I dont think that IP is even announced - the /24 is not in the routing table at all. Did you get some spam from any specific IP in there? <div class="gmail_quote">On Mon, Mar 26, 2012 at 1:30 PM, Frank Gadegast <<a href="mailto:ripe-anti-spam-wg@powerweb.de">ripe-anti-spam-wg@powerweb.de</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi, we receive Spam from some networks we cannot find any whois record for. An example: 62.61.196.0 (we found about 1000 networks like this) ARINs whois says, its RIPE RIPEs whois says, its AFRINIC LACNIC also says, its AFRINIC but AFRINICs whois says, its "world-wide" ... So, where is this really allocated too and where can we we find a whois record for those networks ? Unallocated, but still in use from somebody ? Anybody an idea ? Here are the whois records: ARIN: NetRange: 62.0.0.0 - 62.255.255.255 CIDR: <a href="http://62.0.0.0/8" target="_blank">62.0.0.0/8</a> OriginAS: NetName: RIPE-C3 NetHandle: NET-62-0-0-0-1 RIPE: inetnum: 62.61.192.0 - 62.61.255.255 org: ORG-AFNC1-RIPE netname: AFRINIC-NET-TRANSFERRED-20050223 descr: This network has been transferred to AFRINIC remarks: These IP addresses are assigned in the AFRINIC region. AFRINIC: inetnum: 0.0.0.0 - 255.255.255.255 netname: IANA-BLK descr: The whole IPv4 address space country: EU # Country is really world wide org: ORG-IANA1-AFRINIC Kind regards, Frank -- MOTD: "have you enabled SSL on a website or mailbox today ?" -- PHADE Software - PowerWeb <a href="http://www.powerweb.de" target="_blank">http://www.powerweb.de</a> Inh. Dipl.-Inform. Frank Gadegast mailto:<a href="mailto:frank@powerweb.de" target="_blank">frank@powerweb.de</a> Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ====================================================================== </blockquote></div> -- Suresh Ramasubramanian (<a href="mailto:ops.lists@gmail.com">ops.lists@gmail.com</a>)