[nsp-sec] Contact for theplanet.net - phish take-down

[Chris Calvert]

Marc tells me that the direct contact Jose provided for this bounced.  Our Abuse folks are trying to make contact, but without success to date.

BTW Team Cymru folks, the whois doesn't list the abuse contact despite it being in the ARIN whois info:
AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | Abuse
21844   | 70.86.17.98      | 70.84.0.0/14        | US | arin     | 2004-07-29 | NO_CONTACT

NetRange:   70.84.0.0 - 70.87.255.255 
CIDR:       70.84.0.0/14 
OriginAS:   AS13749,  AS21844,  AS30315,  AS36420

chris

> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net [mailto:nsp-security-
> bounces at puck.nether.net] On Behalf Of Marc Kneppers
> Sent: Friday, October 02, 2009 2:29 PM
> To: 'NSP-Sec'
> Subject: [nsp-sec] Contact for theplanet.net - phish take-down
> Importance: High
> 
> ----------- nsp-security Confidential --------
> 
> Hi
> 
> Do we have anyone from theplanet.net on the list? If not, does anyone have a
> contact?
> 
> It is hosting a phishing site that is getting good success with our user
> base:
> 	http://www.artoodle.net/telus.net.php
> 
> 	bash-2.03$ whois -h whois.arin.net 70.86.17.98
> 
> 	OrgName:    ThePlanet.com Internet Services, Inc.
> 	OrgID:      TPCM
> 	Address:    315 Capitol
> 	Address:    Suite 205
> 	City:       Houston
> 	StateProv:  TX
> 	PostalCode: 77002
> 	Country:    US
> 
> -
> MArc Kneppers
> Security Architecture, Design Authority
> TELUS
> AS852
> 
> 
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
> 
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security
> counter-measures.
> _______________________________________________