- NANOG - lists.nanog.org

Unbelievable Spam.
by Ejay Hire 03 Feb '04

03 Feb '04

Personally, I don't like spam, but I tolerate the messages that slip through to my mailbox as a penalty for my own laziness in not tightening down my spam rules. Today I got one that I couldn't believe. --snip-- Spam Hosting - from 20$ per mounth. Fraud Hosting - from 30$ per mounth. Stoln Credit Cards, Fake ID, DL's. Spam For free only from 1.02.2004 to 5.02.2004. --snip-- It's just wrong in my opinion, and exacerbated by the fact that it was spammend to our abuse account. Their /24 just fell off of my piece of the internet. Have I just been blind to this all along, or are the spammers getting bolder? -Ejay

8 8

Re: Need abuse contact for Yahoo Hostinng
by Christopher X. Candreva 02 Feb '04

02 Feb '04

On Mon, 2 Feb 2004, Barnabas Toth wrote: > Maybe you should try to contact AOL abuse instead? I know, I know... Just > a though. Thanks to those who replied. I've been contacted directly by an AOL rep (who the site pretended to be), and an FBI agent. Interestingly not a peep from Yahoo. Sigh. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 1

other virus damages/costs.....(hello skynet.be ?)
by Mike Tancsa 02 Feb '04

02 Feb '04

Looking at my disk stats, my mail storage spool has grown by 15% in the past week not due the deluge of viruses which I can block and reject, but in large part to those idiotic "Hi, I am sorry in a happy idiotic way to inform you that the message you sent has a virus" messages.... As almost all of them forge their email address, what is the point of warning the "sender." Even better, I wake up this am to 285 (and growing) messages below telling me that someone at skynet is trying to send me a virus message and it cc's 64 other people. Nice. ---Mike >From: "Skynet Mail Protection" <support(a)skynet.be> >To: gbs-vossem(a)pi.be >To: timofeev(a)granch.ru >To: chris(a)aims.com.au >To: dcs(a)newsguy.com >To: imp(a)harmony.village.org >To: ted(a)ness.plymouth.edu >To: deepak(a)ai.net >To: bmilekic(a)technokratis.com >To: randy(a)psg.com >To: sthaug(a)nethelp.no >To: shelton(a)sentry.granch.ru >To: danny_j_mitzel(a)yahoo.com >To: tinguely(a)web.cs.ndsu.nodak.edu >To: charon(a)hell.gr >To: jesper(a)skriver.dk >To: anandfranklin(a)hotmail.com >To: nascar24(a)home.nl >To: c.prevotaux(a)hexanet.fr >To: reichert(a)numachi.com >To: andy(a)tecc.co.uk >To: provos(a)citi.umich.edu >To: rtek(a)dolfijntje.nl >To: jack_xiao99(a)hotmail.com >To: mark.blackman(a)netscalibur.co.uk >To: gunther(a)aurora.regenstrief.org >To: s_bschmi(a)ira.uka.de >To: vova(a)express.ru >To: vlad(a)ariel.phys.wesleyan.edu >To: lord(a)4jon.com >To: assar(a)freebsd.org >To: peter.jeremy(a)alcatel.com.au >To: chaegle(a)mediaone.net >To: brad(a)wcubed.net >To: ewiz(a)mail.dotcom.fr >To: freedom(a)csie.nctu.edu.tw >To: oberman(a)es.net >To: wes(a)softweyr.com >To: julian(a)elischer.org >To: iedowse(a)maths.tcd.ie >To: sroberts84(a)hotmail.com >To: maddave(a)suxx.eu.org >To: ambrisko(a)ambrisko.com >To: ari(a)suutari.iki.fi >To: bonnetf(a)plonk.esiee.fr >To: lucky(a)land3.nsu.ru >To: ume(a)freebsd.org >To: crewking(a)buckeye-express.com >To: bright(a)sneakerz.org >To: tlambert(a)primenet.com >To: gwford(a)home.com >To: vlad(a)infonet.com.ua >To: freebsd-lists-for-dayan-only-owner(a)egroups.co.uk >To: kimch(a)etri.re.kr >To: chris(a)calldei.com >To: peter(a)guest-tek.com >To: sudish(a)corp.earthlink.net >To: peter(a)wemm.org >To: cristjc(a)earthlink.net >To: yar(a)freebsd.org >To: shalunov(a)internet2.edu >To: mike(a)sentex.net >To: roy(a)its-sby.edu >To: kjc(a)csl.sony.co.jp >To: seichert(a)coopcomp.com >Subject: Skynet Mail Protection scan results >Date: Mon, 02 Feb 2004 12:09:44 +0100 >Importance: high >X-Mailer: ravmd/8.4.2 >X-RAVMilter-Version: 8.4.3(snapshot 20030212) (september.skynet.be) >X-Virus-Scanned: by amavisd-new >X-Spam-Flag: YES >X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on > spamscanner4.sentex.ca >X-Spam-Level: ***** >X-Spam-Status: Yes, hits=5.7 required=5.1 tests=MAILTO_TO_SPAM_ADDR, > MISSING_MIMEOLE,MISSING_OUTLOOK_NAME,TW_JN,X_PRIORITY_HIGH, > X_PRI_MISMATCH_HI autolearn=no version=2.63 >X-Spam-Report: > * 0.5 X_PRIORITY_HIGH Sent with 'X-Priority' set to high > * 0.1 TW_JN BODY: Odd Letter Triples with JN > * 1.1 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely > spammer email > * 1.2 MISSING_MIMEOLE Message has X-MSMail-Priority, but no > X-MimeOLE > * 2.8 X_PRI_MISMATCH_HI 'X-Priority' does not match > 'X-MSMail-Priority' > * 0.1 MISSING_OUTLOOK_NAME Message looks like Outlook, but isn't > > > >----------------------- >This e-mail is generated by Skynet Mail Protection to warn you that the e-mail >sent by gbs-vossem(a)pi.be to timofeev(a)granch.ru, chris(a)aims.com.au, >dcs(a)newsguy.com, imp(a)harmony.village.org, ted(a)ness.plymouth.edu, >deepak(a)ai.net, bmilekic(a)technokratis.com, randy(a)psg.com, >sthaug(a)nethelp.no, shelton(a)sentry.granch.ru, danny_j_mitzel(a)yahoo.com, >tinguely(a)web.cs.ndsu.nodak.edu, charon(a)hell.gr, jesper(a)skriver.dk, >anandfranklin(a)hotmail.com, nascar24(a)home.nl, c.prevotaux(a)hexanet.fr, >reichert(a)numachi.com, andy(a)tecc.co.uk, provos(a)citi.umich.edu, >rtek(a)dolfijntje.nl, jack_xiao99(a)hotmail.com, >mark.blackman(a)netscalibur.co.uk, gunther(a)aurora.regenstrief.org, >s_bschmi(a)ira.uka.de, vova(a)express.ru, vlad(a)ariel.phys.wesleyan.edu, >lord(a)4jon.com, assar(a)freebsd.org, peter.jeremy(a)alcatel.com.au, >chaegle(a)mediaone.net, brad(a)wcubed.net, ewiz(a)mail.dotcom.fr, >freedom(a)csie.nctu.edu.tw, oberman(a)es.net, wes(a)softweyr.com, >julian(a)elischer.org, iedowse(a)maths.tcd.ie, sroberts84(a)hotmail.com, >maddave(a)suxx.eu.org, ambrisko(a)ambrisko.com, ari(a)suutari.iki.fi, >bonnetf(a)news.esiee.fr, lucky(a)land3.nsu.! > ru, ume(a)freebsd.org, crewking(a)buckeye-express.com, bright(a)sneakerz.org, > tlambert(a)primenet.com, gwford(a)home.com, vlad(a)infonet.com.ua, > freebsd-lists-for-dayan-only-owner(a)egroups.co.uk, kimch(a)etri.re.kr, > chris(a)calldei.com, peter(a)guest-tek.com, sudish(a)corp.earthlink.net, > peter(a)wemm.org, cristjc(a)earthlink.net, yar(a)freebsd.org, > shalunov(a)internet2.edu, mike(a)sentex.net, roy(a)its-sby.edu, > kjc(a)csl.sony.co.jp, seichert(a)coopcomp.com is infected with virus: > Win32/Swen.A@mm. >Deze e-mail is gegenereerd door Skynet Mail Protection om u te waarschuwen dat >de e-mail gestuurd door gbs-vossem(a)pi.be naar timofeev(a)granch.ru, >chris(a)aims.com.au, dcs(a)newsguy.com, imp(a)harmony.village.org, >ted(a)ness.plymouth.edu, deepak(a)ai.net, bmilekic(a)technokratis.com, >randy(a)psg.com, sthaug(a)nethelp.no, shelton(a)sentry.granch.ru, >danny_j_mitzel(a)yahoo.com, tinguely(a)web.cs.ndsu.nodak.edu, charon(a)hell.gr, >jesper(a)skriver.dk, anandfranklin(a)hotmail.com, nascar24(a)home.nl, >c.prevotaux(a)hexanet.fr, reichert(a)numachi.com, andy(a)tecc.co.uk, >provos(a)citi.umich.edu, rtek(a)dolfijntje.nl, jack_xiao99(a)hotmail.com, >mark.blackman(a)netscalibur.co.uk, gunther(a)aurora.regenstrief.org, >s_bschmi(a)ira.uka.de, vova(a)express.ru, vlad(a)ariel.phys.wesleyan.edu, >lord(a)4jon.com, assar(a)freebsd.org, peter.jeremy(a)alcatel.com.au, >chaegle(a)mediaone.net, brad(a)wcubed.net, ewiz(a)mail.dotcom.fr, >freedom(a)csie.nctu.edu.tw, oberman(a)es.net, wes(a)softweyr.com, >julian(a)elischer.org, iedowse(a)maths.tcd.ie, sroberts84(a)hotmail.com, >maddave(a)suxx.eu.org, ambrisko(a)ambrisko.com, ari(a)suutari.iki.fi, >bonnetf(a)news.esiee.fr! > , lucky(a)land3.nsu.ru, ume(a)freebsd.org, crewking(a)buckeye-express.com, > bright(a)sneakerz.org, tlambert(a)primenet.com, gwford(a)home.com, > vlad(a)infonet.com.ua, freebsd-lists-for-dayan-only-owner(a)egroups.co.uk, > kimch(a)etri.re.kr, chris(a)calldei.com, peter(a)guest-tek.com, > sudish(a)corp.earthlink.net, peter(a)wemm.org, cristjc(a)earthlink.net, > yar(a)freebsd.org, shalunov(a)internet2.edu, mike(a)sentex.net, > roy(a)its-sby.edu, kjc(a)csl.sony.co.jp, seichert(a)coopcomp.com geinfecteerd > is met Win32/Swen.A@mm. >Ce mail est généré par Skynet Mail Protection afin de vous prévenir que >l'e-mail envoyé par gbs-vossem(a)pi.be à timofeev(a)granch.ru, >chris(a)aims.com.au, dcs(a)newsguy.com, imp(a)harmony.village.org, >ted(a)ness.plymouth.edu, deepak(a)ai.net, bmilekic(a)technokratis.com, >randy(a)psg.com, sthaug(a)nethelp.no, shelton(a)sentry.granch.ru, >danny_j_mitzel(a)yahoo.com, tinguely(a)web.cs.ndsu.nodak.edu, charon(a)hell.gr, >jesper(a)skriver.dk, anandfranklin(a)hotmail.com, nascar24(a)home.nl, >c.prevotaux(a)hexanet.fr, reichert(a)numachi.com, andy(a)tecc.co.uk, >provos(a)citi.umich.edu, rtek(a)dolfijntje.nl, jack_xiao99(a)hotmail.com, >mark.blackman(a)netscalibur.co.uk, gunther(a)aurora.regenstrief.org, >s_bschmi(a)ira.uka.de, vova(a)express.ru, vlad(a)ariel.phys.wesleyan.edu, >lord(a)4jon.com, assar(a)freebsd.org, peter.jeremy(a)alcatel.com.au, >chaegle(a)mediaone.net, brad(a)wcubed.net, ewiz(a)mail.dotcom.fr, >freedom(a)csie.nctu.edu.tw, oberman(a)es.net, wes(a)softweyr.com, >julian(a)elischer.org, iedowse(a)maths.tcd.ie, sroberts84(a)hotmail.com, >maddave(a)suxx.eu.org,! > ambrisko(a)ambrisko.com, ari(a)suutari.iki.fi, bonnetf(a)news.esiee.fr, > lucky(a)land3.nsu.ru, ume(a)freebsd.org, crewking(a)buckeye-express.com, > bright(a)sneakerz.org, tlambert(a)primenet.com, gwford(a)home.com, > vlad(a)infonet.com.ua, freebsd-lists-for-dayan-only-owner(a)egroups.co.uk, > kimch(a)etri.re.kr, chris(a)calldei.com, peter(a)guest-tek.com, > sudish(a)corp.earthlink.net, peter(a)wemm.org, cristjc(a)earthlink.net, > yar(a)freebsd.org, shalunov(a)internet2.edu, mike(a)sentex.net, > roy(a)its-sby.edu, kjc(a)csl.sony.co.jp, seichert(a)coopcomp.com est infecté > par le virus : Win32/Swen.A@mm. > >Please contact your system administrator for further information. >Gelieve uw systeembeheerder te contacteren voor meer informatie. >Veuillez contacter votre administrateur système pour de plus amples >informations. > >If you are the sender: >Indien u de zender bent: >Si vous êtes l'expéditeur: >------------------- >The scanned e-mail has your address in the <From> header field. Either your >computer is infected or someone's computer having your e-mail address in >the address book has been infected. >De gescande e-mail heeft uw adres in het <From> veld. Dat betekent dat ofwel >jouw computer geinfecteerd is, ofwel dat iemand is geinfecteerd, die jouw >e-mail >adres in zijn/haar adresboek heeft. >Le mail scanné contient votre adresse e-mail dans son en-tête <De>. >Soit votre ordinateur est infecté soit votre adresse e-mail est reprise dans >le carnet d'adresse d'un ordinateur infecté. > >If you are the receiver: >Indien u de bestemmeling bent: >Si vous êtes le destinataire: >--------------------- >Please contact the sender: most likely he/she doesn't know he/she has a >computer virus. >Gelieve de zender te contacteren: hoogst waarschijnlijk weet hij/zij niet >dat hij/zij >geinfecteerd is met een computer virus. >Veuillez contacter l'expéditeur: le plus souvent, il/elle ne sait pas que son >ordinateur est infecté. > >Actions taken for the infected files: >Ondernomen actie voor de geinfecteerde bestanden: >Actions prises pour les fichiers infectés: >------------------------------------- > > >The infected file was saved to quarantine with name: >1075720184-RAVi12B9bAP025868. >The file (part0004:Update.exe) attached to mail (with subject:net critical >upgrade) sent by gbs-vossem(a)pi.be to timofeev(a)granch.ru, >chris(a)aims.com.au, dcs(a)newsguy.com, imp(a)harmony.village.org, >ted(a)ness.plymouth.edu, deepak(a)ai.net, bmilekic(a)technokratis.com, >randy(a)psg.com, sthaug(a)nethelp.no, shelton(a)sentry.granch.ru, >danny_j_mitzel(a)yahoo.com, tinguely(a)web.cs.ndsu.nodak.edu, charon(a)hell.gr, >jesper(a)skriver.dk, anandfranklin(a)hotmail.com, nascar24(a)home.nl, >c.prevotaux(a)hexanet.fr, reichert(a)numachi.com, andy(a)tecc.co.uk, >provos(a)citi.umich.edu, rtek(a)dolfijntje.nl, jack_xiao99(a)hotmail.com, >mark.blackman(a)netscalibur.co.uk, gunther(a)aurora.regenstrief.org, >s_bschmi(a)ira.uka.de, vova(a)express.ru, vlad(a)ariel.phys.wesleyan.edu, >lord(a)4jon.com, assar(a)freebsd.org, peter.jeremy(a)alcatel.com.au, >chaegle(a)mediaone.net, brad(a)wcubed.net, ewiz(a)mail.dotcom.fr, >freedom(a)csie.nctu.edu.tw, oberman(a)es.net, wes(a)softweyr.com, >julian(a)elischer.org, iedowse(a)maths.tcd.ie, sroberts84(a)hotmail.com, >maddave(a)suxx.eu.org! > , ambrisko(a)ambrisko.com, ari(a)suutari.iki.fi, bonnetf(a)news.esiee.fr, > lucky(a)land3.nsu.ru, ume(a)freebsd.org, crewking(a)buckeye-express.com, > bright(a)sneakerz.org, tlambert(a)primenet.com, gwford(a)home.com, > vlad(a)infonet.com.ua, freebsd-lists-for-dayan-only-owner(a)egroups.co.uk, > kimch(a)etri.re.kr, chris(a)calldei.com, peter(a)guest-tek.com, > sudish(a)corp.earthlink.net, peter(a)wemm.org, cristjc(a)earthlink.net, > yar(a)freebsd.org, shalunov(a)internet2.edu, mike(a)sentex.net, > roy(a)its-sby.edu, kjc(a)csl.sony.co.jp, seichert(a)coopcomp.com >is infected with virus: Win32/Swen.A@mm. >The mail was not delivered because it contained dangerous code. > >------------------------ >this is a copy of the e-mail header: > > > >RAV AntiVirus for Linux i386 version: 8.4.2 (snapshot-20030212) > >Scan engine 8.11 for i386. >Last update: Mon, 02 Feb 2004 04:36:04 +01 >Scanning for 89407 malwares (viruses, trojans and worms). -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

7 7

Re: AOL web troubles.. New AOL speedup seems to be a slowdown
by webmaster＠jessicastover.com 02 Feb '04

02 Feb '04

JC, I would encourage you to get more familiar with the HTTP 1.1 spec with regard to your claim of copyright infringement. I will summarize my interpretation of a part of it here. When someone provides HTTP content, they are agreeing to the protocols governing the transmission of that content, which includes caching and transformation of that content by proxy systems. Fortunately, the spec provides for netizens to send Cache-Control headers that can exclude their content from storage on and transformation by proxies. These headers are outlined in the spec, so I'm not going to detail them here. But as far as I have been able to tell, AOL is in compliance with the Cache-Control specs. I see it like this: Not including Cache-Control headers and claiming copyright infringement is like publishing a novel in English and distributing it in the U.S., but printing the copyright notice in Chinese. Clients accessing your content must be able to understand that you do not wish for it to be transformed; and since proxies speak HTTP, content providers need to include the appropriate HTTP headers so the proxies understand their wishes. Conversely, when a content provider excludes Cache-Control headers, ISPs have free reign to handle the content and deliver to the end user in whatever way they wish, as long as that way falls within the HTTP 1.1 spec. As an aside, I have a special folder on my Apache server for Jessica Stover's website where I keep images that I don't want to be compressed by all of these web accelerators (Earthlink and NetZero have them too, not just AOL). In that folder's .htacccess file, I have included instructions to send the "Cache-Control: No-Transform" header on all files requested via HTTP within that folder; those images are not modified in any way by the various web caching systems out there -- the end user gets the identical image to what is stored on my server. ~ The Gunn webmaster(a)jessicastover.com > AOL is copying and redistributing the image in a new format *without the > permission of the copyright holder* in a way that A) makes AOL money and B) > removes protections that the copyright holder had placed on the image to > help keep third parties from reproducing the image without permission. > > and in doing so: > > IMHO they are infringing on the copyright of those who have placed the > digital watermark in the image. > > jc

5 5

Need abuse contact for Yahoo Hostinng
by Christopher X. Candreva 02 Feb '04

02 Feb '04

Sorry to bother the list, but if anyone from Yahoo is listening, There is an credit card stealing web site hosted by Yahoo. Complaints to abuse(a)yahoo.com, as usual for complaints about their hosting, are returned days later saysing "Sorry, we can't do anything since this spam didn't come through Yahoo.: URL: http://aol.account-cgi1.com/update.htm Please contact me directly for a copy of the scam e-mail and the idiotic Yahoo abuse response. If abuse(a)yahoo-inc.com is not the correct address, then this really should be added to the whois record for your hosting netblocks. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0

Re: Did Wanadoo, French ISP, block access to SCO?
by Miquel van Smoorenburg 02 Feb '04

02 Feb '04

In article <Pine.LNX.4.44.0402020046130.1268-100000(a)server2.tcw.telecomplete.net>, Stephen J. Wilcox <steve(a)telecomplete.co.uk> wrote: > >So thats 1-0 to the worm! > >You could do some real cool things if you were controlling the DNS for a site >under a major sustained DDoS, who doesnt the intended victim like.. just >fire up >an A record and they're gone! ;p http://news.netcraft.com/archives/2004/01/30/wwwscocom_is_a_weapon_of_mass_… Mike.

1 0

SCO blames ISPs for blocking access to web site
by Sean Donelan 02 Feb '04

02 Feb '04

SCO's spokesperson Blake Stowell blamed ISPs around the world for blocking access to SCO's web site. SCO says their web site bandwidth is at normal levels. According to SCO the attack is not schedule to begin until Sunday at 1609 GMT. http://www.channelnewsasia.com/stories/afp_world_business/view/68946/1/.html So much for spin-control. If you thought you were helping SCO, it appears SCO doesn't want your help.

5 4

Re: What happened to dot pro... (BTW)
by J. Oquendo 02 Feb '04

02 Feb '04

Anyone can send a spoof through say a misconfigured email server responsible for that TLD say through remixer, posing as someone on that network. Just because someone has some 'nifty' tld means absolutely nothing. If someone truly wants to be held accountable in such fields they could always use PGP to sign the messages they send. Wait for that to happen and I'll be a millionaire before it does. Not to get into an accountability issue here, but in certain professions I feel digital messages should be signed entirely, it sends a sign of some form of trust being given/desired. Personally I would love to see people in office use some form of digital based signature, but that would after all - hold them accountable. ;O =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

4 4

Did Wanadoo, French ISP, block access to SCO?
by Sean Donelan 02 Feb '04

02 Feb '04

EWeek is reporting an anonymous source that Wanadoo, a major French ISP, has stopped all traffic to SCO's web site? Is this true? Have any other ISPs taken similar action?

11 14

Outbound Route Optimization
by Jim Devane 02 Feb '04

02 Feb '04

Hello, I am trying to determine for myself the relevance of Intelligent Routing Devices like Sockeye, Route Science etc. I am not trying to determine who does it better, but rather if the concept of optimizing routes is addressing a significant problem in terms of improved traffic performance ( not in cost savings of disparate transit pipes ) I am interested in hearing other views ( both for and against ) these devices in the context of optimizing latency for a small multi-homed ISP. I want to make sure I understand their context correctly and have not missed any important points of view. My questions are these: "Is sub-optimal routing caused by BGP so pervasive it needs to be addressed?" "Are these devices able to effectively address the need?" Thanks, Jim

11 16