October 1998 - NANOG - lists.nanog.org

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Dean Anderson 02 Oct '98

02 Oct '98

> > We now return you to TongaV8, in progress.. > > ^^^^^^^ > > Karl Whats this mean?? --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Milk attack
by Steve Nash 02 Oct '98

02 Oct '98

Im curious if anyone knows of the "milk" attack. Our network was just slammed by such an attack for about an hour all aimed at one of our core routers. A "sh ip cache x.x.x.x x.x.x.x fl" on it showed this: SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts B/Pk Active Fa0/0 208.10.5.2 Local X.X.X.X 11 0498 0017 164K1028 985.3 except from 10 to 15 hosts all nailing us at the same time. The protocol as you see is "11" which I have been unable to find information about. There was no way to filter it and access-lists denying protocol "11" showed 0 matches. Anyone have any ideas? -- \\|// -(@ @)- ==oOO==(_)==OOo========================================================= Steven Nash snash(a)lightning.net l i g h t n i n g i n t e r n e t s e r v i c e s l l c Chief Backbone Engineer -- Network Engineering http://www.lightning.net

3 2

The Man would like to know [was: Is the .to (Tonga) domain completely rogue and should beremoved?}
by scott w 02 Oct '98

02 Oct '98

"His view was that the US host so many smut sites and many other things yet they continue. So why is it that the Kingdom of Tonga that is trying to make some money from domain name registrations is the subject of so much debate. He said it does not make any sense. He said he will have someone look into the matter though."

1 1

Re: A Message from Exodus (fwd)
by Dean Anderson 02 Oct '98

02 Oct '98

At 05:54 PM 10/1/98 -0400, Adam Rothschild wrote: >Uggggh. So many people have requested this privately, I can't take it! > >So, here goes. Note that some of the information in the spam is totally >false. Some is just plain funny/silly, such as: > >"If GTE/BBN has a brown-out tomorrow, their customers are out of luck if >their network fails. At Exodus, traffic for all of our customers would >just get rerouted either though our own backbone, or through another major >Internet carrier (like UUNet)." IF their network failed, they would be out of luck... ;-) IF the GTE customer fails, Exodus customers would get rerouted... Thats reassuring ;-) Marketing speak. Gotta love it. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: Is the .to (Tonga) domain completely rogue an
by egullich＠tonic.to 01 Oct '98

01 Oct '98

Mr. Shein: > With all due respect, I think your management of the .to domain is a > hazard to the internet and should be ceased immediately. By your gross > negligence you are providing safe haven to criminals. I'm sorry, but your reply leaves me somewhat mystified. If you could be more specific as to what acts of "gross negligence" you believe Tonic is guilty of in its management of the .TO top level domain, we would take your opinions under serious evaluation and see if there are ways we could improve the operation of our registry. > As of this minute, about 2:30PM EDT 10/1/98, the domain-hijacker > spammers have a web address in the .to domain and are > spamming/domain-forging to advertise this, as they have been > doing for weeks. In my last posting, I brought to your attention the existence of our pioneering antispam policy. If you could be specific as to which "domain-hijacker spammers have a web address in the .to domain" and send a copy of the spam(s) to hostmaster(a)tonic.to, we would be able to warn the domain name holders, and/or terminate their domain name registration if they are in repeated violation of our antispam policy. Regards, - Eric Gullichsen Tonic Corporation Kingdom of Tonga Network Information Center http://www.tonic.to Email: egullich(a)tonic.to

3 2

Re: A Message from Exodus (fwd)
by Sanjay Dani 01 Oct '98

01 Oct '98

> Uggggh. So many people have requested this privately, I can't take it! > > So, here goes. Note that some of the information in the spam is totally > false. Some is just plain funny/silly, such as: > > "If GTE/BBN has a brown-out tomorrow, their customers are out of luck if > their network fails. At Exodus, traffic for all of our customers would > just get rerouted either though our own backbone, or through another major > Internet carrier (like UUNet)." Looks like revenue desperation. What with the tanking stock market and too aggressive pricing, I would be looking for signs of troubles at a company that uses the language in the spam you quoted. Not someone I would trust to run my data center.

1 0

Re: Is the .to (Tonga) domain completely rogue an
by egullich＠tonic.to 01 Oct '98

01 Oct '98

Mr. Shein: > You know, Mr Gullichsen, you can answer every complaint you get with > "why didn't you tell us this before!", but it's not fooling anyone. I don't answer every complaint with that reply, nor did I answer your complaint in that manner. What I did was to bring to your attention Tonic's published antispam policy, and to request that if you were having problems with SPAM involving any .TO domain names, that you inform us as to what those names are, so we can deal with them in accordance with our policy. > So why was the Consulate's web page changed from an advertisement for > a software company to something having to do with the Kingdom of Tonga > in the past couple of hours? We recently moved a number of servers to a colocated facility for improved bandwidth. The mail POP for the Consulate was one of these, and now runs on a machine supporting a number of virtual IP addresses. There is no web page for the Consulate, and as a result of the fact that there was no explicit VirtualHost directive for sfconsulate.gov.to in the Apache config file, web accesses defaulted to another virtual IP on the same machine, which is that of a software company. As a result of your discovering this, I recently added a VirtualHost directive so that accesses to port 80 on the sfconsulate.gov.to IP address return the Tonga Visitor's Bureau home page, www.vacations.tvb.gov.to Thank you for pointing this out. You may note that the Tonga Visitor's Bureau home page also prominently features an advertisement for Tonic. This is intentional. Regards, - Eric Gullichsen Tonic Corporation Kingdom of Tonga Network Information Center http://www.tonic.to Email: egullich(a)tonic.to

6 5

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by Andy Walden 01 Oct '98

01 Oct '98

I have a legit .to domain. I paid $100 for it like any .com domain, which of course has no porn sites. or something... Sincerely, Andy Walden System Administrator MTCO Communications 1-800-859-6826 On Wed, 30 Sep 1998, Barry Shein wrote: > > We've been having increasing problems with one or more porn sites in > the .to domain promoting itself by massive spamming of AOL customers > using one of our domains in their From: header thus causing both > complaints to us and thousands of bounces from AOL due to bad AOL > addresses in their spam lists. > > Looking at the .to domain I can't help but notice it's heavily laden > with what appear to be porn sites (sexonline.to, come.to, > xxxhardcore.to, etc.) > > 1. Performing traceroutes and other analyses seems to indicate that > this domain is NOT being used for communication with entities > legitimately located (legally, not only geographically) within the > sovereignty of the Kingdom of Tonga, as intended. > > 2. Clearly criminal and malicious activites are arising from sites to > which Tonga has provided comfort and sanctuary. > > 3. Therefore, I call for a process whereby it can be determined as to > whether or not it is appropriate to decommission the Tongan domain due > to negligence, mismanagement, and having allowed it to become an > attractive resource for criminal activities. I do not believe the > Tongan domain serves any legitimate purpose as an internet resource. > > In support of this assertion I want to show you an SMTP conversation > with what claims to be the Consulate of the Government of Tonga in San > Francisco (This San Francisco office is listed as an official Tongan > contact point for visas etc by the US State Dept): > > world% telnet sfconsulate.gov.to 25 > Trying 209.24.51.169... > Connected to sfconsulate.gov.to. > Escape character is '^]'. > 220 colo.to SMTP ready, Who are you gonna pretend to be today? > VRFY postmaster > 500 Bloody Amateur! Proper forging of mail requires recognizable SMTP commands! > > -------------------- > > Viewing the web page for the Tongan Consulate in the US > (http://sfconsulate.gov.to) reveals nothing but an ad for a software > company, this page ends with: > > Need a domain name? Contact the Kingdom of Tonga Internet domain name > registry. > > -------------------- > > Consequently, I assert there is no reason for this domain to exist and > it should be removed from the root name servers. > > > -- > -Barry Shein > > Software Tool & Die | bzs(a)world.std.com | http://www.world.com > Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD > The World | Public Access Internet | Since 1989 *oo* >

11 19

Re: Is the .to (Tonga) domain completely rogue and should be removed?
by dichro-f890504e＠rcpt.to 01 Oct '98

01 Oct '98

>>>>> "SJS" == Steven J Sobol <sjsobol(a)nacs.net> writes: SJS> Here's another one: bounce.to, another redirection service. SJS> I'm sure I can find others. Allow me to assist. Is the cause of the complaint that there are non-Tongan porn sites with .to domains? Would it make you happier if the porn sites in .to were exclusively Tongan? Perhaps you disagree with porn sites in general? There's better targets to aim at if so. 'sides, there's better candidates for extinction on aesthetic grounds. There's a bar in the Cook Islands that has an email address of - I am not making this up ((c) Dave Barry) - drink(a)ronnies.co.ck. Aren't you glad the Cook Islands aren't selling commercial subdomains to everyone? m. PS: No, I don't know what they were thinking either.

2 1

A Message from Exodus (fwd)
by Adam Rothschild 01 Oct '98

01 Oct '98

Uggggh. So many people have requested this privately, I can't take it! So, here goes. Note that some of the information in the spam is totally false. Some is just plain funny/silly, such as: "If GTE/BBN has a brown-out tomorrow, their customers are out of luck if their network fails. At Exodus, traffic for all of our customers would just get rerouted either though our own backbone, or through another major Internet carrier (like UUNet)." Regards, -asr > > > From Mike.Johnson(a)exodus.net Tue Sep 29 11:09:32 1998 > > > Received: from venus.exodus.net (venus.exodus.net [209.185.81.244]) > > > by exoserv.exodus.net (8.8.5/8.8.5) with ESMTP id HAA12891; Tue, > > > 29 Sep 1998 07:47:08 -0700 > > > Received: by venus.exodus.net with Internet Mail Service > > (5.0.1457.3) > > > id <Q3Y5LSL0>; Tue, 29 Sep 1998 08:00:15 -0700 > > > Date: Tue, 29 Sep 1998 08:00:14 -0700 > > > From: Mike Johnson <Mike.Johnson(a)exodus.net> > > > Subject: A Message from Exodus > > > To: "'XXXXX@XXXXXX'" <XXXX@XXXXXXXX>, > > > "'XXXX@XXXXXXX'" <XXXXX@XXXXXXX> > > > Message-id: > > <XXXXXXXXXXXXXXXXXXXXX(a)venus.exodus.net> > > > MIME-version: 1.0 > > > X-Mailer: Internet Mail Service (5.0.1457.3) > > > Content-type: text/plain; charset="ISO-8859-1" > > > Content-transfer-encoding: quoted-printable > > > X-Priority: 3 > > > > > > Gentlemen, > > > > > > I would to talk with your company to see if we could provide some of > > = > > > our > > > Internet data center services for use in your business. In a > > nutshell, > > > our primary focus is to provide a world-class facility for managing > > the > > > Internet portion of an organization's data center. For a lot of > > our > > > clients (including several ISPs), our US facilities are their ONLY > > data > > > center facilities. Companies like Hotmail, iVillage, Geocities, > > > CondeNet, and USAToday run all of their server hardware in our > > > buildings. On the ISP side of the equation, we have connections > > with > > > nearly every public and private Internet exchange in the US and are > > > expanding into both Europe and Asia. If GTE/BBN has a brown-out > > > tomorrow, their customers are out of luck if their network fails. > > At > > > Exodus, traffic for all of our customers would just get rerouted > > either > > > though our own backbone, or through another major Internet carrier = > > > (like > > > UUNet). As a policy, we always add more physical bandwidth when we > > > reach 50% of capacity. > > > > > > I would really appreciate it if you could point me to someone there > > in > > > management who might be interested in spending a lot less money on > > your > > > equipment infrastructure and more on your core business. Here are > > some > > > bullet points for you to consider... > > > > > > > > > EXODUS' 7 INTERNET DATA CENTERS FEATURE: > > > > > ---------------------------------------------------------------------- > > --= > > > > > > --- > > > * 7X24 monitored physical security =09 > > > * 12" raised flooring > > > * Battery back up =09 > > > * Diesel power generators=09 > > > * FM200 Fire Suppression System =09 > > > * Diverse local loops > > > * Scalable space from =BC shared rack to multiple 7'X 8' Virtual > > Data > > > Centers with dedicated racks and power. =20 > > > > > > EXODUS' VIRTUALLY UNLIMITED BANDWIDTH FEATURE: > > > > > ---------------------------------------------------------------------- > > --= > > > > > > --------------- > > > * 1 Megabit Ethernet to 100 Megabit Fast Ethernet scalable Internet > > > connections > > > * Fixed and "usage based" bandwidth options > > > * Direct "public" connectivity to NAP's and MAE's > > > * Multiple PRIVATE peering agreements with other Tier 1 Service > > > Providers > > > * OC3 nationwide backbone > > > > > > EXODUS' MANAGED SERVICE INCLUDE: > > > -------------------------------------------------------------- > > > * Customized Computer Associates Unicenter TNG reports > > > * Distributed and Local Director / Disaster Recovery - Load > > Balancing > > > * URL monitoring and bandwidth utilization reports > > > * CheckPoint or Raptor firewall protection > > > > > > VALUE PROPOSITION > > > ---------------------------------- > > > Exodus capabilities can significantly benefit companies that have > > > figured out how to use the Internet as an effective business tool > > but > > > don't want to invest finite resources into managing their Web > > > operations. The Exodus solution allows these Internet savvy > > companies > > > to reduce Web administration costs, off-load IS resources, and > > reduce > > > time-to-market while increasing the quality and reliability of > > Internet > > > content distribution, communication and commerce. > > > > > > > > > =20 > > > Exodus Clients > > > "Non-Stop Internet Computing" > > > Companies doing serious business on the web, park their web servers > > at > > > the Exodus Internet Data Centers=20 > > > > > > Partial List > > > > > > Computer Associates Major Strategic Alliance =09 > > > http://www.ca-nethaven.com > > > > > > Geocities Top 5 Site on the Web > > > http://www.geocities.com > > > > > > Tripod Leading Web Community > > > http://www.tripod.com > > > > > > Microsoft Software Juggernaut > > > http://www.microsoft.com > > > > > > CBS Sportsline Top 3 Sport Site > > > http://www.sportsline.com > > > > > > Hearst New Media Major Media Site > > > http://www.homearts.com > > > > > > Oracle #1 Database Company > > > http://www.oracle.com > > > > > > Litlenet #1 Electronic Commerce Company > > > http://www.litle.net > > > > > > Tibco Reuters Information Service Provider > > > http://www.tibco.com > > > > > > BMG $5.8 Billion Entertainment Conglomerate > > > http://www.bmg.com > > > > > > D.E. Shaw / JUNO #2 Free E-mail Site > > > http://www.juno.com > > > > > > Poppe Tyson #1 Internet Marketing Co. for Wall Street > > > http://www.poppe.com > > > > > > USA Today #1 National Newspaper > > > http://www.usatoday.com=09 > > > > > > Progressive Networks Real Audio/Real Video > > > http://www.real.com > > > > > > HOTBOT Top Rated Search Engine > > http://www.hotbot.com > > > > > > Conde Nast Major Media Publisher > > > http://www.condenet.com > > > > > > Hotmail #1 Free E-mail Site > > > http://www.hotmail.com > > > > > > Lycos Top Rated Search Site > > > http://www.lycos.com > > > > > > *Over $100 Million of Customer equipment are housed in Exodus > > > facilities. > > > > > > > > > Please contact me if you think we might be able to work together. = > > > Thank > > > you for your consideration. > > > -- > > > Mike Johnson > > > Major Account Consultant > > > EXODUS COMMUNICATIONS > > > 212.220.5458 > > > mike.johnson(a)exodus.net > > > > > > > > > > > > -- > > > Mike Johnson > > > Major Account Consultant > > > EXODUS COMMUNICATIONS > > > 212.220.5458 > > > mike.johnson(a)exodus.net

1 0