gojeda AKA cocacola
This is a rather drastic step, but I'm forced to make it as a warning to other members here.
On 02-02-2004, new member joined under the name gojeda. 10 posts were made within a the next week and a half, and most had to be moved or removed, as they tended to be little more than personal attacks. Several of you complained via PMs or the "Report this Post" function about him.
Last night, gojeda came back, and after seeing a fresh post starting in on the same pattern, I banned him. He immediately rejoined under the name cocacola and continued posting. aFR was then contacted and the IP address (220.127.116.11)was banned as well as the name cocacola.
This morning I recived three emails with spoofed addresses for the same IP address.
All three contained .zip files. One scanned positive for a virus/worm. While I did not bother to scan the others, I suspect that they also contained malicous code.
At this time, I have started an abuse complaint ticket at the ISP listed as controlling that IP.
Owning to the nature of some of the messages here, I suspect some other members may also be the target of malicous email. If anyone else does get some, I would urge you to contact the ISP listed below, and request an abuse complaint be lodged.
02/24/04 11:47:09 dig 18.104.22.168
Dig 22.214.171.124.in-addr.arpa ...
Recursive queries supported by this server
Query for 126.96.36.199.in-addr.arpa type=255 class=1
188.8.131.52.in-addr.arpa PTR (Pointer) user184.108.40.206.dsli.com
148.251.63.in-addr.arpa NS (Nameserver) panther.accesspro.net
148.251.63.in-addr.arpa NS (Nameserver) ns1.dsli.com
148.251.63.in-addr.arpa NS (Nameserver) ns1.dsli.net
panther.accesspro.net A (Address) 220.127.116.11
ns1.dsli.com A (Address) 18.104.22.168
ns1.dsli.net A (Address) 22.214.171.124
02/24/04 11:48:32 IP block firstname.lastname@example.org
Trying 126.96.36.199 at ARIN
Trying 209.42.47 at ARIN
OrgName: DSLi Corppration
Address: 5000 sw 75 ave
Address: 3rd Floor
NetRange: 188.8.131.52 - 184.108.40.206
NetType: Direct Allocation
Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
TechName: Iqbal, Wajid
TechName: Martinez, Roberto
OrgTechName: Bustamante, Mario M
# ARIN WHOIS database, last updated 2004-02-23 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.