- NANOG - lists.nanog.org

RE: Atrivo/Intercage
by Tom Sparks (Applied Operations) 24 Sep '08

24 Sep '08

Just to add my $0.02 to this discussion and a disclaimer - I've known Emil for years, I've seen his shop and even the controversy. 200 Paul is a small community, and most of the folks in there know eachother, I've been in there since 2001 or so. Intercage is not a big shop, there are very few people involved in running it and I have a very hard time believing the accusations made by some of the folks around. I also don't believe Intercage was complicit in any net-crime; Thats not to say it didn't exist, but more along the lines of they got lost in the noise of running a business. I'd guess that given the server volume they've got, abuse emails are less than one percent of all the email they get in a week. From what I've seen, the bulk of their customer base is webhosters, Unix Shell providers and some video/audio streamers. Were I to venture a guess on the number of folks reselling those webservers, its probably on the order of thousands... Any time I've had an issue with one of Atrivo's customers, it only took one email to get it dealt with, or I got Emil on IM or on the phone and it was taken care of. My experience with being on the other end of abuse@, I'd say a good 60-75% of the complaints I saw coming in were bogus. Either people complaining about their ZoneAlarm's going off, people complaining about bounced emails with spam and a bunch of automated stuff that was always wrong. The legit complaints were not always easy to deal with either since a good 20-30% of them were unclear on what was actually wrong until you spent some time digging. Basically is what it boils down to for me - its easy to blame an NSP/ISP/Hoster for what their clients do, it takes real dedication to find out whats *actually* going on. -- Tom Sparks (415) 367-7328x1001

8 15

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Mark, It really seems YOU _DID_ miss the memo. I think that since no one else is responding to your non-sense, there is no reason for me to either. If you have something accurate to say, I'll be happy to listen. Until then, there's not much I can say. There's no sense in repeating myself. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Mark Foo <mark.foo.dog(a)gmail.com> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: Bruce Williams <williams.bruce(a)gmail.com>; Christopher Morrow <christopher.morrow(a)gmail.com>; nanog(a)nanog.org; Joe Greco <jgreco(a)ns.sol.net> Sent: Wednesday, September 24, 2008 12:27:50 AM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer Russell: Ferg was just being coy -- what you don't understand is there are about 3 other security mailing lists plotting to TAKE YOUR SERVICE DOWN. You FAIL. Law Enforcement might not take action against you (but appear to be interested now), but the community can. GET OFF THE NET WITH YOUR MALWARE! You mistake me for someone who believes you pack of lies! Don't you understand each time you post to this list gives those of us who know the opportunity to post MORE EVIDENCE of your MALWARE? You disconnected Hostfresh and think that's the extent of your cimes? Gimme a break. Only those who are easily socially engineered would believe your pathetic claims of innocence. You've BEEN HOSTING MALWARE since 2003 -- SEE Nanog post: Re: The in-your-face hijacking example http://www.irbs.net/internet/nanog/0305/0038.html > Let me know if there's anything else you'd like me to state to the public. Answer Ferg's question -- Why are you moving to CERNAL? Do you think this is going to work? That's just another of Emil's networks. > We're on a rocky road right now. But it IS starting to smooth out. That's just the calm before the storm. Go ahead and post a response to each of these allegations: Cybercrime's US Hosts http://www.spamhaus.org/news.lasso?article=636 Report Slams U.S. Host as Major Source of Badware http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_a… A Superlative Scam and Spam Site Registrar http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html?nav=rs… ICANN cast as online scam enabler http://www.theregister.co.uk/2008/09/03/cyber_crime_reports/ 'Malware-friendly' Intercage back with the living http://www.theregister.co.uk/2008/09/24/intercage_back_online/ On Tue, Sep 23, 2008 at 11:50 PM, Russell Mitchell <russm2k8(a)yahoo.com> wrote: > > Hello John Doe, > > I welcome any further comments you have. > We have to get past people such as yourself, and your blasphemous and false statements. > > This is the same issue with the recent media and self-proclaimed "Security Researchers". Fly-by-night mind you. > > To help you out in your claims: > Yes, we did house a client whom had quite a run with their client's from various locations, such as Russia. > That Client is no longer hosted on our network. I myself spent all of monday afternoon, night, and tuesday morning shutting off EVERY machine they had leased in our Billing System. I'm currently working to scan further and see if there's anything I may have missed. > > Yes, Russia is very well known for Virus and Malware writer's. > > Yes, we have had issues with malware distribution from our network. > This was directly and near singularly related to the former client of ours. We did have another client, Hostfresh, whom had their share of malware issues. > > Both have been completely and effectively removed. The server's leased to both of them have been canceled, and their machines have been shutoff. > > Let me know if there's anything else you'd like me to state to the public. > We're on a rocky road right now. But it IS starting to smooth out. > > Thank you for your time. Have a great day. > --- > Russell Mitchell > > InterCage, Inc. > > > > ----- Original Message ---- > From: Mark Foo <mark.foo.dog(a)gmail.com> > To: Bruce Williams <williams.bruce(a)gmail.com> > Cc: Christopher Morrow <christopher.morrow(a)gmail.com>; nanog(a)nanog.org; Joe Greco <jgreco(a)ns.sol.net> > Sent: Tuesday, September 23, 2008 11:08:21 PM > Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer > > NANOG: > > Look, the people posting here who are trashing Intercage are pure security > analysts -- they > know and understand the evil that is Intercage. STOP TRYING TO ASSIST > INTERCAGE > -- you are effectively aiding and abetting the enemy. > > Intercage/Atrivo hosts the malware c&c botnets that DDoS your systems and > networks. > > Intercage/Atrivo hosts the spyware that compromises your users' passwords. > > Intercage/Atrivo hosts the adware that slows your customers' machines. > > Don't take my word for it, DO YOUR OWN RESEARCH: > http://www.google.com/search?hl=en&q=intercage+malware > > You don't get called the ***American RBN*** for hosting a couple bad > machines. They > have and will continue to host much of the malware pumped out of America. > THEY > ARE NOT YOUR COMRADES.. > > These people represent the most HIGHLY ORGANZIED CRIME you will ever > come across. Most people were afraid to speak out against them until this > recent ground swell. > > This is the MALWARE CARTEL. GET THE PICTURE? > > Many links have been posted here that prove this already -- instead of > asking > what customers they cut off, let them show WHAT CUSTOMERS ARE LEGIT-- > because there are NONE. > > > > > > > >> I would suggest a different Step 1. Instead of killing power, simply > > >> isolate the affected machine. This might be as simple as putting up a > > >> firewall rule or two, if it is simply sending outgoing SMTP spam, or > > > it's probably easiest (depending on the network gear of course) to > > > just put the lan port into an isolated VLAN. It's not the 100% > > > solution (some badness rm's itself once it loses connectivity to the > > > internets) but it'd make things simpler for the client/LEA when they > > > need to figure out what happened. > > > > > > -chris > > > > > > > > > > > > > > >

5 4

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello John Doe, I welcome any further comments you have. We have to get past people such as yourself, and your blasphemous and false statements. This is the same issue with the recent media and self-proclaimed "Security Researchers". Fly-by-night mind you. To help you out in your claims: Yes, we did house a client whom had quite a run with their client's from various locations, such as Russia. That Client is no longer hosted on our network. I myself spent all of monday afternoon, night, and tuesday morning shutting off EVERY machine they had leased in our Billing System. I'm currently working to scan further and see if there's anything I may have missed. Yes, Russia is very well known for Virus and Malware writer's. Yes, we have had issues with malware distribution from our network. This was directly and near singularly related to the former client of ours. We did have another client, Hostfresh, whom had their share of malware issues. Both have been completely and effectively removed. The server's leased to both of them have been canceled, and their machines have been shutoff. Let me know if there's anything else you'd like me to state to the public. We're on a rocky road right now. But it IS starting to smooth out. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Mark Foo <mark.foo.dog(a)gmail.com> To: Bruce Williams <williams.bruce(a)gmail.com> Cc: Christopher Morrow <christopher.morrow(a)gmail.com>; nanog(a)nanog.org; Joe Greco <jgreco(a)ns.sol.net> Sent: Tuesday, September 23, 2008 11:08:21 PM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer NANOG: Look, the people posting here who are trashing Intercage are pure security analysts -- they know and understand the evil that is Intercage. STOP TRYING TO ASSIST INTERCAGE -- you are effectively aiding and abetting the enemy. Intercage/Atrivo hosts the malware c&c botnets that DDoS your systems and networks. Intercage/Atrivo hosts the spyware that compromises your users' passwords. Intercage/Atrivo hosts the adware that slows your customers' machines. Don't take my word for it, DO YOUR OWN RESEARCH: http://www.google.com/search?hl=en&q=intercage+malware You don't get called the ***American RBN*** for hosting a couple bad machines. They have and will continue to host much of the malware pumped out of America. THEY ARE NOT YOUR COMRADES.. These people represent the most HIGHLY ORGANZIED CRIME you will ever come across. Most people were afraid to speak out against them until this recent ground swell. This is the MALWARE CARTEL. GET THE PICTURE? Many links have been posted here that prove this already -- instead of asking what customers they cut off, let them show WHAT CUSTOMERS ARE LEGIT-- because there are NONE. > >> I would suggest a different Step 1. Instead of killing power, simply > >> isolate the affected machine. This might be as simple as putting up a > >> firewall rule or two, if it is simply sending outgoing SMTP spam, or > > it's probably easiest (depending on the network gear of course) to > > just put the lan port into an isolated VLAN. It's not the 100% > > solution (some badness rm's itself once it loses connectivity to the > > internets) but it'd make things simpler for the client/LEA when they > > need to figure out what happened. > > > > -chris > > > > > >

5 4

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Joe, If we can't power down the machine, due to evidence loss. We can't nullroute the IP, as stated, some malware will delete itself or alter itself when Net Access is lost. Now we can filter a single port, in the case of spam, phishing, etc? I'll look further into the JunOS. I'm not too familiar with the rules on the Juniper, so I'll take a look further, and see how to achieve this on a single IP rather then the network. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Joe Greco <jgreco(a)ns.sol.net> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: nanog(a)nanog.org Sent: Tuesday, September 23, 2008 8:20:18 PM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer > Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST= > Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha= > ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som= > e of the public media, such as google, DroneBL, as well as several Anti-Mal= > ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire= > ly GONE, we should not have any further issues.=0AIn the case that somethin= > g=A0does arise, such as an exploited host, we're currently developing a gam= > e plan for=A0response to=A0the issues.=0ATo make the best effort towards co= > mbatting=A0abuse on our network, here's what I have planned so far for ANY = > Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,= > Call/Email the client whom the affected machine is leased to.=0AStep 3, Al= > low the client=A0the option to=A0investigate the machine further (Nullroute= > access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o= > r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the = > Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments= > ? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.= > If it's clear that the server owner is the cause of the abusive material e= > tc, the client will then be immediately cancelled. No questions.=A0=0A=0A= > =0AIt seems that this approach will be the best supported by the anti-abuse= > communities, so please let me know your input.=0A=0AThank you for your tim= > e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A= > =0A=0A----- Original Message ----=0AFrom: Paul Wall <pauldotwall(a)gmail.com>= > =0ATo: Mark Foo <mark..foo.dog(a)gmail.com>=0ACc: nanog(a)nanog.org=0ASent: Tues= > day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage= > : NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on = > UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon= > th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a= > nd Drive Slow,=0APaul Wall=0A=0A=0A Speaking of missing memos... mailing lists are not highly compatible with HTML or some clients that like to encode list mail. The above is what your mail looked like to some people. I would suggest a different Step 1. Instead of killing power, simply isolate the affected machine. This might be as simple as putting up a firewall rule or two, if it is simply sending outgoing SMTP spam, or for more complex issues, downing the port facing the machine in question. Killing the power may destroy useful forensic clues about what happened to the system, and may damage the system. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

2 1

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Michael, THANK YOU for the Intervention. If anyone would like to continue the chats, drop me an email, and we can continue talks OFF NANOG. Thank you all very much for your time and careful consideration into the issues we're having. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: "michael.dillon(a)bt.com" <michael.dillon(a)bt.com> To: nanog(a)nanog.org Sent: Wednesday, September 24, 2008 2:23:01 AM Subject: RE: YAY! Re: Atrivo/Intercage: NO Upstream depeer > It is clear to me -- at least -- that this entire criminal > operation is being operated out of Eastern Europe, and their > foothold in the U.S. is the major issue here. If you believe that this is a criminal operation then you should keep this discussion OFF THE LIST and discourage anyone from taking any action against the bad guys that might disrupt evidence gathering. If this is a criminal matter, then it is best to keep quiet, collect good evidence, and go to court. Better to get a court injunction ordering them to stop sending malware, and then collect evidence showing that they violated the injunction. To do this, they need to have functioning upstream connections to your network. NANOG is not the place to discuss these things. None of this is network operational. The whole discussion amounts to a shouting match between vigilantes and their victims. Some of those victims might also be bad guys, but a shouting match on NANOG does not prove this one way or the other. --Michael Dillon

1 0

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Paul, GREAT! I am very pleased with that. This is what we need, and I'm sure you can agree, this is what the Internet needs. Thank you very much for your time. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Paul Ferguson <fergdawgster(a)gmail.com> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: nanog(a)nanog.org Sent: Wednesday, September 24, 2008 12:20:59 AM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wed, Sep 24, 2008 at 12:12 AM, Russell Mitchell <russm2k8(a)yahoo.com> wrote: > > I hope soon, people will realise and accept the truth that we are a > LEGITIMATE Company that DOES Operate in the USA. We are NOT directly or > in-directly related to any Russian's. We do NOT support, write, directly > distribute, or knowingly allow the distribution of malware or other > abusive activities to originate from our network. While the previous > statements are questionable in the public's eye, I hope some time, you > will understand it IS the truth. > > Prove me wrong, PLEASE. AS27595, and all prefixes which you advertise, will be ultra-scrutinized. You can be sure that you, and many others, will know if & when criminal activity re-appears inside prefixes hosted by Atrivo/Intercage. The gloves are off, so to speak. Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFI2epPq1pz9mNUZTMRAumJAKD5lujVV7CTeZ6iQDEjsELHy7+I1wCfeXFH TxVWvBONxa+jozHf9hq+k2c= =L/4x -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Pedram, Until everyone fully understands the truth in ENGLISH, this topic will continue. This is what they demand. As long as there are questions which relate to us, I will continue to respond. When it's set in stone, and the false claims and false statements are corrected, this topic will cease. I hope soon, people will realise and accept the truth that we are a LEGITIMATE Company that DOES Operate in the USA. We are NOT directly or in-directly related to any Russian's. We do NOT support, write, directly distribute, or knowingly allow the distribution of malware or other abusive activities to originate from our network. While the previous statements are questionable in the public's eye, I hope some time, you will understand it IS the truth. Prove me wrong, PLEASE. If you know of any further malware or further abusive activities, such as the claimed C&C Botnets, please PLEASE don't hesitate to tell me. abuse.intercage and russ..intercage and emil.intercage are live and operational. We are currently investigating the rest of our clientel and any site's or communities you can recommend to follow, we will follow. While it is clear that this will not be accepted by the community any time soon, it will eventually be accepted. That is what I am waiting for, however long it takes. I can't stress this enough. We DO need your help to locate and eliminate abusive activities from our network. I know you have information, and I need you to atleast reclaim the faith that we WILL be very active against abuse originating from our network, and we WILL be proactive to locate and eliminate abusive activities on our network. Thank you very much for all your time and future assistance. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Pedram M <pmessri(a)gmail.com> To: nanog(a)nanog.org Sent: Tuesday, September 23, 2008 11:38:54 PM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer Wow, this topic has really gotten old. On Tue, Sep 23, 2008 at 11:31 PM, Paul Ferguson <fergdawgster(a)gmail.com>wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Tue, Sep 23, 2008 at 11:28 PM, Russell Mitchell <russm2k8(a)yahoo.com> > wrote: > > > > Sorry I didn't make this clear enough in the previous responses. > > > > The prefixes that are registered to Inhoster belong to Esthost. > > I'm not sure how or why you think those prefixes belong to us. > > > > These prefixes belong DIRECTLY to us: > > - 69.50.160.0/19 Withdrawn > > - 216.255.176.0/20 Withdrawn > > > > These prefixes belong DIRECTLY to nLayer, and were LEASED to us: > > - 69.22.162.0/23 Withdrawn > > - 69.22.168.0/21 Withdrawn > > - 69.22.184.0/22 Withdrawn > > - 69.31.64.0/20 Withdrawn > > > > The prefixes LEASED to us BY nLayer are being reclaimed at the end of > > this month 09/30/08, as the lease contract is set to cease at that time. > > > > Hopefully, that is clear enough for you. > > > > Thank you for your time. Have a great day. > > --- > > Russell Mitchell > > > > InterCage, Inc. > > > > Clear as mud, thanks. > > - - ferg > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.6.3 (Build 3017) > > wj8DBQFI2d6uq1pz9mNUZTMRAmkcAJ4toRsggJ325VfjkqK8QJKWQG4UegCg84x+ > KwcuyxtFp7/x3/vScFTkP3I= > =/vFy > -----END PGP SIGNATURE----- > > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawgster(at)gmail.com > ferg's tech blog: http://fergdawg.blogspot.com/ > >

2 1

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Hello Paul, Sorry I didn't make this clear enough in the previous responses. The prefixes that are registered to Inhoster belong to Esthost. I'm not sure how or why you think those prefixes belong to us. These prefixes belong DIRECTLY to us: - 69.50.160.0/19 Withdrawn - 216.255.176.0/20 Withdrawn These prefixes belong DIRECTLY to nLayer, and were LEASED to us: - 69.22.162.0/23 Withdrawn - 69.22.168.0/21 Withdrawn - 69.22.184.0/22 Withdrawn - 69.31.64.0/20 Withdrawn The prefixes LEASED to us BY nLayer are being reclaimed at the end of this month 09/30/08, as the lease contract is set to cease at that time. Hopefully, that is clear enough for you. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc. ----- Original Message ---- From: Paul Ferguson <fergdawgster(a)gmail.com> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: nanog(a)nanog.org Sent: Tuesday, September 23, 2008 11:11:39 PM Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, Sep 23, 2008 at 10:52 PM, Paul Ferguson <fergdawgster(a)gmail.com> wrote: > On Tue, Sep 23, 2008 at 10:13 PM, Russell Mitchell <russm2k8(a)yahoo.com> > wrote: > >> I believe the blocks your referring to are their 85.255 Blocks? >> Registered to "InHoster". I believe those prefixes are an entity of >> their's, though I don't know for sure. Perhaps ask them? >> > > Thanks, thats right -- Inhoster. Operating out of Odessa and blacklisted > virtually everywhere. > Sorry, my last post on this issue. As you may (or may not) know, Inhoster's domain(s) were suspended due to criminal activity: http://whois.domaintools.com/inhoster.com The prefixes you mention, were deliberately being originated by AS27595 up until the recent kerfluffle and disconnect on Saturday night: Prefixes added and withdrawn by this origin AS in the past 7 days. - 64.28.176.0/20 Withdrawn - 67.210.0.0/21 Withdrawn - 67.210.8.0/22 Withdrawn - 67.210.14.0/23 Withdrawn - 69.22.162.0/23 Withdrawn - 69.22.168.0/21 Withdrawn - 69.22.184.0/22 Withdrawn - 69.31.64.0/20 Withdrawn - 69.50.160.0/19 Withdrawn - 85.255.113.0/24 Withdrawn - 85.255.114.0/23 Withdrawn - 85.255.116.0/22 Withdrawn - 85.255.120.0/23 Withdrawn - 85.255.122.0/24 Withdrawn - 216.255.176.0/20 Withdrawn - 216.255.176.0/22 Withdrawn - 216.255.180.0/22 Withdrawn - 216.255.184.0/22 Withdrawn - 216.255.188.0/22 Withdrawn And they magically reappeared in Cernel (AS36445) almost immediately: Prefix AS Path 64.28.187.0/24 12654 3257 36445 67.210.12.0/23 12654 3257 36445 85.255.112.0/20 12654 3257 36445 93.188.161.0/24 12654 3257 36445 93.188.166.0/24 12654 3257 36445 This was not an accident. So what you are saying is that these prefixes have always belonged to Inhoster? Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFI2doTq1pz9mNUZTMRAupwAKDxEF9kyS/UoTb/Hl2FwEGM1tsj2gCfYF16 qyG0vUAmfxfdQg/vqHFCxbw= =T+0o -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="0-593512929-1222225655=:9145" --0-593512929-1222225655=:9145 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST= Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha= ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som= e of the public media, such as google, DroneBL, as well as several Anti-Mal= ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire= ly GONE, we should not have any further issues.=0AIn the case that somethin= g=A0does arise, such as an exploited host, we're currently developing a gam= e plan for=A0response to=A0the issues.=0ATo make the best effort towards co= mbatting=A0abuse on our network, here's what I have planned so far for ANY = Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,= Call/Email the client whom the affected machine is leased to.=0AStep 3, Al= low the client=A0the option to=A0investigate the machine further (Nullroute= access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o= r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the = Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments= ? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.= If it's clear that the server owner is the cause of the abusive material e= tc, the client will then be immediately cancelled. No questions.=A0=0A=0A= =0AIt seems that this approach will be the best supported by the anti-abuse= communities, so please let me know your input.=0A=0AThank you for your tim= e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A= =0A=0A----- Original Message ----=0AFrom: Paul Wall <pauldotwall(a)gmail.com>= =0ATo: Mark Foo <mark.foo.dog(a)gmail.com>=0ACc: nanog(a)nanog.org=0ASent: Tues= day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage= : NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on = UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon= th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a= nd Drive Slow,=0APaul Wall=0A=0A=0A --0-593512929-1222225655=:9145 Content-Type: text/html; charset=us-ascii <html><head><style type="text/css"></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><P>Hello All,</P> <P> </P> <P>It seems you all missed the memo.<BR>As of about 11PM PST Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer have ANY Machine on my network.</P> <P> </P> <P>I'm currently starting to monitor some of the public media, such as google, DroneBL, as well as several Anti-Malware community websites for abuse.</P> <P> </P> <P>Being that Esthost is now entirely GONE, we should not have any further issues.</P> <P>In the case that something does arise, such as an exploited host, we're currently developing a game plan for response to the issues.</P> <P>To make the best effort towards combatting abuse on our network, here's what I have planned so far for ANY Type of abuse:</P> <P>Step 1, Suspend Power to the affected machine.</P> <P>Step 2, Call/Email the client whom the affected machine is leased to.</P> <P>Step 3, Allow the client the option to investigate the machine further (Nullroute access via KVM)</P> <P>Step 4, Verify the reported content, domain, user, or exploit is patched/eliminated from the machine.</P> <P>Step 5, Remove the Nullroute. Allow the machine to return to the network.</P> <P> </P> <P>Any comments? </P> <P> </P> <P>This is the result of a zero tolerance policy regarding abuse. If it's clear that the server owner is the cause of the abusive material etc, the client will then be immediately cancelled. No questions. </P> <DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> <DIV></DIV> <DIV> </DIV> <DIV>It seems that this approach will be the best supported by the anti-abuse communities, so please let me know your input.</DIV> <DIV> </DIV> <DIV>Thank you for your time. Have a great day.<BR> </DIV>---<BR>Russell Mitchell<BR> <DIV>InterCage, Inc.<BR></DIV> <DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><BR> <DIV style="FONT-SIZE: 13px; FONT-FAMILY: arial, helvetica, sans-serif">----- Original Message ----<BR>From: Paul Wall <pauldotwall(a)gmail.com><BR>To: Mark Foo <mark.foo.dog(a)gmail.com><BR>Cc: nanog(a)nanog.org<BR>Sent: Tuesday, September 23, 2008 5:46:58 PM<BR>Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer<BR><BR>Hold the rejoicing, Atrivo is back, this time on UnitedLayer.<BR><BR>I'd contact them, only they seem to change CTOs every month or two,<BR>does anybody know who's currently in charge?<BR><BR>Thank you, and Drive Slow,<BR>Paul Wall<BR><BR></DIV></DIV></DIV></div><br> </body></html> --0-593512929-1222225655=:9145--

6 6

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 24 Sep '08

24 Sep '08

Apologies, Yahoo was set to "Rich Text" :( ----- Hello All, It seems you all missed the memo.As of about 11PM PST Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer have ANY Machine on my network. I'm currently starting to monitor some of the public media, such as google, DroneBL, as well as several Anti-Malware community websites for abuse. Being that Esthost is now entirely GONE, we should not have any further issues. In the case that something does arise, such as an exploited host, we're currently developing a game plan for response to the issues. To make the best effort towards combatting abuse on our network, here's what I have planned so far for ANY Type of abuse: Step 1, Suspend Power to the affected machine. Step 2, Call/Email the client whom the affected machine is leased to. Step 3, Allow the client the option to investigate the machine further (Nullroute access via KVM)= Step 4, Verify the reported content, domain, user, or exploit is patched/eliminated from the machine. Step 5, Remove the Nullroute. Allow the machine to return to the network. Any comments? This is the result of a zero tolerance policy regarding abuse. If it's clear that the server owner is the cause of the abusive material etc, the client will then be immediately cancelled. No questions. It seems that this approach will be the best supported by the anti-abuse communities, so please let me know your input. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc.

2 2