- NANOG - lists.nanog.org

Stopping ip range scans
by william＠elan.net 05 Jan '04

05 Jan '04

Recently (this year...) I've noticed increasing number of ip range scans of various types that envolve one or more ports being probed for our entire ip blocks sequentially. At first I attributed all this to various windows viruses, but I did some logging with callbacks soon after to origin machine on ports 22 and 25) and substantial number of these scans are coming from unix boxes. I'm willing to tolerate some random traffic like dns (although why would anybody send dns requests to ips that never ever had any servers on them?), but scans on random port of all my ips - that I consider to be a serious security issue and I'm getting tired of it to say the least (not to mention that its drain on resources as for example routers have to answer and try to route all the requests or answer back that they could not). So I'm wondering what are others doing on this regard? Is there any router configuration or possibly intrusion detection software for linux based firewall that can be used to notice as soon as this random scan starts and block the ip on temporary basis? Best would be some kind of way to immediatly detect the scan on the router and block it right there... Any people or networks tracking this down to perhaps alert each other? -- William Leibzon Elan Networks william(a)elan.net

8 8

Re: Cable and Wireless Security Contact?
by Richard Cocks 05 Jan '04

05 Jan '04

Paul if you look closer you'll see they have pipes to not only CWUSA, but Abovenet and NetAccess. All of these providers are announcing the hijacked IP block. Richard ----- Original Message ----- From: "Paul" <paul(a)rusko.us> Date: Fri, 2 Jan 2004 10:55:29 -0500 To: "Daniel Roesen" <dr(a)cluenet.de>, <nanog(a)merit.edu> Subject: Re: Cable and Wireless Security Contact? > > daniel, > > they are a cw customer - http://www.fixedorbit.com/AS/20/AS20473.htm > some of their gear is in the cw dc in jersey city. > > paul > > ----- Original Message ----- > From: "Daniel Roesen" <dr(a)cluenet.de> > To: <nanog(a)merit.edu> > Sent: Friday, January 02, 2004 8:50 AM > Subject: Re: Cable and Wireless Security Contact? > > > > > > On Fri, Jan 02, 2004 at 02:41:17PM +0800, Hijacked L wrote: > > > Could a security contact from C&W PLEASE contact me off list? > > > This is very important! > > > One of your customers, Net Transactions LLC > > > > I don't see AS20473 being a C&W customer. Are you perhaps mixing > > up C&W and AboveNet? > > > > > > Regards, > > Daniel > -- ____________________________________________________ Get your own Hello Kitty email @ www.sanriotown.com Powered by Outblaze

5 4

[Fwd: att.net Mail Admin Contact?]
by Mark Foster 04 Jan '04

04 Jan '04

Apologies for the inconvenice to others on NANOG for this post. I've tried repeatedly over the last 6 weeks or more to get in touch with someone within att.net's Abuse/Security/Mail administration. I'd appreciate it if someone in such a position could please contact me off list with urgency. Thanks, Mark.

1 0

Re: Out of office/vacation messages
by Stephen J. Wilcox 03 Jan '04

03 Jan '04

On Sat, 3 Jan 2004, Gregh wrote: > > >> - run on Windows, > > >> Oops, I see your problem. No self-respecting network operator runs and > > >> M$W boxen as an MTA, so Templin is an imposter/troll. > > > > > > This isnt true, the majority run Windows (at least thats what I see in > > > various meetings and from the user-agent headers) > > > > I'm not arguing with your conclusion, but your reasoning is a little broken. > > Only a small proportion of the nanog list membership attend meetings, and > > those that do don't necessarily provide a representative distribution (of > > any kind). > > > > Similarly, the user-agent headers you see are from people on nanog-post; I > > am told the nanog list is much bigger. > > You know, I wish I had Nanog posting rights. This whole thing is very SIMPLY > taken care of yet so many "professionals" are making a D in a B cup about > it! > > You can write/buy/install any flavour of OS you like with a very simple rule > in it to delete "out of office" messages from the server OR just blackban > that particular email address for "X" number of days. > > Why is the obvious always the thing most people argue about? That wont work - how do you sort the bad ooo's from the legitimate ones. The problem is on the sending side not the receiving and a quick hack isnt going to fix anything but you may annoy a few people on the false positives you drop.. And any half decent IT manager isnt going to allow a hack into a system, they are going to require a proper solution. Steve

1 0

Cable and Wireless Security Contact?
by Hijacked L 02 Jan '04

02 Jan '04

Could a security contact from C&W PLEASE contact me off list? This is very important! One of your customers, Net Transactions LLC (doing business under the name "Choopa"), is advertising 146.20.40.0/21. According to ARIN whois and www.completewhois.com, this IP block is illegally hijacked, and used without authorization from its original owners. I've tried contacting your NOC on several occasions via telephone and e-mail and have been unable to get this advertisement filtered. In addition, I've called Erie Forge and Steel, the rightful owners of this block, who've articulated they've gotten numerous complaints about port scanning and spam from this IP block. Route-server output enclosed. route-server.phx1>sh ip bgp 146.20.40.0 BGP routing table entry for 146.20.40.0/21, version 2398010279 Paths: (14 available, best #3) Not advertised to any peer 6461 20473 20473, (received & used) 203.192.129.42 (inaccessible) from 203.192.128.96 (203.192.128.96) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2402 3549:32392 Originator: 203.192.129.16, Cluster list: 0.0.1.155 6461 20473 20473, (received & used) 203.192.129.42 (inaccessible) from 203.192.134.97 (203.192.134.97) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2402 3549:32392 Originator: 203.192.129.16, Cluster list: 0.0.1.155 6461 20473 20473 206.132.117.1 from 67.17.81.117 (67.17.81.117) Origin IGP, metric 50, localpref 200, valid, internal, best Community: 3549:2082 3549:30840 Originator: 67.17.80.182, Cluster list: 0.0.0.81 6461 20473 20473, (received-only) 208.50.13.106 from 67.17.81.117 (67.17.81.117) Origin IGP, metric 50, localpref 200, valid, internal Community: 3549:2082 3549:30840 Originator: 67.17.80.182, Cluster list: 0.0.0.81 OrgName: Erie Forge and Steel OrgID: EFS Address: 1341 West 16th Street Address: P.O. Box 180 City: Erie StateProv: PA PostalCode: 16512 Country: US NetRange: 146.20.0.0 - 146.20.255.255 CIDR: 146.20.0.0/16 NetName: IWAVE NetHandle: NET-146-20-0-0-1 Parent: NET-146-0-0-0-0 NetType: Direct Allocation Comment: The information for this network has been reported to Comment: be invalid. ARIN has attempted to obtain updated data, but has Comment: been unsuccessful. To provide current contact information, Comment: please e-mail hostmaster(a)arin.net. RegDate: 1991-01-18 Updated: 2003-06-30 -- ____________________________________________________ Get your own Hello Kitty email @ www.sanriotown.com Powered by Outblaze

4 4

RE: Out of office/vacation messages
by McBurnett, Jim 02 Jan '04

02 Jan '04

->Must really suck to put ALL those rules on and take them off ->every time you go ->on vacation. (Yes, I'm on at least 65 mailing lists - and ->that's just the ones ->high-volume enough to warrant filtering to their own folder). -> And even if you're ->on only 4 or 5 lists, that's enough work to mean it's likely ->you'll forget one. No, you setup the rules once and then turn on the OoO when necessary.. I have 40 or so rules.. and they are relatively easy.. -> ->Hardly a selling point for your choice of software. Unless ->it's a disguised ->"My management makes me use software so broken I have to...." story? I seem remember a conversation about a "big" business standard would not be a "big" business standard without good reason...... <ALMOST PUT AN EMOTICON>

2 1

RE: Out of office/vacation messages
by McBurnett, Jim 02 Jan '04

02 Jan '04

Microsoft Mail server is configureable so as not to send the out of office emails out to the internet for the entire server.. This is an ADMIN config.. ALSO if a user goes to the out of office attendent in Outlook, they has the option of creating rules.. RULE #1: If from owner-nanog(a)merit.edu Move the email to "NANOG EMAILS WHILE I WAS OUT SO I DON'T GET FLAMED FOLDER." Stop Processing more rules Rule # 2: Reply to Jerry WITH "I am taking 6 Month leave of ABSENSE to learn how to wear asbestos underwear" Stop Preccessing more rules.... Rule # 3: everyone else THERE that should settle it.. THIS WORKS I USE IT! Enough already folks! If anyone using exchange out there wants some nice screen shots, drop me a line, off list please, I will create it and send it to all at once via a BCC so no one needs to know who you are. Later, Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Valdis.Kletnieks(a)vt.edu ->Sent: Friday, January 02, 2004 1:32 PM ->To: Rachel K. Warren ->Cc: nanog(a)merit.edu ->Subject: Re: Out of office/vacation messages -> -> ->On Fri, 02 Jan 2004 10:13:28 PST, "Rachel K. Warren" -><rachel(a)plur.net> said: -> ->> Sometimes you have no choice but to run a Windows mail ->client - it's called ->> your company forcing you to a standard mailer. It's not ->something I have ->> liked doing in the past, but having your management heavily ->disaprove of ->> using something outside of standard is usually not a good thing. -> ->Wave the "security issue" flag at them on this one. There's ->a number of good ->security reasons to not use software that blabs in response ->to mailing list mail: -> ->1) If this is a reply to a message from a mailing list that ->you usually "lurk" ->on, your subscription to the list has just been revealed ->(probably to every ->person who is posting - possibly to the entire list if your ->responder replied ->to the list). -> ->2) The fact you are "Out of your office" could reveal ->information to a hacker. -> ->2a) The hacker now knows that you aren't watching your PC ->very carefully, and ->thus it's possibly a better target for a hacking attempt. -> ->2b) If the hacker has gotten a message "George Smith is at a ->client site until ->Aug 30", he can try calling your company and saying "This is ->George.. I'm at ->the client's site, and I can't get to the corporate net. Can ->you reset my ->password so I can get the documents I need to close this ->deal?". This is an ->amazingly effective "social engineering" attack. -> ->2c) The software most responsible for these errant messages ->is also well-known ->for multiple security issues - and quite often even puts its ->exact version in ->the X-Mailer header. This allows an attacker to send you a ->malicious e-mail ->message (specially selected for your software version), for ->you to read when ->you get back (and are probably buried under many messages and ->not paying as ->much attention to the contents as you should). -> ->If that doesn't work, point the PHB at this: -> ->http://news.bbc.co.uk/1/hi/technology/3290251.stm -> ->Only 2 out of the top 10 viruses/worms for last year did ->*NOT* target Outlook. -> ->Then ask the PHB if they have any legal criterion of "due ->care" that would put ->them at risk of being negligent for continuing to run their ->business in a known ->dangerous manner. -> ->

2 1

Packet-based multi-service provisioning platforms [MSPP]
by Henry Linneweh 02 Jan '04

02 Jan '04

I am interested in problems in this area and what nanog members are part of this emerging market and are generating a profit..... -Henry

1 0

The Cidr Report
by cidr-report＠potaroo.net 02 Jan '04

02 Jan '04

This report has been generated at Fri Jan 2 21:47:21 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 26-12-03 129101 90485 27-12-03 129152 90411 28-12-03 128993 90454 29-12-03 129056 90534 30-12-03 129312 90459 31-12-03 129124 90575 01-01-04 129207 90551 02-01-04 129307 90461 AS Summary 16314 Number of ASes in routing system 6526 Number of ASes announcing only one prefix 1395 Largest number of prefixes announced by an AS AS7018 : ATT-INTERNET4 AT&T WorldNet Services 73402112 Largest address span announced by an AS (/32s) AS568 : SUMNET-AS DISO-UNRRA Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 02Jan04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 129175 90402 38773 30.0% All ASes AS4134 709 124 585 82.5% CHINANET-BACKBONE No.31,Jin-rong Street AS6197 823 296 527 64.0% BATI-ATL BellSouth Network Solutions, Inc AS4323 675 204 471 69.8% TW-COMM Time Warner Communications, Inc. AS7018 1395 960 435 31.2% ATT-INTERNET4 AT&T WorldNet Services AS701 1386 955 431 31.1% ALTERNET-AS UUNET Technologies, Inc. AS7843 508 117 391 77.0% ADELPHIA-AS Adelphia Corp. AS6198 569 228 341 59.9% BATI-MIA BellSouth Network Solutions, Inc AS22909 320 13 307 95.9% DNEO-OSP1 Comcast Cable Communications, Inc. AS27364 381 81 300 78.7% ACS-INTERNET Armstrong Cable Services AS22773 327 31 296 90.5% CCINET-2 Cox Communications Inc. Atlanta AS1239 957 669 288 30.1% SPRINTLINK Sprint AS4355 380 101 279 73.4% ERMS-EARTHLNK EARTHLINK, INC AS1221 912 657 255 28.0% ASN-TELSTRA Telstra Pty Ltd AS17676 290 42 248 85.5% GIGAINFRA Softbank BB Corp. AS6347 325 83 242 74.5% DIAMOND SAVVIS Communications Corporation AS25844 243 16 227 93.4% SKADDEN1 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 273 55 218 79.9% SATYAMNET-AS Satyam Infoway Ltd., AS209 730 515 215 29.5% ASN-QWEST Qwest AS6140 351 136 215 61.3% IMPSAT-USA ImpSat AS14654 206 3 203 98.5% WAYPORT Wayport AS11305 231 38 193 83.5% INTERLAND-NET1 Interland Incorporated AS4519 194 13 181 93.3% MAAS Maas Communications AS6478 218 41 177 81.2% ATT-INTERNET3 AT&T WorldNet Services AS9929 204 27 177 86.8% CNCNET-CN China Netcom Corp. AS6327 204 28 176 86.3% SHAW Shaw Communications Inc. AS2386 408 239 169 41.4% INS-AS AT&T Data Communications Services AS20115 581 414 167 28.7% CHARTER-NET-HKY-NC Charter Communications AS15270 204 41 163 79.9% AS-PAETEC-NET PaeTec.net -a division of PaeTecCommunications, Inc. AS2048 245 83 162 66.1% LANET-1 State of Louisiana AS4766 389 234 155 39.8% KIX Korea Internet Exchange for "96 World Internet Exposition Total 14638 6444 8194 56.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 ANDARA-HSI Andara High Speed Internet c/o Halifax Cable Ltd. 61.12.32.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 61.12.34.0/24 AS7545 TPG-INTERNET-AP TPG Internet Pty Ltd 64.62.64.0/24 AS3549 GBLX Global Crossing 64.62.126.0/23 AS25700 SWIFTDESK SWIFTDESK VENTURE 66.41.192.0/18 AS13367 CCCH-AS3 Comcast Cable Communications Holdings, Inc 69.8.128.0/17 AS7260 NORLIGHT Norlight Telecommunications 132.0.0.0/10 AS568 SUMNET-AS DISO-UNRRA 137.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 138.136.0.0/13 AS568 SUMNET-AS DISO-UNRRA 140.143.2.0/24 AS1221 ASN-TELSTRA Telstra Pty Ltd 158.0.0.0/13 AS568 SUMNET-AS DISO-UNRRA 192.43.230.0/24 AS4738 SAARDNET-AS South Australian Academic Research and Development Network 192.44.0.0/19 AS702 AS702 MCI EMEA 192.64.84.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.16.0/20 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.32.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.64.0/19 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.96.0/22 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.83.100.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.119.135.0/24 AS270 PSCNI-AS National Aeronautics and Space Administration 192.124.252.0/22 AS680 AS680 DFN-IP service G-WiN 192.135.50.0/24 AS7018 ATT-INTERNET4 AT&T WorldNet Services 192.136.71.0/24 AS719 AS719 LANLINK autonomous system 192.136.79.0/24 AS719 AS719 LANLINK autonomous system 192.153.144.0/21 AS568 SUMNET-AS DISO-UNRRA 192.172.0.0/19 AS568 SUMNET-AS DISO-UNRRA 192.188.208.0/20 AS568 SUMNET-AS DISO-UNRRA 192.243.32.0/23 AS2044 PALIN-AS Palin Aquisitions Inc. 198.23.26.0/24 AS4390 BELLATLANTIC-COM Bell Atlantic, Inc. 198.41.194.0/24 AS1982 ASN-NWNEXUS Northwest Nexus Inc. 198.97.72.0/21 AS568 SUMNET-AS DISO-UNRRA 198.97.80.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.88.0/24 AS89 NUSC-CSTLNET-AS Naval Underwater Systems Center 198.97.192.0/20 AS568 SUMNET-AS DISO-UNRRA 198.97.240.0/20 AS568 SUMNET-AS DISO-UNRRA 198.101.4.0/22 AS568 SUMNET-AS DISO-UNRRA 198.136.32.0/20 AS19329 MCNET Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY-NET CityNet, Inc. 198.161.87.0/24 AS6539 GROUPTLCOM GT Group Telecom Services Corp. 198.161.165.0/24 AS852 ASN852 Telus Advanced Communications 198.163.155.0/24 AS684 MBNET-AS Manitoba Regional Network 198.167.0.0/16 AS7456 INTERHOP Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASKTEL SaskTel 198.232.133.0/24 AS23075 SKOTOS-AS Skotos Tech, Inc 199.10.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.60.0.0/20 AS271 BCNET-AS University of British Columbia 199.84.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 199.114.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.0.0/21 AS568 SUMNET-AS DISO-UNRRA 199.114.128.0/18 AS568 SUMNET-AS DISO-UNRRA 199.114.130.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.132.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.136.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.138.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.140.0/24 AS3544 ITSDN-U7 DISA/UNRRA 199.114.142.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.144.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.148.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.150.0/24 AS721 DLA-ASNBLOCK-AS DoD Network Information Center 199.114.152.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.154.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.114.156.0/24 AS1913 DLA4 Defense Logistics Agency 199.114.160.0/24 AS1733 CENTAF-SWA AF DDN PMO 199.120.32.0/19 AS16582 NEXTLEVELINTERNET NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS568 SUMNET-AS DISO-UNRRA 199.123.0.0/18 AS568 SUMNET-AS DISO-UNRRA 199.123.16.0/20 AS568 SUMNET-AS DISO-UNRRA 199.123.80.0/21 AS568 SUMNET-AS DISO-UNRRA 199.189.32.0/19 AS7332 IQUEST-AS IQuest Internet 199.202.0.0/16 AS701 ALTERNET-AS UUNET Technologies, Inc. 200.120.0.0/16 AS22047 CL-VPNS-LACNIC VTR BANDA ANCHA S.A. 202.0.180.0/24 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.4.252.0/22 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.4.255.0/24 AS4799 UNSPECIFIED Ji Tong Communications Co., Ltd. 202.70.240.0/20 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.72.112.0/22 AS22351 INTELSAT-1 INTELSAT 202.122.76.0/24 AS17553 TIMELESS-AP System Integration provider 202.136.254.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 202.136.255.0/24 AS4808 CHINA169-BJ CNCGROUP IP network¡ªChina169 Beijing Province Network 203.32.4.0/23 AS7617 APNIC-AS-2-BLOCK Asia Pacific Network Information Centre 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.76.128.0/24 AS9729 IS-AP iAdvantage Limited 203.76.224.0/24 AS9549 COMDEK-ISP-AS-AP Comdek ISP 203.86.2.0/23 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 203.132.95.0/24 AS9787 CONCEPT-AU-AP Concept Networks 203.132.97.0/24 AS7652 VIANET-AS-AP Vianet Communications Pty Ltd 203.132.107.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.108.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.109.0/24 AS10141 CALOUNDRA-AS-AP Caloundra.net 203.132.111.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.112.0/24 AS10236 FOXGOLD-NET-AU-AP FOXGOLD COMMUNICATIONS 203.132.118.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.122.0/24 AS4802 WANTREE-AS-AP Wantree Development 203.132.123.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.124.0/24 AS18065 CENTRALDATA-WA Central Data Pty Ltd. 203.132.125.0/24 AS4817 TECHEX1-AS-AP Techex Primary Netblock 203.135.99.0/24 AS2687 IBM-MMD-AS IBM 204.19.224.0/19 AS816 UUNET-AS4 UUNET Technologies, Inc. 204.69.144.0/22 AS5668 AS-5668 CenturyTel Internet Holdings, Inc. 204.154.125.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLABS-ASN TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBIT 205.150.0.0/15 AS701 ALTERNET-AS UUNET Technologies, Inc. 206.41.32.0/19 AS14824 NEWSOUTH NewSouth Communications Corp. 206.81.187.0/24 AS19194 JOVITA Sentris Network LLC 206.108.34.0/24 AS852 ASN852 Telus Advanced Communications 206.108.35.0/24 AS852 ASN852 Telus Advanced Communications 206.167.57.0/24 AS376 RISQ-AS Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ALLST-15290 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL Telesat International Ltd. 207.47.39.0/24 AS816 UUNET-AS4 UUNET Technologies, Inc. 207.162.192.0/19 AS4589 EASYNET Easynet Group Plc 207.231.96.0/19 AS11194 NUNETPA NuNet Inc 208.81.187.0/24 AS19194 JOVITA Sentris Network LLC 209.169.219.0/24 AS189 GENUITY-AS189 Genuity 209.169.223.0/24 AS189 GENUITY-AS189 Genuity 209.172.0.0/18 AS7770 TRITON Triton Technologies, Inc. 209.196.192.0/19 AS1784 GNAPS Global NAPs Networks 209.213.32.0/19 AS10629 INTERPAC Inter-Pacific Network Services 209.213.50.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.51.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.55.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.213.56.0/24 AS10629 INTERPAC Inter-Pacific Network Services 209.222.137.0/24 AS27429 TIL Telesat International Ltd. 209.240.96.0/19 AS10815 KCNET KCnet, Inc. 209.251.0.0/19 AS11036 SISCOM SISCOM, Inc 209.251.64.0/19 AS10266 NETWAY-AS MDC, Inc. 210.213.0.0/19 AS6453 GIEUROPE Teleglobe America Inc. 216.18.224.0/21 AS11458 IMBRIS IMBRIS, INC. 216.18.224.0/22 AS11458 IMBRIS IMBRIS, INC. 216.18.228.0/22 AS11458 IMBRIS IMBRIS, INC. 216.36.46.0/24 AS7176 GENUITY-AS7176 Genuity 216.36.47.0/24 AS7176 GENUITY-AS7176 Genuity 216.96.128.0/18 AS7018 ATT-INTERNET4 AT&T WorldNet Services 220.228.0.0/16 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.0.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.0.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.32.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.64.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.96.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.128.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.128.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.160.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.192.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.228.224.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/16 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.0.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.32.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.64.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.96.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.128.0/17 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.128.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.160.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.192.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. 220.229.224.0/19 AS9919 NCIC-TW New Century InfoComm Tech Co., Ltd. Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0

Re: any bellsouth admins around?
by mduckett＠bellsouth.net 31 Dec '03

31 Dec '03

Working to get you a contact. Stand by. > > From: Mark Jeftovic <markjr(a)easydns.com> > Date: 2003/12/31 Wed PM 07:37:59 GMT > To: nanog(a)merit.edu > Subject: any bellsouth admins around? > > > > Any bellsouth admins around? > > This would suck if it kept up over the holiday... > > -mark > > -- > Mark Jeftovic <markjr(a)easydns.com> > Co-founder, easyDNS Technologies Inc. > ph. +1-(416)-535-8672 ext 225 > fx. +1-(416)-535-0237 > > ---------- Forwarded message ---------- > Date: Wed, 31 Dec 2003 14:19:24 -0500 (EST) > From: Simon Carr <scarr(a)easydns.com> > To: abuse(a)bellsouth.net > Subject: Abuse: Getting hammered with forged addresses. > > Hey there, > > We seem to be getting hammered with forged addresses from several > bellsouth IPs on the 205.152.59.0/24 netblock. Please try to take action > agains this immediately as it is causing severe load on our SMTP cluster. > > Dec 31 13:27:25 10.0.2.44 postfix/smtpd[4221]: 13EEC4F3B3: > client=imf16aec.mail.bellsouth.net[205.152.59.64] > Dec 31 13:27:39 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <federicohooperfk(a)syselog.fr>: Sender address rejected: Domain not found; > from=<federicohooperfk(a)syselog.fr> to=<dmeans(a)the-means.net> > Dec 31 13:28:15 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <sritteron(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<sritteron(a)ipcc.ch> > to=<dmeans(a)the-means.net> > Dec 31 13:28:23 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <deghejmfp(a)genie.com>: > Sender address rejected: Domain not found; from=<deghejmfp(a)genie.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:35 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <jim223bfovl(a)home.com>: > Sender address rejected: Domain not found; from=<jim223bfovl(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:28:41 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 > <K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net>: Sender address rejected: > Domain not found; from=<K3TF72Ml1morientesedXqv0Cdr(a)freeserve.net> > to=<dmeans(a)the-means.net> > Dec 31 13:28:49 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <MGgcVpy(a)home.com>: Sender > address rejected: Domain not found; from=<MGgcVpy(a)home.com> > to=<dmeans(a)the-means.net> > Dec 31 13:29:36 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <w9hsxyu(a)wonderful.com>: > Sender address rejected: Domain not found; from=<w9hsxyu(a)wonderful.com> > to=<dmeans(a)the-means.net> > Dec 31 13:30:18 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <d.carrillo_lr(a)reg.fi>: > Sender address rejected: Domain not found; from=<d.carrillo_lr(a)reg.fi> > to=<dmeans(a)the-means.net> > Dec 31 13:31:22 10.0.2.44 postfix/smtpd[4221]: reject: RCPT from > imf16aec.mail.bellsouth.net[205.152.59.64]: 450 <lhancock_nh(a)ipcc.ch>: > Sender address rejected: Domain not found; from=<lhancock_nh(a)ipcc.ch> > to=<dmeans(a)the-means.net> > > > -- > Simon Carr, > easyDNS Technologies, Inc. > http://www.easydns.com > >

1 0