sweetlemon@sphere:~> ping 77.Red-80-39-158.dynamicIP.rima-tde.net
PING 77.Red-80-39-158.dynamicIP.rima-tde.net (80.39.158.77): 56 data bytes
-[snip]-

sweetlemon@sphere:~> whois -h whois.ripe.net -p 43 80.39.158.77
-[snip]-

% Information related to '80.36.0.0 - 80.39.255.255'

inetnum: 80.36.0.0 - 80.39.255.255
netname: RIMA
descr: TELEFONICA DE ESPANA
descr: Provider Local Registry
country: ES
admin-c: ATDE1-RIPE
tech-c: TTDE1-RIPE
status: ASSIGNED PA
mnt-by: MAINT-TdE
mnt-lower: MAINT-TdE
mnt-routes: MAINT-TdE
source: RIPE # Filtered

role: Administradores Telefonica de Espana
address: Ronda de la Comunicación s/n
address: Edificio Norte 1, planta 6ª
address: 28050 Madrid
address: SPAIN
org: ORG-TDE1-RIPE
admin-c: ADT89-RIPE
tech-c: TTE2-RIPE
nic-hdl: ATdE1-RIPE
mnt-by: MAINT-TdE
abuse-mailbox: [email protected]
source: RIPE # Filtered

role: Tecnicos Telefonica de Espana
address: Emilio Vargas, 4
address: 28043-MADRID
address: SPAIN
org: ORG-TDE1-RIPE
admin-c: TTE2-RIPE
tech-c: TTE2-RIPE
nic-hdl: TTdE1-RIPE
mnt-by: MAINT-TdE
abuse-mailbox: [email protected]
source: RIPE # Filtered

% Information related to '80.39.0.0/16AS3352'

route: 80.39.0.0/16
descr: RIMA (Red IP Multi Acceso)
origin: AS3352
mnt-by: MAINT-TdE
source: RIPE # Filtered


http://www.telefonica.com/home_eng.shtml

I'd goto the contact page, and call them up. Also email the bolded abuse email above. Can't really say how helpful it is because ISP's abuse emails sometimes goes to the bit bucket (the void).

No clue how helpful they will be, and if they even speak english. But telefonica.es owns this block. Spainish ISP. This looks to be a DSL residential line. If they say it's not their customer blocks, it could be a wholesale customer of theirs (mention rima-tde.net).



This info isn't much. This could also be a pwned pc who's set to proxy everything from the hackers real origin.