Re: [icann-eu] [ecdiscuss] Re: Horrible young sites

[Harald Alvestrand <Harald@Alvestrand.no>]

At 13:21 20/11/2000 +0100, Olivier Guillard / AFNIC wrote:
>Harald and All,
>
>First, is it normal to have such an whois info published:
>
>Registrant: 
>
>  none 
 >
>  N.J. 
 >
>  N.J., N.J. 
> 12345678 
>
>  US

no, it is stupid of NSI to allow such obviously fake information to remain.
but it would not help much if NSI did not allow obvious fakes, because 
there would still be fakes, just less obvious ones.

> > So the right place to send complaints about this is to US police.
>
>In such a case, nothing more than close the site can be expected.
>
>First bis: Only for closing, how long will it take? The URL here has been
>relayed to us lists and other organizations for a while now, the site is
>still open, nobody as tools to perform anything and nobody is responsible.

I do not know, never having tried to get the police interested.



>second, when I tarceroute something strange happens:
>
>traceroute to www.youngrussian.com (209.40.101.28), 30 hops max, 38 byte 
>packets
>  1  nic-gw ()  2.646 ms  1.606 ms  1.237 ms
>  2  rocq-gw.inria.fr (192.93.1.100)  3.855 ms  2.201 ms  4.183 ms
>  3  192.93.122.3 (192.93.122.3)  1.391 ms  1.966 ms  1.091 ms
>  4  stlambert1.rerif.ft.net (193.48.53.225)  5.366 ms  10.586 ms  9.670 ms
>  5  stamand1.rerif.ft.net (193.48.53.101)  4.637 ms  2.468 ms  2.213 ms
>  6  nio-i.cssi.renater.fr (193.51.206.145)  3.372 ms  2.919 ms  5.225 ms
>  7  193.51.206.30 (193.51.206.30)  3.433 ms  2.998 ms  2.940 ms
>  8  P2-0.PASBB2.Paris.opentransit.net (193.251.128.65)  3.325 ms  5.297 
> ms  5.160 ms
>  9  P0-3.NYKBB1.NewYork.opentransit.net (193.251.128.222)  970.471 
> ms  966.683 ms  970.271 ms
>.....
>18  covesoft-gw.customer.alter.net (157.130.43.22)  179.965 ms  167.369 
>ms  176.302 ms
>19  209.40.101.28 (209.40.101.28)  168.411 ms  171.998 ms  170.066 ms
>
>Have you noticed, 8 gateways in France, does it mean that the problem is
>also french?

No, it means that there are a lot of French routers between you and the 
operator of the transatlantic cable.

More interesting is the fact that you got a traceroute through a different 
provider than I did; this means that the guy is multiply connected, and 
gives more leads for the police to track him down - if they can be made 
interested.

At one time the site www.childporn.com (!) contained information on how to 
deal with this, I believe (together with links to the "socially 
responsible" legal porn sites who were sponsoring the site....sigh...). But 
that was long ago....

>I would be happy to have real answers to those questions.

wouldn't we all.... to my mind, something is strange; the police is using a 
great deal of resource on advocating legalized wiretaps for fighting child 
porn, and then a site such as this sit right out in the open for long 
times. Something does not seem right.....the more paranoid among us would 
suspect a honeypot; give your credit card and be arrested.....but I'm not 
that paranoid. Yet.

--
Harald Tveit Alvestrand, alvestrand@cisco.com
+47 41 44 29 94
Personal email: Harald@Alvestrand.no