- NANOG - lists.nanog.org

Spam .. Find the sender !
by Jan Czmok 14 May '98

14 May '98

Hi! We got some spam mail from > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007) (153.37.184.151) > by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000 and i cannot query the database (arin , ripe or radb) for the owner of this network. Any hints ? If we can find the sender, then we go for a hunt against this spammers. So far... Greetings Jan Czmok IPF.NET NOC more headers : Return-Path: hioqibua38(a)msn.com > Delivery-Date: Sun May 10 04:48:03 1998 > Received: (qmail 26693 invoked from network); 10 May 1998 04:48:03 -0000 > Received: from claven.cse.psu.edu (HELO cse.psu.edu) (130.203.3.50) > by finch.cse.psu.edu with SMTP; 10 May 1998 04:48:03 -0000 > Received: from relay.ipf.net (relay.ipf.net [195.88.0.13]) by cse.psu.edu (8.8.8/8.7.3) with SMTP id AAA21505 for <0000(a)0000.cs.psu.edu>; Sun, 10 May 1998 00:48:02 -0400 (EDT) > Date: Sun, 10 May 1998 00:48:02 -0400 (EDT) > From: hioqibua38(a)msn.com > Received: (qmail 13706 invoked from network); 10 May 1998 04:47:58 -0000 > Received: from 1cust151.tnt1.tampa.fl.da.uu.net (HELO byte007) (153.37.184.151) > by relay.ipf.net with SMTP; 10 May 1998 04:47:58 -0000 > To: hioqibua38(a)msn.com > Comments: Authenticated sender is <hioqibua38(a)msn.com> > Errors-To: shadow007(a)hotmail.com > Subject: DO YOU KNOW HIS OR HER BACKGROUND??? > Message-Id: <199805103688SAA3125(a)post.ipf.net>

8 10

Are you alive, @Home ?
by Adam Rothschild 13 May '98

13 May '98

I would attempt to mail some @H folks privately, but that does not appear to be an option, given the nature of this problem. sh ip bgp 24.0.0.0 Need I say more? Any information welcome...

2 2

Re: Are you alive, @Home ?
by Curt Howland 13 May '98

13 May '98

There does seem to be something goin on, we lost any routes to 38.0.0.0 today as well. Is there a monster out there eating "class A's"? Wait, Godzilla *is* due soon, perhapps this is the rumblings of his arrival.... Curt- > I would attempt to mail some @H folks privately, but that does not appear > to be an option, given the nature of this problem. > > sh ip bgp 24.0.0.0 > > Need I say more? > > Any information welcome... > > >

1 0

backbone in shreveport, la?
by Jeff Deyo 13 May '98

13 May '98

does anyone know of a tier I provider in shreveport? i tried digex, but could not accomodate us. we are a clec and are hot to almost every telco wired building in the area with fiber. we are just llooking for someone we can pay the port charge to. would not need a local loop charge since we are our own local loop. just want a port charge instead of having to pay any colocate fees like digex was wanting. any reccomendations? thanks, jeff ~~^v~^v~^v~^v~^v~^v~^v~^v~^v~^v~^v~^v~^v~~^v~^^v~^v~^v~^v~~^^v~^v~ Jeff Deyo (JD1537) KMC Telecommunications Network Analyst 506 Caddo Street (318)213-8093 (wk) Shreveport, LA 71101 (318)424-8093 (wk) mailto:jdeyo@kmctelecom.com http://www.deyo.org mailto:jdeyo@shreve.net ICQ 260339

1 0

RE: Agis Detroit
by Lyle Antieau 13 May '98

13 May '98

John, We are in the middle of a migration to OC-48 based network. It sounds like there may have been a lack of communication on our part. In the future, please direct any inquiries to our NOC at noc(a)agis.net, I am confident that they would be able to answer any questions that you may have. Lyle Antieau AGIS At 01:35 PM 5/12/98 +0000, you wrote: >I was wondering if anyone had heard anything recently about Agis >moving a POP. I contacted them and no one could give me ANY >information. My line was from the Bagley (Detroit, MI) POP but 2 >weeks ago Ameritech returned to install a line to the Outer Drive >(Dearborn, MI) POP. > >I was wondering if any AGIS personell that have a clue (With my >experiences there aren't frequent) could pass me any information. > >

1 0

Re: Possible login/password grabbing ploy
by Joe Provo - Network Architect 13 May '98

13 May '98

> I have found that most of the common mis-spellings of our domain name > have been registered with the Internic by a company named Americaoffline. Yup. They've been busy registering dropped-letter variants of many folks. All the zones I've looked at are merely wildcard A records, not purposeful hosts. I was sorely disappointed that http://www.americaoffline.com/ contains no references to malicous nor humourous stuff. Personally, I was hoping for large-scale lampooning. Nothing at the real provider's home base, INSTANET.COM, reveals anything of interest. Some kook thinking he can auction off typo domains? Joe

18 19

NANOG 13 REMINDER
by Pam Ciesla 13 May '98

13 May '98

The attendee list has been updated. If you are not on it, but should be or if you have any other questions please contact. The room block at the Hyatt ends Friday, 5/15. Be sure to reserve your room. All information is available on the NANOG webpage http://www.nanog.org. xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Pam Ciesla 734-936-0172 - phone Merit Network, Inc. 734-647-3185 - fax University of Michigan 4251 Plymouth Road Bldg. I, Suite C Ann Arbor, MI 48105-2785 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

1 0

Re: Authoratative Nameserver Info
by Jon Lewis 13 May '98

13 May '98

On Wed, 13 May 1998, Raymond Curci wrote: > I recently migrated a DNS server with many domains and found > out an undocumented command. If you first find out the NIC handle > for your DNS server, use the whois interface's server command to > locate domains with NS records pointing to your server. > Here is an example to locate domains with NS records pointing at > my server, CNTFL.COM: I've been doing that for some time...trouble is, we're listed as authoratative for probably a thousand domains or more. yoda:~$ whois "server KASHM-HST" [rs.internic.net] Aborting search 256 records found ..... ------------------------------------------------------------------ Jon Lewis <jlewis(a)fdt.net> | I guess only the first 256 are Network Administrator | important :) Florida Digital Turnpike | ______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____

1 0

1.1.1.0/24
by SASAKI Kazuyoshi 13 May '98

13 May '98

who's living here? -sasaki -------------------------------------------------- SJS1>sh ip bgp BGP table version is 15571821, local router ID is 158.205.224.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * 1.1.1.0/24 204.70.158.109 80 0 3561 174 i * i 137.39.136.73 80 0 701 174 i *> 137.39.252.17 80 0 701 174 i ...snip... SJS1>ping 1.1.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echoes to 1.1.1.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 96/208/396 ms SJS1> --------------------------------------------------

1 0

Digex in Houston?
by Louis Destree 12 May '98

12 May '98

Can someone clueful from Digex fill me in on what's going on in Houston right now? Your NOC wouldn't say much, and had no ETA. Thanks, Louis -- Louis A. Destree Senior Network Engineer FlashNet Communications destree(a)flash.net

3 2