: We did, and now we're solving the problem.


From: Andrew D Kirch <>

> Basically is what it boils down to for me - its
> easy to blame an NSP/ISP/Hoster for what their
> clients do, it takes real dedication to find out
> whats *actually* going on.

: We did, and now we're solving the problem.

Apparently, this is what's going on. Making money at the expense of everyone else on the internet:

> If I had the ability... I would cut Esthost as a
> client... But, in doing so, it causes nearly a
> quarter if not half of the company's monthly
> revenue to be cut. That is not too good of a move
> nor reasonably possible :wink:
> People consider Atrivo/InterCage to be some abuse
> supporting company...
> If only any of you knew what the position would be
> in a company our size.
> It's not as easy as you believe it to be :wink:
> Russell Mitchell - Russ[at]
> Atrivo Technologies

Esthost (the main problem) is actually cut off as of this morning. So
actually, they are taking steps to fix the problem.

However, as we all know, there is the real story, and then there is the
NANOG story. We should keep this all in mind, Intercage are actually
trying hard to clean up their network, and now is the time to stop with
the whining and actually help them identify the problems.

Esthost is a tricky situation because it is a significant portion of
their income... but they are offline. I would be reluctant to cut them
off too if I were in their position... not because it's the right thing
to do, but because they are such a large client that I might not be able
to pay the bills at the end of the month. If you were in their position,
wouldn't you have concerns about terminating ANY source of income that
is that large too?

That said, they should have dropped Esthost before it got that big, but
they didn't. People make bad choices, but for fucks sake, lets move on

I have also noticed that most of the people doing the whining aren't
even the people who are tracking the problem. Again, a case of the NANOG
story verses the real story...


That said, they should have dropped Esthost before it got that big, but
they didn't.

Didn't you notice that the quoted material was from *three years ago*?

And this problem didn't begin three years ago, either. For example:

From Fri Dec 5 09:53:14 EST 2003
Article: 1141964 of
From: furio ercolessi <>
Subject: AS27595 (Atrivo) here no more
Date: 5 Dec 2003 09:29:30 GMT
Organization: Spin Internetworking
Message-ID: <bqpj5q$6ra$>

After several months of spam support including routing of hijacked IP
blocks, without apparent traces of non-abuse related IP traffic, our
backbone is now stopping the exchange of IP packets with AS27595,
currently announcing the following blocks:

   Network DNSBL Upstreams
--------------- ----- ------------------ 4474 S2489 22934 4474 S2783 4474, 22934 S2453 4474 S2453 4474, 30371 S2489 4474, 22934, 30371 S2489 4474, 22934, 30371

AS4474 Global Village Communication, Inc.
AS22934 E Broadband Now Inc.
AS30371 nLayer Communications, Inc.

We are currently considering an extension of this measure to the
three entities above, which also seem to appear repeatedly in connection
with network abuses and with very little, if any, legitimate traffic
with our customers.

furio ercolessi