Abuse


#1

I am a teacher, and one of my websites is my classroom website with schedules, links, etc.
One of my students signed the guestbook (anonymously of course) with some really bad message.
I know that I can report this to their ISP and get them in trouble. But how can I find out their ISP and do this?
I have their IP address and the date/time stamp of:

Time Stamp: Saturday, February 15th 2003 - 10:13:14 PM
IP: 204.244.197.24

Raven Oak


www.torifest.com
www.6-58.com


#2

Here’s a start.

From a shell, I got
[dali]$ host 204.244.197.24
Name: MAX1-24.PERF.BC.CA
Address: 204.244.197.24

Then I went to http://www.internic.net/, clicked on the Registrars link, and clicked on Listing by Location of Registrar. That got me to http://www.internic.net/origin.html. Since the domain is Canadian, I went for TuCows, since they are pretty big and handle .ca registrations

At tucows.com, there is a box in the lower left that says WHOIS Lookup. Entering perf.bc.ca returns a lot of info, including:

Description: PerfeKt Programming provides computer sales and support to the public and commercial organizations of Mackenzie, B.C. Local ISP to service the community.
Admin-Name: Mr Neil Smith
Admin-Title: President
Admin-Postal: Perf Investments Ltd.
Perf Investments Ltd.
358 dba PerfeKt Programming
Mackenzie BC V0J 2C0 Canada
Admin-Phone: +1 (250) 997-5125
Admin-Fax: +1 (250) 997-4755
Admin-Mailbox: sales@perf.bc.ca
Tech-Name: Neil Smith
Tech-Title: President
Tech-Postal: PerfeKt Programming
358 Mackenzie Centre Mall
Mackenzie BC V0J 2C0 Canada
Tech-Phone: +1 (250) 997-5125
Tech-Fax: +1 (250) 555-4755


#3

Well, I thought it was a student, but I’m not in Canada. Could this really be the ISP of a person living in Texas?
Or was it more likely some creep who just googled his way to the site?

Raven


www.torifest.com
www.6-58.com


#4

From the registration info and the website, it sounds like this is a pretty small ISP. Check out the ISP’s home page. You gotta love the photo of the World’s Largest Tree Crusher.

It’s hard to say without knowing more about what was posted. Also, I’m assuming the IP Address is accurate and not forged by whoever posted the info.

Did the post include info that only a local student would know? Obviously, if the post referred to any information that was already easily accessible on the website (like names, recent events, etc.), anyone could have gotten that information before posting.


#5

[quote]One of my students signed the guestbook (anonymously of course) with some really bad message.

[/quote]

What make you think so sure that it’s one of your students?

P.S. I was once a teacher myself (for some 7 years). :slight_smile:


Alleged Cybersquatter - knows a thing or two about domain names
http://www.nameslave.com


#6

They posted the following:

“ur a gay teacher
foo u
ur a gay teacher and u suck u just foo around foo u go foo ur husband ta ta ta ta let him stick hat thang in ur thing and sream and then put chocolate on ur tits and let him lick it offfffffffffffffffffffffffffffffffffff”

The IP address is the one reported by Dreambook so I doubt they made it up.
It says on my page that I’m married so I guess it wouldn’t be hard to come up with the info but I’ve recently had trouble with a couple of my students in my guestbook so I felt this was probably more that than just some weirdo. I could be wrong.

I figured I’d ask ya’ll since you know more about the IP tracing than I.

Thanks for the help, btw!

Raven


www.torifest.com
www.6-58.com


#7

I emailed the ISP. We’ll have to see what next.
Thanks for the help all.

Raven


www.torifest.com
www.6-58.com


#8

It’s usually better to look for the organization who is delegated a particular block by consulting the appropriate registry - in this case ARIN.

I’d send the complaint to:

TechHandle: AD233-ARIN
TechName: Domain Administrator, Administrator
TechPhone: +1-877-477-5266
TechEmail: abuse@westel.com

OrgAbuseHandle: ABUSE127-ARIN
OrgAbuseName: Abuse Complaints
OrgAbusePhone: +1-877-477-5266
OrgAbuseEmail: Abuse@navigata.net

as well as possibly to postmaster / abuse at perf.bc.ca (the organization to which the smaller block is registered to. However, note that unless there is a threat of violence in the post, the ISP will most likely not take action (and in any event, they will not be able to give you information about the user, although they might kick them off).