Email viruses from NTL accounts

Has anyone ever had any success reporting virus attacks from NTL accounts?
I'm being inundated here from the same IP address (82.13.45.60) and I must
have reported it a dozen times or more over the last 2 weeks, with no
obvious response from them. I'm beginning to get seriously pissed at
them...

On Sat, 24 Sep 2005 10:24:20 +0100, Trent SC wrote in
<news:43351b4c$0$49769$(E-Mail Removed)>

> Has anyone ever had any success reporting virus attacks from NTL accounts?
> I'm being inundated here from the same IP address (82.13.45.60) and I must
> have reported it a dozen times or more over the last 2 weeks, with no
> obvious response from them. I'm beginning to get seriously pissed at
> them...

I'm wondering if it should be Virgin you report to as that translates to

[82.13.45.60]
Hostname: client-82-13-45-60.brhm.adsl.virgin.net

However, I'm pretty clueless about the relationship between NTL and Virgin
as I use neither.

--
Mike Coleraine 55.13°N 6.69°W posted 24/09/2005 09:43:48 UTC

>> Has anyone ever had any success reporting virus attacks from NTL
>> accounts?
>> I'm being inundated here from the same IP address (82.13.45.60) and I
>> must
>> have reported it a dozen times or more over the last 2 weeks, with no
>> obvious response from them. I'm beginning to get seriously pissed at
>> them...
>
> I'm wondering if it should be Virgin you report to as that translates to
>
> [82.13.45.60]
> Hostname: client-82-13-45-60.brhm.adsl.virgin.net
>
> However, I'm pretty clueless about the relationship between NTL and Virgin
> as I use neither.

This is what I got from www.ripe.net:

inetnum: 82.0.0.0 - 82.31.255.255
org: ORG-NI9-RIPE
netname: UK-NTLI-20030228
descr: NTL Internet
descr: PROVIDER LIR
country: GB
admin-c: NNMC1-RIPE
tech-c: NNMC1-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: AS5089-MNT
mnt-routes: AS5089-MNT
source: RIPE # Filtered
organisation: ORG-NI9-RIPE
org-name: NTL Internet
org-type: LIR
address: NTL House
Bartley Wood Business Park
address: RG27 9UP
address: Hook, Hampshire
address: United Kingdom
phone: +44 148 387 5105
phone: +44 125 675 3583
fax-no: +44 1483 875 150
fax-no: +44 1256 753 701
e-mail: (E-Mail Removed)
admin-c: NNMC1-RIPE
admin-c: BP1066-RIPE
admin-c: MH22007-RIPE
admin-c: EE1705-RIPE
admin-c: CM1377-RIPE
admin-c: NR731-RIPE
mnt-ref: AS5089-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered
role: NTLI Network Management Centre
address: NTL Internet
address: Crawley Court
address: Winchester
address: Hampshire
address: SO21 2QA
remarks: -------------------------------------------------------
remarks: For abuse notifications please -
remarks: file an online case @ http://www.ntlworld.com/netreport
remarks: +44 1633 710142 (Voicemail Only)
remarks: -------------------------------------------------------
remarks: For peering issues/requests please -
remarks: email : (E-Mail Removed)
remarks: -------------------------------------------------------
admin-c: MH22007-RIPE
admin-c: NR731-RIPE
admin-c: CW1083-RIPE
tech-c: MH22007-RIPE
tech-c: CW1083-RIPE
admin-c: NR731-RIPE
nic-hdl: NNMC1-RIPE
mnt-by: AS5089-MNT
e-mail: (E-Mail Removed)
source: RIPE # Filtered
% Information related to '82.12.0.0/14AS5089'
route: 82.12.0.0/14
descr: NTL-UK-IP-BLOCK
origin: AS5089
mnt-by: AS5089-MNT
source: RIPE # Filtered

On Sat, 24 Sep 2005 10:43:48 +0100,it is alleged that Mike Tullett
<(E-Mail Removed)> spake thusly in
uk.telecom.broadband:

[snip]

>I'm wondering if it should be Virgin you report to as that translates to
>
>[82.13.45.60]
>Hostname: client-82-13-45-60.brhm.adsl.virgin.net
>
>However, I'm pretty clueless about the relationship between NTL and Virgin
>as I use neither.

Virgin.net are now a 'wholly owned subsidiary' of NTL I believe. I use
virgin, and everything gets routed through NTL as you'd expect.

To the OP: Try abuse at virgin.net possibly with a cc to NTL.

Zombified PCs are probably low on their priority list but it may cause
some response.

HTH

--
We are just an advanced breed of monkeys on a minor planet of a very
average star. But we can understand the Universe. That makes us something
very special.
- Stephen Hawking

Thanks for the heads-up - I'll get onto Virgin.


"Chip" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) n.net...
> On Sat, 24 Sep 2005 10:43:48 +0100,it is alleged that Mike Tullett
> <(E-Mail Removed)> spake thusly in
> uk.telecom.broadband:
>
> [snip]
>
>>I'm wondering if it should be Virgin you report to as that translates to
>>
>>[82.13.45.60]
>>Hostname: client-82-13-45-60.brhm.adsl.virgin.net
>>
>>However, I'm pretty clueless about the relationship between NTL and Virgin
>>as I use neither.
>
> Virgin.net are now a 'wholly owned subsidiary' of NTL I believe. I use
> virgin, and everything gets routed through NTL as you'd expect.
>
> To the OP: Try abuse at virgin.net possibly with a cc to NTL.
>
> Zombified PCs are probably low on their priority list but it may cause
> some response.
>
> HTH
>
> --
> We are just an advanced breed of monkeys on a minor planet of a very
> average star. But we can understand the Universe. That makes us something
> very special.
> - Stephen Hawking

In article <43351b4c$0$49769$(E-Mail Removed)>, Trent SC
wrote:
> Has anyone ever had any success reporting virus attacks from NTL accounts?
> I'm being inundated here from the same IP address (82.13.45.60) and I must
> have reported it a dozen times or more over the last 2 weeks, with no
> obvious response from them. I'm beginning to get seriously pissed at
> them...

Have you considered the possibility of address spoofing? My incoming
spam/virus email traffic dropped from 90% of my email to virtually zero about
a couple of months ago. Most of the viruses seemed to originate with someone
who eventually got their PC fixed.

--

Jock Mackirdy
Bedford

>> Has anyone ever had any success reporting virus attacks from NTL
>> accounts?
>> I'm being inundated here from the same IP address (82.13.45.60) and I
>> must
>> have reported it a dozen times or more over the last 2 weeks, with no
>> obvious response from them. I'm beginning to get seriously pissed at
>> them...
>
> Have you considered the possibility of address spoofing? My incoming
> spam/virus email traffic dropped from 90% of my email to virtually zero
> about
> a couple of months ago. Most of the viruses seemed to originate with
> someone
> who eventually got their PC fixed.

Where in my post did I mention the sender's email address? I did, however,
refer to the originating IP address. What I do know from the virus which
I've been receiving (16 today) that it spoofs the email address - as so many
do - but not the header data, from which I took the IP address.

On Sat, 24 Sep 2005 18:54:24 GMT, [Jock Mackirdy] said :-

>In article <43351b4c$0$49769$(E-Mail Removed)>, Trent SC
>wrote:
>> Has anyone ever had any success reporting virus attacks from NTL accounts?
>> I'm being inundated here from the same IP address (82.13.45.60) and I must
>> have reported it a dozen times or more over the last 2 weeks, with no
>> obvious response from them. I'm beginning to get seriously pissed at
>> them...
>
>Have you considered the possibility of address spoofing? My incoming
>spam/virus email traffic dropped from 90% of my email to virtually zero about
>a couple of months ago. Most of the viruses seemed to originate with someone
>who eventually got their PC fixed.

Wrong answer Jock. Who mentioned email addresses ? The OP stated the
IP address.

The user is on the virgin network, which is actually part of the NTL
system.

Both Virgin and NTL are pretty much useless when it comes to abuse
addressing. In fact, it probably wont be long until NTL goes the same
way as Telewest and have their address space listed in SPEWS.

"Jock Mackirdy" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> In article <43351b4c$0$49769$(E-Mail Removed)>, Trent
SC
> wrote:
> > Has anyone ever had any success reporting virus attacks from NTL
accounts?
> > I'm being inundated here from the same IP address (82.13.45.60) and I
must
> > have reported it a dozen times or more over the last 2 weeks, with no
> > obvious response from them. I'm beginning to get seriously pissed at
> > them...
>
> Have you considered the possibility of address spoofing? My incoming
> spam/virus email traffic dropped from 90% of my email to virtually zero
about
> a couple of months ago. Most of the viruses seemed to originate with
someone
> who eventually got their PC fixed.

NTL implemented spam filtering over the last few months, so i think this
isnt anything to do with the original query.

as an aside - you may want to alter the options on your NTL email
account(s) - the default is to bin anything suspect

since there may be some false positives - the simplest option is to alter
the options so they are marked but still sent (NTL put [SPAM] in the
subject) then do your own filtering in the email client.
>
> --
>
> Jock Mackirdy
> Bedford
--
Regards

(E-Mail Removed) - replace xyz with ntl

On Sat, 24 Sep 2005 10:24:20 +0100, Trent SC wrote:

> Has anyone ever had any success reporting virus attacks from NTL accounts?
> I'm being inundated here from the same IP address (82.13.45.60) and I must
> have reported it a dozen times or more over the last 2 weeks, with no
> obvious response from them. I'm beginning to get seriously pissed at
> them...

In a word no. I ended up filtering the IP address at the router as I was
getting so many.

--
Regards
Tony
(Take out the garbage to reply)