- NANOG - lists.nanog.org

Google.com redirecting to Google.co.in
by Vikash Sorout 29 Jul '16

29 Jul '16

blockquote, div.yahoo_quoted { margin-left: 0 !important; border-left:1px #715FFA solid !important; padding-left:1ex !important; background-color:white !important; } Hi All, When I am trying to hit Google.com it's redirecting me to Google.co.in. I am using VPN network globally over MPLS networks So for all locations internet is going via Level 3 in North America . You can go here for my IP details. I am seeking for support please help me out. Side note : Google geo-coding is looking good. Sent from Yahoo Mail for iPhone

3 2

ASR920-12G-2-10G
by Andrew N 29 Jul '16

29 Jul '16

Hello, We're looking to purchase 1. Can anyone confirm this is a permanent license for the router? Thanks. Andrew

2 1

Weekly Routing Table Report
by cscora＠apnic.net 29 Jul '16

29 Jul '16

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, AusNOG, SANOG, PacNOG, SAFNOG, SdNOG, BJNOG, CaribNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 30 Jul, 2016 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 605937 Prefixes after maximum aggregation (per Origin AS): 218930 Deaggregation factor: 2.77 Unique aggregates announced (without unneeded subnets): 295442 Total ASes present in the Internet Routing Table: 54446 Prefixes per ASN: 11.13 Origin-only ASes present in the Internet Routing Table: 36489 Origin ASes announcing only one prefix: 15509 Transit ASes present in the Internet Routing Table: 6470 Transit-only ASes present in the Internet Routing Table: 172 Average AS path length visible in the Internet Routing Table: 4.3 Max AS path length visible: 54 Max AS path prepend of ASN ( 55644) 51 Prefixes from unregistered ASNs in the Routing Table: 68 Unregistered ASNs in the Routing Table: 16 Number of 32-bit ASNs allocated by the RIRs: 14821 Number of 32-bit ASNs visible in the Routing Table: 11487 Prefixes from 32-bit ASNs in the Routing Table: 45357 Number of bogon 32-bit ASNs visible in the Routing Table: 14 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 377 Number of addresses announced to Internet: 2822086116 Equivalent to 168 /8s, 53 /16s and 157 /24s Percentage of available address space announced: 76.2 Percentage of allocated address space announced: 76.2 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 98.2 Total number of prefixes smaller than registry allocations: 196985 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 156685 Total APNIC prefixes after maximum aggregation: 42877 APNIC Deaggregation factor: 3.65 Prefixes being announced from the APNIC address blocks: 169189 Unique aggregates announced from the APNIC address blocks: 68365 APNIC Region origin ASes present in the Internet Routing Table: 5197 APNIC Prefixes per ASN: 32.56 APNIC Region origin ASes announcing only one prefix: 1180 APNIC Region transit ASes present in the Internet Routing Table: 933 Average APNIC Region AS path length visible: 4.4 Max APNIC Region AS path length visible: 54 Number of APNIC region 32-bit ASNs visible in the Routing Table: 2259 Number of APNIC addresses announced to Internet: 759212868 Equivalent to 45 /8s, 64 /16s and 171 /24s Percentage of available APNIC address space announced: 88.7 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-137529 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 182664 Total ARIN prefixes after maximum aggregation: 89227 ARIN Deaggregation factor: 2.05 Prefixes being announced from the ARIN address blocks: 188251 Unique aggregates announced from the ARIN address blocks: 88506 ARIN Region origin ASes present in the Internet Routing Table: 16265 ARIN Prefixes per ASN: 11.57 ARIN Region origin ASes announcing only one prefix: 5757 ARIN Region transit ASes present in the Internet Routing Table: 1699 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 23 Number of ARIN region 32-bit ASNs visible in the Routing Table: 1357 Number of ARIN addresses announced to Internet: 1105299936 Equivalent to 65 /8s, 225 /16s and 137 /24s Percentage of available ARIN address space announced: 58.5 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-397212 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 145236 Total RIPE prefixes after maximum aggregation: 71314 RIPE Deaggregation factor: 2.04 Prefixes being announced from the RIPE address blocks: 155038 Unique aggregates announced from the RIPE address blocks: 95411 RIPE Region origin ASes present in the Internet Routing Table: 18101 RIPE Prefixes per ASN: 8.57 RIPE Region origin ASes announcing only one prefix: 7832 RIPE Region transit ASes present in the Internet Routing Table: 3016 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 27 Number of RIPE region 32-bit ASNs visible in the Routing Table: 4958 Number of RIPE addresses announced to Internet: 706001024 Equivalent to 42 /8s, 20 /16s and 184 /24s Percentage of available RIPE address space announced: 102.6 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 196608-204287 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 61638 Total LACNIC prefixes after maximum aggregation: 12265 LACNIC Deaggregation factor: 5.03 Prefixes being announced from the LACNIC address blocks: 76799 Unique aggregates announced from the LACNIC address blocks: 36773 LACNIC Region origin ASes present in the Internet Routing Table: 2483 LACNIC Prefixes per ASN: 30.93 LACNIC Region origin ASes announcing only one prefix: 568 LACNIC Region transit ASes present in the Internet Routing Table: 576 Average LACNIC Region AS path length visible: 4.8 Max LACNIC Region AS path length visible: 24 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 2675 Number of LACNIC addresses announced to Internet: 170224704 Equivalent to 10 /8s, 37 /16s and 108 /24s Percentage of available LACNIC address space announced: 101.5 LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-265628 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 14288 Total AfriNIC prefixes after maximum aggregation: 3237 AfriNIC Deaggregation factor: 4.41 Prefixes being announced from the AfriNIC address blocks: 16283 Unique aggregates announced from the AfriNIC address blocks: 6049 AfriNIC Region origin ASes present in the Internet Routing Table: 734 AfriNIC Prefixes per ASN: 22.18 AfriNIC Region origin ASes announcing only one prefix: 172 AfriNIC Region transit ASes present in the Internet Routing Table: 176 Average AfriNIC Region AS path length visible: 4.5 Max AfriNIC Region AS path length visible: 21 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 238 Number of AfriNIC addresses announced to Internet: 81007360 Equivalent to 4 /8s, 212 /16s and 19 /24s Percentage of available AfriNIC address space announced: 80.5 AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5553 4191 75 ERX-CERNET-BKB China Education and Rese 7545 3428 384 253 TPG-INTERNET-AP TPG Telecom Limited, AU 4766 3186 11145 1126 KIXS-AS-KR Korea Telecom, KR 17974 2933 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 9829 2613 1488 513 BSNL-NIB National Internet Backbone, IN 1659 2493 1466 38 ERX-TANET-ASN1 Taiwan Academic Network 9808 2233 8761 40 CMNET-GD Guangdong Mobile Communication 4755 2079 432 243 TATACOMM-AS TATA Communications formerl 4808 1796 2309 548 CHINA169-BJ China Unicom Beijing Provin 38197 1507 93 277 SUNHK-DATA-AS-AP Sun Network (Hong Kong Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 22773 3497 2965 144 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 6389 2225 3671 41 BELLSOUTH-NET-BLK - BellSouth.net Inc., 18566 2195 405 110 MEGAPATH5-US - MegaPath Corporation, US 20115 1932 1956 410 CHARTER-NET-HKY-NC - Charter Communicat 30036 1726 345 354 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 209 1709 5083 651 CENTURYLINK-US-LEGACY-QWEST - Qwest Com 6983 1689 849 228 ITCDELTA - Earthlink, Inc., US 16509 1348 2478 432 AMAZON-02 - Amazon.com, Inc., US 7018 1340 20070 995 ATT-INTERNET4 - AT&T Services, Inc., US 11492 1309 233 567 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 39891 3329 169 15 ALJAWWALSTC-AS , SA 20940 2719 1048 1933 AKAMAI-ASN1 , US 34984 1974 327 358 TELLCOM-AS , TR 12479 1294 1018 46 UNI2-AS , ES 8551 1212 377 46 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 6849 1148 355 21 UKRTELNET , UA 13188 1094 98 62 BANKINFORM-AS , UA 8402 1025 544 15 CORBINA-AS Russia, RU 31148 1017 47 44 FREENET-AS , UA 9198 967 352 25 KAZTELECOM-AS , KZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 10620 3475 542 129 Telmex Colombia S.A., CO 8151 2265 3369 547 Uninet S.A. de C.V., MX 7303 1530 945 244 Telecom Argentina S.A., AR 11830 1493 369 66 Instituto Costarricense de Electricidad 6503 1413 437 54 Axtel, S.A.B. de C.V., MX 6147 1095 377 27 Telefonica del Peru S.A.A., PE 3816 996 479 182 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 7738 994 1882 40 Telemar Norte Leste S.A., BR 11172 907 125 76 Alestra, S. de R.L. de C.V., MX 28573 899 2181 159 CLARO S.A., BR Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1166 402 48 LINKdotNET-AS, EG 36903 656 330 109 MT-MPLS, MA 37611 649 48 2 Afrihost, ZA 36992 538 1357 26 ETISALAT-MISR, EG 8452 501 1472 15 TE-AS TE-AS, EG 37492 373 234 68 ORANGE-TN, TN 24835 333 594 15 RAYA-AS, EG 29571 300 37 12 CITelecom-AS, CI 15399 289 35 6 WANANCHI-KE, KE 2018 268 327 74 TENET-1, ZA Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 4538 5553 4191 75 ERX-CERNET-BKB China Education and Rese 22773 3497 2965 144 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3475 542 129 Telmex Colombia S.A., CO 7545 3428 384 253 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3329 169 15 ALJAWWALSTC-AS , SA 4766 3186 11145 1126 KIXS-AS-KR Korea Telecom, KR 17974 2933 904 78 TELKOMNET-AS2-AP PT Telekomunikasi Indo 20940 2719 1048 1933 AKAMAI-ASN1 , US 9829 2613 1488 513 BSNL-NIB National Internet Backbone, IN 1659 2493 1466 38 ERX-TANET-ASN1 Taiwan Academic Network Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 22773 3497 3353 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 10620 3475 3346 Telmex Colombia S.A., CO 39891 3329 3314 ALJAWWALSTC-AS , SA 7545 3428 3175 TPG-INTERNET-AP TPG Telecom Limited, AU 17974 2933 2855 TELKOMNET-AS2-AP PT Telekomunikasi Indo 1659 2493 2455 ERX-TANET-ASN1 Taiwan Academic Network 9808 2233 2193 CMNET-GD Guangdong Mobile Communication 6389 2225 2184 BELLSOUTH-NET-BLK - BellSouth.net Inc., 9829 2613 2100 BSNL-NIB National Internet Backbone, IN 18566 2195 2085 MEGAPATH5-US - MegaPath Corporation, US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 65001 PRIVATE 5.143.176.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/20 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.192.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.200.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.208.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65001 PRIVATE 31.172.216.0/21 15468 KLGELECS-AS 38, Teatralnaya st 65000 PRIVATE 31.219.177.0/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65000 PRIVATE 31.219.177.128/25 8966 ETISALAT-AS P.O. Box 1150, Dub 65412 PRIVATE 41.89.7.0/24 36866 JTL, KE 65512 PRIVATE 45.252.244.0/24 45899 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-badAS Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 23.249.144.0/20 40430 COLO4JAX-AS - colo4jax, LLC, US 27.100.7.0/24 56096 UNKNOWN 41.73.1.0/24 37004 -Reserved AS-, ZZ 41.73.2.0/24 37004 -Reserved AS-, ZZ 41.73.3.0/24 37004 -Reserved AS-, ZZ 41.73.4.0/24 37004 -Reserved AS-, ZZ 41.73.5.0/24 37004 -Reserved AS-, ZZ 41.73.6.0/24 37004 -Reserved AS-, ZZ 41.73.7.0/24 37004 -Reserved AS-, ZZ 41.73.8.0/24 37004 -Reserved AS-, ZZ Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:16 /9:13 /10:36 /11:101 /12:266 /13:518 /14:1051 /15:1765 /16:13157 /17:7823 /18:12745 /19:25321 /20:38313 /21:40218 /22:67197 /23:58829 /24:336901 /25:566 /26:586 /27:378 /28:54 /29:32 /30:16 /31:1 /32:34 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 39891 2896 3329 ALJAWWALSTC-AS , SA 22773 2726 3497 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 18566 2087 2195 MEGAPATH5-US - MegaPath Corporation, US 30036 1540 1726 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 6389 1440 2225 BELLSOUTH-NET-BLK - BellSouth.net Inc., 10620 1384 3475 Telmex Colombia S.A., CO 6983 1340 1689 ITCDELTA - Earthlink, Inc., US 34984 1257 1974 TELLCOM-AS , TR 11492 1207 1309 CABLEONE - CABLE ONE, INC., US 6849 968 1148 UKRTELNET , UA Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1578 2:748 4:21 5:2129 6:31 8:973 12:1774 13:41 14:1719 15:45 16:2 17:88 18:117 20:49 22:1 23:1619 24:1798 27:2300 31:1778 32:68 33:3 34:2 35:5 36:318 37:2281 38:1247 39:35 40:93 41:2814 42:447 43:1833 44:43 45:2127 46:2511 47:84 49:1165 50:889 51:12 52:531 54:342 55:8 56:7 57:42 58:1613 59:950 60:353 61:1807 62:1504 63:1920 64:4529 65:2169 66:4229 67:2200 68:1127 69:3265 70:1247 71:484 72:2014 74:2526 75:344 76:391 77:1431 78:1266 79:861 80:1250 81:1383 82:975 83:721 84:849 85:1585 86:497 87:1097 88:551 89:2089 90:210 91:6056 92:975 93:2365 94:2426 95:2511 96:503 97:354 98:947 99:41 100:76 101:1084 103:11793 104:2562 105:125 106:431 107:1399 108:663 109:2234 110:1284 111:1631 112:1038 113:1132 114:1092 115:1659 116:1628 117:1540 118:1998 119:1597 120:1220 121:1122 122:2195 123:2001 124:1586 125:1772 128:672 129:423 130:409 131:1331 132:620 133:175 134:446 135:138 136:379 137:399 138:1793 139:417 140:712 141:454 142:651 143:925 144:719 145:165 146:884 147:658 148:1384 149:538 150:659 151:867 152:637 153:302 154:656 155:952 156:517 157:490 158:380 159:1142 160:509 161:736 162:2358 163:921 164:898 165:1062 166:322 167:1155 168:1961 169:670 170:1807 171:263 172:625 173:1641 174:757 175:702 176:1721 177:4004 178:2213 179:1123 180:2150 181:1811 182:1981 183:987 184:828 185:7031 186:3067 187:2083 188:2193 189:1741 190:7804 191:1284 192:9056 193:5730 194:4426 195:3852 196:1711 197:1145 198:5545 199:5741 200:7081 201:3750 202:10116 203:10095 204:4511 205:2725 206:2985 207:3084 208:4059 209:3863 210:4261 211:2039 212:2694 213:2327 214:871 215:71 216:5829 217:1983 218:800 219:610 220:1635 221:867 222:683 223:1259 End of report

1 0

Yahoo Postmaster or Email Admin
by Mark Stevens 29 Jul '16

29 Jul '16

Good Morning, If there is a Yahoo postmaster or email Admin that could contact me offline concerning a deferred IP address it would be great. Thanks Mark

6 11

Re: EVERYTHING about Booters (and CloudFlare)
by Scott Weeks 29 Jul '16

29 Jul '16

--- tknchris(a)gmail.com wrote: They don't discriminate, anyone can be a customer https://www.youtube.com/watch?v=T4GfoSZ_sDc great quote from the reporter "why do you need a court order to do the right thing?" ------------------------------------------ Holy crap that girl was painful to listen to! scott

2 1

Re: EVERYTHING about Booters (and CloudFlare)
by Alexander Maassen 28 Jul '16

28 Jul '16

Sigh, another long thread that goes nowhere in the end and simply dies a dull dead. So let's add my 2ct donation into it. First of all, CF like any other carrier/provider/hoster/whatever only cares about the bucks, nothing else, you all do to, so that should be clear enough. Them actually booting customers just because some other instance (except through govermential powers) wants them to is not done, as it would decrease the income. Period. Same goes for ISP's blocking access to resources. They will simply switch to another provider and or try to find workarounds for it (see pirate bay and the alikes). Thats like mopping the floor while the fire sprinklers are still on. Second, CF indeed offers DDoS mitigation, but only on their heavy paid plans, if you also want the netflow logs of the attacks etc, it will cost you extra. If you are on a free plan, and your assigned gw gets ddossed, and they figure out you are the target, they drop the 'protection' by simply changing dns to it's real values and letting the attacker know: don't dos us if you want to hit that site, use the real endpoint IP instead and you will hit them directly. (Been there with DroneBL, and as soon as I figured out they do that, dropped them immediately). In the end, you are better off at hosters like OVH/Foonet and such as they learned from the IRC age where it was common to nuke clients/bnc's in order to hijack nicknames/channels when the network didn't have channel/nick services. Third, for those who do not know it yet, CF only acts as an intermediate RELAY that provides a method of attempting to identify bad asses, nothing more. And the badasses they also relay for? Testpigs and informational source! (Keep your friends close, your enemies closer?). Hell, aren't some of the best security advisors former hackers? At least the ones I know used to be. And I rather have some decent hacker in my team, keeping me updated with the stuff thats going on in the scene, then some million dollar company trying to sell you crap that is always behind the facts. Oh, and I am talking about real hackers, not those scriptkiddies using ready made tools thinking they are god. Fourth, and I see it in this mail as well and a lot of others: The Jurisdictional issues. Why aren't there any international Cyber Crime laws yet? We all do need to enforce crap like DMCA (which the music/entertainment industry is responsible for), EU Cookie Law (which should have been handled through the browsers and not force it upon the websites) and it's inbread stupid derivates, but everyone, despite acting out international by it's presence on a global spanning network, is still hiding behind his/her's organizations local law. Kinda stupid, don't you agree ? Kind regards, Alexander Maassen Maintainer DroneBL On Thu, July 28, 2016 4:41 pm, Paul WALL wrote: > I'm sorry, but this entire discussion is predicated on half-truths and nonsense spewing out of the CF team. It's a shame too, as they're usually great community minded folks who are well respected around here. > > No matter how you define the CloudFlare service, that they can claim ignorance due to "common carrier" passthrough is preposterous, > especially given their purported knowledge of what's going on. > Likewise if the booter sites were connected to any other CDN, > WAF/proxy, public cloud provider, etc. Call it what you want, but at the end of the day, they're providing connectivity and keeping the storefront online. Want the problem stopped? Easy, stop it at the source by denying them service. Every service provider (or its > upstream at some point) has an AUP which prevents the service from being used for illegal purposes. Telling NANOG members that they don't understand the nature of the CF service, and that they should somehow get a pass, is dishonest. > > That they're keeping these criminals online at the requirement of the FBI? Anyone who's actually worked with law enforcement can tell you that the first rule of fight club is to NOT talk about it, especially if you're under gag order. A more likely story is they're just doing this for the attention, and basking in it, kind of like a certain blog post suggesting they pioneered the practice of configuring hosts with LACP for throughput and HA. > > If Justin/Matthew/Martin/etc. are listening, I implore you to do the right thing and stop providing service to criminals. Full stop, without caving in to your very talented marketing department. And to everyone else, I'd ask you to do what you think is right, and treat CloudFlare's anycasted IP blocks as you would any other network > harboring criminal activity and security risk to the detriment of your customers. (Is Team CYMRU listening?) Much like the original spam problem in the 90s, the collateral damage might be annoying at first, but the end will justify the means. > > Drive Slow (like a souped up Supra), > Paul Wall > > On Wed, Jul 27, 2016 at 10:48 PM, Randy Bush <randy(a)psg.com> wrote: >>> They just lost all respect from here. Would someone from USA please report these guys to the feds? What they are doing is outright criminal. >> >> hyperbole. it is not criminal. you just don't happen to like it. >

2 1

Yellow Pages - YP.ca sys/net admins
by Eric Dugas 27 Jul '16

27 Jul '16

Hello, Just trying to reach a clueful system or network admins from Yellow Pages. You can contact me off-list. Eric

1 0

Re: cloudflare hosting a ddos service?
by Steve Atkins 27 Jul '16

27 Jul '16

> On Jul 26, 2016, at 7:58 PM, Justin Paine <justin(a)cloudflare.com> wrote: > > Folks, > > "For a long time their abuse@ alias was (literally) routed to /dev/null. I'm not > sure whether that's still the case or whether they now ignore reports manually." > > @Steve It (literally) never was. :) Yes, it was. The smiley doesn't make your statement true. > The team I manage processes > reports all day > long. If you have a report to file certainly do so, > https://www.cloudflare.com/abuse I gave up on doing that in late 2014 after reporting thousands of pieces of spam advertising websites hosted by Cloudflare, with no action taken, no reply received, no ticket created, *nothing*. Not in response to mail sent to abuse@cloudflare, not in response to backchannel reports, not in response to mentions in person to staff at conferences. (This was mostly people selling lists of credit card numbers rather than booters, but it's the same sort of issue). Just to see what had changed, I went back to look at the sites I reported to Cloudflare in 2014. The couple I spot-checked are still hosted by Cloudflare. Given that you (Cloudflare, rather than you personally) haven't changed your policy of never terminating abusive websites you host then continuing to report them to you seems fairly pointless. > > > On the topic of booters: > > Short version -- As someone already mentioned, CloudFlare continues > not to be a hosting provider. That's untrue, of course. You terminate the http connection; you're hosting the website; you're hiding the identity of any other operators involved; you continue to serve the website even when the backing server has been terminated. Adding an interstitial for sites hosting malware is nice and all, but the problematic customers are the ones that are selling access to those malware compromised machines. You are taking sole responsibility by your actions, while denying all responsibility in your public statements. > > Our CEO has broadly covered this topic several times. > https://blog.cloudflare.com/thoughts-on-abuse/ > > Even if we removed our service the website does not go away,it > doesn't solve the problem if we temporarily stop providing DNS to the > domain(s). An often overlooked but extremely important note: there are > some situations where law > enforcement has required that we *not* terminate service to certain > websites. In those situations we are of course not allowed to discuss > specifics. Cheers, Steve

1 0

Re: cloudflare hosting a ddos service?
by Paras Jha 27 Jul '16

27 Jul '16

Justin, The only problem with that statement is that it's not true: if you did terminate service to them, the websites would go away. Maybe not today, but eventually. "Network stresser" owners are notorious for trying to take out the competition. Cloudflare provides free protection for these services to stay online. Most other ISPs wouldn't tolerate such shenanigans, whether it be for facilitating illegal activities or being on the receiving end of DDoS attacks, and would kick them off. On Tue, Jul 26, 2016 at 10:58 PM, Justin Paine <justin(a)cloudflare.com> wrote: > Folks, > > "For a long time their abuse@ alias was (literally) routed to /dev/null. > I'm not > sure whether that's still the case or whether they now ignore reports > manually." > > @Steve It (literally) never was. :) The team I manage processes > reports all day > long. If you have a report to file certainly do so, > https://www.cloudflare.com/abuse > > > On the topic of booters: > > Short version -- As someone already mentioned, CloudFlare continues > not to be a hosting provider. > > Our CEO has broadly covered this topic several times. > https://blog.cloudflare.com/thoughts-on-abuse/ > > Even if we removed our service the website does not go away, it > doesn't solve the problem if we temporarily stop providing DNS to the > domain(s). An often overlooked but extremely important note: there are > some situations where law > enforcement has required that we *not* terminate service to certain > websites. In those situations we are of course not allowed to discuss > specifics. > > ____________ > Justin Paine > Head of Trust & Safety > CloudFlare Inc. > PGP: BBAA 6BCE 3305 7FD6 6452 7115 57B6 0114 DE0B 314D > > > On Tue, Jul 26, 2016 at 7:42 PM, Paras Jha <paras(a)protrafsolutions.com> > wrote: > > A five minute Google search revealed this, which is just the tip of the > > iceberg > > > > booter.xyz > > exitus.to > > zstress.net > > critical-boot.com > > instress.club > > webstresser.co > > anonymousstresser.com > > rawdos.com > > kronosbooter.com > > alphastress.com > > synergy.so > > str3ssed.me > > layer7.pw > > > > There are probably hundreds > > > > > > > > On Tue, Jul 26, 2016 at 10:33 PM, Paras Jha <paras(a)protrafsolutions.com> > > wrote: > > > >> This is quite common, almost all of the DDoS-for-hire services are > hosted > >> behind CloudFlare, and a great majority of them take PayPal. Another one > >> had even managed to secure an EV SSL cert. > >> > >> On Tue, Jul 26, 2016 at 10:24 PM, Dovid Bender <dovid(a)telecurve.com> > >> wrote: > >> > >>> I used to have a boss that was convinced that MCafee was writing > viruses > >>> to stay in business.... > >>> > >>> Regards, > >>> > >>> Dovid > >>> > >>> -----Original Message----- > >>> From: Phil Rosenthal <pr(a)isprime.com> > >>> Sender: "NANOG" <nanog-bounces(a)nanog.org>Date: Tue, 26 Jul 2016 > 22:17:53 > >>> To: jim deleskie<deleskie(a)gmail.com> > >>> Cc: NANOG list<nanog(a)nanog.org> > >>> Subject: Re: cloudflare hosting a ddos service? > >>> > >>> Plus, it’s good for business! > >>> > >>> -Phil > >>> > >>> > On Jul 26, 2016, at 10:14 PM, jim deleskie <deleskie(a)gmail.com> > wrote: > >>> > > >>> > sigh... > >>> > > >>> > On Tue, Jul 26, 2016 at 10:55 PM, Patrick W. Gilmore < > patrick(a)ianai.net > >>> > > >>> > wrote: > >>> > > >>> >> CloudFlare will claim they are not hosting the problem. They are > just > >>> >> hosting the web page that lets you pay for or points at or otherwise > >>> >> directs you to the problem. > >>> >> > >>> >> The actual source of packets is some other IP address. Therefore, > they > >>> can > >>> >> keep hosting the web page. It is not sending the actual > >>> >> [spam|DDoS|hack|etc.], right? So stop asking them to do something > >>> about it! > >>> >> > >>> >> Whether you think that is the proper way to provide service on the > >>> >> Internet is left as an exercise to the reader. > >>> >> > >>> >> -- > >>> >> TTFN, > >>> >> patrick > >>> >> > >>> >>> On Jul 26, 2016, at 9:49 PM, Mike <mike-nanog(a)tiedyenetworks.com> > >>> wrote: > >>> >>> > >>> >>> Hi, > >>> >>> > >>> >>> So vbooter.org's dns and web is hosted by cloudflare? > >>> >>> > >>> >>> "Using vBooter you can take down home internet connections, > websites > >>> and > >>> >> game servers such us Minecraft, XBOX Live, PSN and many more." > >>> >>> > >>> >>> dig -t ns vbooter.org > >>> >>> > >>> >>> ; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> -t ns vbooter.org > >>> >>> ;; global options: +cmd > >>> >>> ;; Got answer: > >>> >>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62177 > >>> >>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: > 1 > >>> >>> > >>> >>> ;; OPT PSEUDOSECTION: > >>> >>> ; EDNS: version: 0, flags:; udp: 512 > >>> >>> ;; QUESTION SECTION: > >>> >>> ;vbooter.org. IN NS > >>> >>> > >>> >>> ;; ANSWER SECTION: > >>> >>> vbooter.org. 21599 IN NS rick.ns.cloudflare.com. > >>> >>> vbooter.org. 21599 IN NS amy.ns.cloudflare.com. > >>> >>> > >>> >>> dig -t a www.vbooter.org > >>> >>> > >>> >>> ; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> -t a www.vbooter.org > >>> >>> ;; global options: +cmd > >>> >>> ;; Got answer: > >>> >>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34920 > >>> >>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: > 1 > >>> >>> > >>> >>> ;; OPT PSEUDOSECTION: > >>> >>> ; EDNS: version: 0, flags:; udp: 512 > >>> >>> ;; QUESTION SECTION: > >>> >>> ;www.vbooter.org. IN A > >>> >>> > >>> >>> ;; ANSWER SECTION: > >>> >>> www.vbooter.org. 299 IN CNAME vbooter.org. > >>> >>> vbooter.org. 299 IN A 104.28.13.7 > >>> >>> vbooter.org. 299 IN A 104.28.12.7 > >>> >>> > >>> >>> > >>> >>> Can anyone from cloudflare answer me why this fits with your > >>> business > >>> >> model? > >>> >>> > >>> >>> Mike- > >>> >> > >>> >> > >>> > >>> > >> > >> > >> -- > >> Regards, > >> Paras > >> > >> President > >> ProTraf Solutions, LLC > >> Enterprise DDoS Mitigation > >> > > > > > > > > -- > > Regards, > > Paras > > > > President > > ProTraf Solutions, LLC > > Enterprise DDoS Mitigation > -- Regards, Paras President ProTraf Solutions, LLC Enterprise DDoS Mitigation

1 1

cloudflare hosting a ddos service?
by Mike 27 Jul '16

27 Jul '16

Hi, So vbooter.org's dns and web is hosted by cloudflare? "Using vBooter you can take down home internet connections, websites and game servers such us Minecraft, XBOX Live, PSN and many more." dig -t ns vbooter.org ; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> -t ns vbooter.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62177 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;vbooter.org. IN NS ;; ANSWER SECTION: vbooter.org. 21599 IN NS rick.ns.cloudflare.com. vbooter.org. 21599 IN NS amy.ns.cloudflare.com. dig -t a www.vbooter.org ; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> -t a www.vbooter.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34920 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.vbooter.org. IN A ;; ANSWER SECTION: www.vbooter.org. 299 IN CNAME vbooter.org. vbooter.org. 299 IN A 104.28.13.7 vbooter.org. 299 IN A 104.28.12.7 Can anyone from cloudflare answer me why this fits with your business model? Mike-

11 13