An especially virulent affiliate marketing campaign was noted today, from a /23 on Stealthy Networks. While it is nice that they have an rwhois server, it doesn’t help the community when registered as ‘Private Customer’. Is it the same as the other Private Customers? This one /23 which lit up the internet sending from a domain ‘robintool.net’, (162.251.68.0/23) was detected at huge swathes of ISP’s over a 12 hour period. You have to assume the provider can see what is going on, unless they just rented the IP Space out. Says that the ‘customer’ is Seattle based, but that might just be because Stealthy says it is from there. Inaccurate rwhois information? or… Hmm.. maybe they are related? Just saying… ps whois says that robintool.net, isn’t registered..
Suggests that you might like to have your spam filters reject anything where the rDNS domain does not come back with rwhois information.