection was indeed the ISP for Success Marketing Associates, LLC (or whoever is sourcing these packets). A traceroute reveals:

# traceroute -n
traceroute to (, 64 hops max, 40 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *

Wow, so our first-hop router doesn't have a route for this network?>show ip route
% Network not in table

I see.... I wonder where this traffic is really coming from?

Seems like either this IP space was hijacked, or someone was using it before, and then it broke. We decided to download a bunch of the archived BGP tables from routeviews and find out if anyone was recently advertising this space. The results:

2005-01-01-0000:*                          0 7911 6389 6387 25817 21529 i
2005-01-02-0000:*            11             0 2914 209 25817 25817 25817 21529 i
2005-01-03-0000:*            11             0 2914 209 25817 25817 25817 21529 i
2005-01-04-0000:*             3             0 4513 701 6389 6387 25817 21529 i
2005-01-05-0000:*             3             0 4513 701 6389 6387 25817 21529 i
2005-01-06-0000:*             3             0 4513 701 6389 6387 25817 21529 i
2005-01-07-0000:*                        0 6939 6389 6387 25817 21529 i
2005-01-12-0000:*                          0 1221 4637 6461 30092 i
2005-01-13-0000:*           0             0 5650 6461 30092 i
2005-01-14-0000:*           0             0 5650 6461 30092 i
2005-01-15-0000:*             0             0 16150 15703 20495 6461 30092 i
2005-01-16-0000:*             6             0 2914 6461 30092 i
2005-01-17-0000:*             0             0 16150 15703 20495 6461 30092 i
2005-01-18-0000:*            0             0 2905 701 6461 30092 i

AS 21529 is the aforementioned, clue-deprived Interesting that the space was more recently advertised by AS 30092, which turns out to be

I wrote to the NOC at and received a quick and friendly reply from Chris Phillips. Turns out this space was announced by them on behalf of a new customer that turned out to be a spammer. Although the route was withdrawn, apparently their boxes remained connected. Assertive Networks disconnected their servers a short while later, and the flood of queries stopped.

Todays Internet Lesson: Don't just withdraw routes to spammers, yank the network cables out of their boxes!