Peerblock - Spammed by eNom?

Posted: Wed Sep 08, 2010 9:16 am

I'm getting endless rapid access attempts by eNom, with the ip of 98.124.199.1

I get this info:

Quote:

98.124.199.1 - Geo Information
IP Address 98.124.199.1
Host redirector-sjl.enom.com
Location US US, United States
City Bellevue, WA 98008
Organization eNom, Incorporated
ISP eNom, Incorporated
AS Number AS21740 eNom, Incorporated
Latitude 47°60'51" North
Longitude 122°11'34" West
Distance 9416.63 km (5851.22 miles)

NetRange: 98.124.192.0 - 98.124.255.255
CIDR: 98.124.192.0/18
OriginAS: AS21740
NetName: DEMANDMEDIA-2
NetHandle: NET-98-124-192-0-1
Parent: NET-98-0-0-0-0
NetType: Direct Assignment
NameServer: DNS1.DEMANDMEDIA.COM
NameServer: DNS2.DEMANDMEDIA.COM
NameServer: DNS3.DEMANDMEDIA.COM
RegDate: 2008-06-17
Updated: 2010-02-03
Ref: http://whois.arin.net/rest/net/NET-98-124-192-0-1

OrgName: eNom, Incorporated
OrgId: ENOM
Address: 15801 NE 24th Street
City: Bellevue
StateProv: WA
PostalCode: 98008
Country: US
RegDate: 2001-06-15
Updated: 2010-02-03
Comment: Domain Related inquiries please contact our helpdesk at 425-274-4500 (http://www.enom.com/help/).
Ref: http://whois.arin.net/rest/org/ENOM

OrgAbuseHandle: DEMAN-ARIN
OrgAbuseName: DemandMedia NOC
OrgAbusePhone: +1-425-274-4500
OrgAbuseEmail: dmnoc@demandmedia.com
OrgAbuseRef: http://whois.arin.net/rest/poc/DEMAN-ARIN

OrgTechHandle: RSI80-ARIN
OrgTechName: Singh, Raj
OrgTechPhone: +1-425-274-4500
OrgTechEmail: raj.singh@demandmedia.com
OrgTechRef: http://whois.arin.net/rest/poc/RSI80-ARIN

OrgNOCHandle: DEMAN-ARIN
OrgNOCName: DemandMedia NOC
OrgNOCPhone: +1-425-274-4500
OrgNOCEmail: dmnoc@demandmedia.com
OrgNOCRef: http://whois.arin.net/rest/poc/DEMAN-ARIN

RNOCHandle: DEMAN-ARIN
RNOCName: DemandMedia NOC
RNOCPhone: +1-425-274-4500
RNOCEmail: dmnoc@demandmedia.com
RNOCRef: http://whois.arin.net/rest/poc/DEMAN-ARIN

RAbuseHandle: DEMAN-ARIN
RAbuseName: DemandMedia NOC
RAbusePhone: +1-425-274-4500
RAbuseEmail: dmnoc@demandmedia.com
RAbuseRef: http://whois.arin.net/rest/poc/DEMAN-ARIN

RTechHandle: RSI80-ARIN
RTechName: Singh, Raj
RTechPhone: +1-425-274-4500
RTechEmail: raj.singh@demandmedia.com
RTechRef: http://whois.arin.net/rest/poc/RSI80-ARIN

This stuff isn't my forte, so I dunno what to make of this, other than the fact that one of the bigger domain providers or whatever, reeeeaaally wants to see what I'm up to....

Anybody else being spammed?

EDIT: On double checking the list, I noticed that the source was ME, the destination was eNom. I wondered what could be transmitting, so I checked my taskmanager....What do you know, uTorrent didn't close properly (wasn't on my tray, but was still there using the memory). I ended the process and it stopped rapidly spamming me with access updates.

Posted: Wed Sep 08, 2010 9:45 am

Enom is just a domain name registrar. That is also a large IP range/subnetwork.

What ports were involved? I wonder if you may have just had a tab open to some website that demand media owns. Are you sure that your torrent client was involved?

Read more about Demand Media:

http://en.wikipedia.org/wiki/Demand_Media

I don't think you should be worried about Demand Media nor eNom.

On the other hand, another entity is probably using that IP address.

EDIT:

Wikipedia wrote:

Demand Media’s acquisition of Pluck.com in 2008 gave it the means to provide specialized content and social media platforms to any website.[15] The content comes with advertising attached. The website owners get free content for their sites and split the advertising revenue with Demand Media. This hybrid Internet publishing model has been referred to as Curated Social Content.[26] It is a combination of Enterprise Generated Media, such as newspapers, and consumer-generated media, such as blogs.

Posted: Wed Sep 08, 2010 10:44 am

I am guessing the ports were 59725 and 27017 (it comes after a colon after the Source and destination IP respectively)

Like I said, it stopped after I force-ended the utorrent process. I wasn't on a website and I didn't have anything special open.