Originally Posted by stimpy
Sarah,
I don't have time to go through your message right now (day job and all), but I recall I did a quick traceroute to the IP address source of the visiongain email and it was NTL. It looks like you did a lot of work. I will try to poke through it when I get a chance.
But don't get hung up on DNS as it is inheirently unsecure and abused. Stick to the IP addresses.
Stimpy, I think you've just shot yourself in the foot and I don't think you're doing yourself any favours. If you used traceroute you were relying entirely on DNS information to give you a host lookup for every host on the route to the destination. However, DNS is
not inherently insecure as you state and without it the internet wouldn't work. I'm not at all sure that you understand the way the internet works quite as well as you think you do.
When you read my post you'll see that I take the IP addresses and do a WHOIS query. This isn't DNS but a separate system. It is a much more powerful (and accurate) tool than simply using traceroute (which I have to say is the amateur sleuth method). The netblock that contains the Visiongain originating IP address has belonged to Claranet at least since April 2003 and probably longer so there's no way you should have come up with NTL. I've just done a traceroute to that IP address from a host in the USA and the route goes nowhere near NTL. I know for a fact that Claranet doesn't rely on NTL connectivity either.