<<Are you sure the jerk who is harassing you is located at:
md.dialup.rcn.com>>
-
Yes, that's the top four levels of domain. The exact IP
number varies from time to time, as does the exact host name
which contains the IP number coded within it. For example,
at various times when he harassed me on IRC the host was
exactly:
>216-164-237-1.s1.tnt9.lnh.md.dialup.rcn.com
>216-164-238-94.s348.tnt9.lnh.md.dialup.rcn.com
>216-164-229-144.s398.tnt8.lnh.md.dialup.rcn.com
>216-164-230-44.s44.tnt7.lnh.md.dialup.rcn.com
One harassing e-mail to my Yahoo account shows:
>Received: from smtp-hub.mrf.mail.rcn.net (207.172.4.107) by ...
>Received: from smtp03.mrf.mail.rcn.net ([207.172.4.62]) by ...
>Received: from 216-164-224-4.s4.tnt6.lnh.md.dialup.rcn.com ([216.164.224.4] helo=erols.com) by ...
So apparently on IRC he runs mirc or somesuch on his PC to
connect directly via PPP and IP to superchat.org, whereas
for e-mail he uploads to smtp03.mrf.mail.rcn.net which
forwards it to a main hub before finally delivering to
Yahoo.
-
<<I went to use neotrace to locate this and it came up that
the host could not be resolved and asked that I check the
spelling.>>
-
Apparently neotrace can't look up a domain, but needs some
exact host name or IP number, sigh. Try on any of the host
names I listed above. nslookup shows for example:
>*** ... can't find 216-164-237-1.s1.tnt9.lnh.md.dialup.rcn.com: Non-existent host/domain
but guessing the IP number is the set of four numbers 216.164.237.1
apparently encoded in the host name, nslookup says:
>Name:    c3-0.sfpo-ubr3.sfrn-sfpo.ca.cable.rcn.net
And traceroute to 216.164.237.1 shows:
>4  erols-gate-100Mbps.above.net (209.249.140.21)  14.383 ms  4.149 ms  3.872 ms
>5  poet2-0.core3.sfrn.ca.rcn.net (207.172.19.138)  5.154 ms  15.099 ms  19.919 ms
>6  ge1-0-0.gw2.sfrn.ca.rcn.net (208.59.255.2)  71.889 ms ge5-0-0.gw2.sfrn.ca.rcn.net (208.59.255.23)  107.273 ms  93.507 ms
>7  * * *
>8  *^C (it was obviously hung because 216.164.237.1 isn't online currently, so I aborted at that point)
Spamcop gives me:
>216-164-237-1.s1.tnt9.lnh.md.dialup.rcn.com = Cannot find master
>nslookup 216.164.237.1 = c3-0.sfpo-ubr3.sfrn-sfpo.ca.cable.rcn.net
> Found abuse address:abuse@rcn.com
>nslookup 208.59.255.2 = ge1-0-0.gw2.sfrn.ca.rcn.net
> Found abuse address:abuse@rcn.com
>nslookup 207.172.4.107 = smtp-hub.mrf.mail.rcn.net
> Found abuse address:abuse@rcn.com
i.e. all the various addresses, except those which don't
currently exist in DNS, including the last relay site shown
by TraceRoute, yield a consistent where-to-complain address
from SpamCop. So full-header -> TraceRoute -> SpamCop seems
to be a winning pipeline for learning where to complain.