RE: [cobalt-users] dip.t-dialin.net IP Range

["Dee Dreslough" <dee@xxxxxxxxxxx>]

>Can anyone tell me how to look up the range of IP's for
>t-dialin.net?  It is
>really starting to get annoying.

This took three steps --

1. first you have to get just one IP for that company through Ping or
something
2. then you go to Arin and find out who's handling/assigning that IP.
3. Then you go to that registrar (in this case Europe's aptly named 'Ripe'
system) and look up the company and what block of IPs they use.

Long ugly story short, the IPs used by that ISP are:
212.185.44.0 - 212.185.47.255

The Play-By-Play
======================

1.  What I did first was ping www.t-dialin.net to get one IP for them:

212.185.44.60

2. Then, I went to www.arin.net and plugged that into their Whois Search and
got this information:

European Regional Internet Registry/RIPE NCC (NET-RIPE-NCC-)
   These addresses have been further assigned to European users.
   Contact info can be found in the RIPE database, via the
   WHOIS and TELNET servers at whois.ripe.net, and at
   http://www.ripe.net/db/whois.html
   NL

   Netname: RIPE-NCC-212
   Netblock: 212.0.0.0 - 212.255.255.255
   Maintainer: RIPE

   Coordinator:
      RIPE Network Coordination Centre  (RIPE-NCC-ARIN)  nicdb@xxxxxxxx
      +31 20 535 4444
Fax- - +31 20 535 4445

   Domain System inverse mapping provided by:

   NS.RIPE.NET			193.0.0.193
   NS.EU.NET			192.16.202.11
   AUTH03.NS.UU.NET		198.6.1.83
   NS2.NIC.FR			192.93.0.4
   SUNIC.SUNET.SE		192.36.125.2
   MUNNARI.OZ.AU		128.250.1.21
   NS.APNIC.NET			203.37.255.97

   To search on arbitrary strings, see the Database page on
   the RIPE NCC web-site at http://www.ripe.net/db/

   Record last updated on 16-Oct-1998.
   Database last updated on 28-Apr-2001 22:45:44 EDT.

3. Then, you have to find out all IPs owned/used by that company.  To do
that, you go to the RIPE whois :

http://www.ripe.net/cgi-bin/whois?query=212.185.44.60

What I got from that was this:
% This is the RIPE Whois server.
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-services/db/copyright.html


inetnum:      212.185.44.0 - 212.185.47.255 <<-- There ya go!
netname:      DTOS-SERVERFARM-NET
descr:        Deutsche Telekom Online Service GmbH
descr:        Julius-Reiber-Strasse 37
descr:        64293 Darmstadt
country:      DE
admin-c:      DK162-RIPE
tech-c:       DK162-RIPE
status:       ASSIGNED PA
notify:       registry@xxxxxxxxxxx
notify:       dbd@xxxxxxxxxxx
mnt-by:       DTAG-NIC
changed:      hermann.ihler@xxxxxxxxxx 19990622
source:       RIPE


route:        212.185.0.0/16
descr:        Deutsche Telekom AG, Internet service provider, CeBIT 99
origin:       AS3320
mnt-by:       DTAG-RR
changed:      bp@xxxxxxxxxxx 19990224
source:       RIPE


person:       Daniel Kaufmann
address:      T-Online International AG
address:      Waldstrasse 3
address:      D-64331 Weiterstadt
address:      Germany
phone:        +49 61 51 680 537
fax-no:       +49 61 51 680 519
e-mail:       d.kaufmann@xxxxxxxxxxxx
nic-hdl:      DK162-RIPE
mnt-by:       UUNET-P
changed:      nobody@xxxxxxxxxxxxxxxx 19980325
changed:      nobody@xxxxxxxxxxxxxxxx 20000821
changed:      hostmaster@xxxxxxxxx 20010412
source:       RIPE

So, long ugly story short, the IPs used by that ISP are:
212.185.44.0 - 212.185.47.255

Block those, and you block these idiots. :) And, you could even write to
d.kaufmann and ask him to tell his users to stop scanning, but that might
incurr some wrath. It's easier just to drop them off the face of the planet.

-Dee Dreslough
Researcher Extrodinaire! :)