ROKSO Home  |  ROKSO FAQs & Policies  |  About Spamhaus  |  FAQs
The Register of Known Spam Operations

Evidence Menu:

zombies Index

Not a spammer or spam gang, but a "tag" where we place hijacked ("zombie") IP address blocks. These are re-tagged when we find the spam gang behind the hijack.

zombies SBL Listings History
Current SBL Listings
Archived SBL Listings

The hijacking of Los Angeles county

Hijacked and routed to host Emil Kacperski's Atrivo hosting operation. When caught, Emil had much trouble keeping his stories straight.

Related URLs ! NET-170-208-0-0-1
This was the hijacked Los Angeles County ISD network block.

On 27 April 2003 he first states:
ISD was run by my partner when I owned a computer store here in NorthernCalifornia. There is absolutely no way I can get access to his e-mail that happened years ago. As you know there is no such thing as owning ip's from arin, they are simply allocated. It's just mind boggling to think that I and Atrivo would be punished for updating the record to a "current" phone and address. ISD is now Atrivo and all contact details provided are valid.

Atrivo - Web Innovation
Emil Kacperski
Phone: 925-550-3947
ICQ: 23531098
The information may have been "valid", but that is akin to putting ones licence plate on a stolen car and claiming the vehicle now belongs to you. If Emil would have bothered to do some research, he would have discovered that ISD stood for the "Internal Services Department" of Los Angeles County.

A month later on 30 May 2003 when the evidence became overwhelming he changed the tale to:
The person't name was James Dyer, we was introduced to me as a IP broken who had access to big blocks. Of course I never imagined that he would be jacking them. In fact when I did bring up the notion if this was normal, he claimed that many big companies use "borrowed space". Guess you learn something everyday, we have no intention of using any blocks he has provided and already out of 170.208 and will be out of 128.121.128 by next week.
And on 28 June 2003 he modified this to:
Let's see if we can clarify this once and for all. ISD owner was a good friend of mine and helped me when I ran a computer store. Without him I couldn't run the store and over the years I have repaid him for his contributions. A few years ago I closed the computer store and started Atrivo. At first we acquired /24's direct from the providers themselves and was statically routing everything.

Contact: Emil Kacperski
Company: Atrivo
180 Golf Club Road #118
Pleasant Hill/CA 94596
Phone: 925-550-3947
ICQ: 23531098
The entry for this hijacked Los Angeles County ISD network block was:
OrgName:    ISD 
OrgID:      ISD-1
Address:    9150 E. Imperial Hwy
City:       Downey
StateProv:  CA
PostalCode: 90242
Country:    US

NetRange: - 
NetName:    LANET-1
NetHandle:  NET-170-208-0-0-1
Parent:     NET-170-0-0-0-0
NetType:    Direct Assignment
RegDate:    1995-01-05
Updated:    2003-06-17

RTechHandle: DS127-ARIN
RTechName:   Shelley, Dennis 
RTechPhone:  +1-310-940-2224

OrgTechHandle: DS127-ARIN
OrgTechName:   Shelley, Dennis 
OrgTechPhone:  +1-310-940-2224
Once the Los Angeles County government was informed, they managed to reclaim their stolen allocation and have been routing it ever since.

The other hijacked block was eventually revoked by ARIN, but historically it was:
OrgName:    Ready Systems 
OrgID:      RADY
Address:    2213 Goody Dr.
City:       Houston
StateProv:  TX
PostalCode: 23541
Country:    US

NetRange: - 
NetName:    READY-NET
NetHandle:  NET-138-121-0-0-1
Parent:     NET-138-0-0-0-0
NetType:    Direct Allocation
RegDate:    1990-05-14
Updated:    2003-05-28

TechHandle: JT129-ARIN
TechName:   Thomson, James 
TechPhone:  +1-888-851-4021
After this, Emil paid for his own IP address space lease from ARIN to host the spammers and cybercriminals he caters to, but that is another story.

The Register of Known Spam Operations (ROKSO) collates information and evidence on entities with a history of spamming or providing spam services, and entities affiliated or otherwise connected with them, for the purpose of assisting ISP Abuse Desks and Law Enforcement Agencies.
The address of this ROKSO record is:

The above consists of information in the public domain. The Spamhaus Project makes every effort to avoid errors in information in the ROKSO database, and will correct any errors as soon as it is able to verify the correction, but accepts no responsibility or liability for any errors or omissions, or liability for any loss or damage, consequential or otherwise, incurred in reliance on the material in these pages. The Spamhaus Project makes no warranties or representations as to the accuracy of the Information in ROKSO records. The information in the ROKSO database is for information purposes only and is not intended as legal advice of any kind.

For information on contacting the ROKSO Team regarding any factual errors in this record, see the ROKSO FAQs.
© 1998-2016 The Spamhaus Project Ltd. All rights reserved.
Legal  |  Privacy