April 2011 - Test - lists.nanog.org

New hijacks, and lots of them
by Ronald F. Guilmette 15 Apr '11

15 Apr '11

One particular large and well-distributed snowshoe spamming operation became the subject of my special scrutiny recently. After seeing all of the the various apparently hijacked IP blocks that this particular snowshoe spamming operation seemed to be relying upon for much of its IP space, it seemed like the right thing to do for me to report on the whole mess here. To begin with here are a couple of files which show the full extent of this particular rather vast snowshoe operation (including both hijacked and non-hijacked parts). By my count we are talking in excess of 6,300 separate second-level gTLD domain names. http://www.47-usc-230c2.org/20110414-snowshoe-1.txt http://www.47-usc-230c2.org/20110414-snowshoe-2.txt Dredging into this operation more deeply led me to the following con- clusions... Based upon information and belief, the following number resources have been hijacked, i.e. they either are now, or were in the recent past being used without proper authorization by a party or parties to whom these resources were not assigned by any RiR. (Unless otherwise specified below, these are all ARIN-assigned number resources.) AS8143 (1) AS29987 (2) AS11756 (3) (4) AS47024 (5) AS27906 (6)(7) 198.23.32.0/20 - NET-198-23-32-0-1 (8) 198.57.64.0/20 - NET-198-57-64-0-1 (9) 199.88.32.0/20 - NET-199-88-32-0-1 (10) 199.192.16.0/20 - NET-199-192-16-0-1 (11) 199.196.192.0/19 - NET-199-196-192-0-1 (12) 200.107.216.0/21 - GT-AGSA1-LACNIC (13) 204.147.240.0/20 - NET-204-147-240-0-1 (14) 207.22.224.0/19 - (NET-207-22-192-0-1) (15) (16) Notes ----- (1) Probable fradulent falsification of JD47-ORG-ARIN - 2010-11-22 (2) Probable fradulent falsification of AS29987 & IPADM448-ARIN - 2010-11-04 (3) Probable fradulent falsification of AS11756 - 2011-03-15 (4) Probable fradulent falsification of JR1271-ARIN - 2010-07-08 (5) ARIN unable to validate contact NOC3622-ARIN since 2010-06-19 (6) LACNIC assigned AS (7) Contact record ERJ3 modified - 2011-04-06 (falsified?) (8) Probable fradulent falsification of NET-199-88-32-0-1 & SH174-ARIN - 2010-11-03 (9) ARIN unable to valiadate contact GW449-ARIN since 2010-07-18 (10) ARIN unable to valiadate contact DM126-ARIN since 2010-07-16 (11) ARIN unable to valiadate contact RP56-ARIN since 2010-07-22 (12) ARIN unable to valiadate contact FB43-ARIN since 2010-07-17 (13) LACNIC assigned IPv4 block (14) ARIN unable to valiadate contact LT127-ORG-ARIN since 2010-07-20 (15) Only the 207.22.224.0/19 portion of 207.22.192.0/18 is being routed (16) ARIN unable to valiadate contact MH521-ARIN since 2010-07-12 Discussion ---------- The entire scope of this particular spamming operation spans both the aforementioned (hijacked) IP ranges and also a number of IP ranges that are clearly NOT hijacked. I have attempted to list below all ranges that either are now in use by this operation, or that have been in use by this operation, in the relatively recent past. The various IP blocks listed below are connected, in one way or another, to several entities that have been caught doing IP block hijacking in the past, in particular: *) Joytel Wireless of Florida... which apparently has some significant connection to an entity called "GoRack", also of South Florida, and *) Xeex aka AS27524 aka Nishant Ramachandran, and *) last but by no means least, Media Breakaway, LLC aka JKS Media, LLC, aka Dynamic Dolphin (ICANN Accredited Registrar) aka "OptInRealBig" aka the notorious Scott Richter. (Essentially all of the domains of this operation are, apparently, registered anonymously with Dynamic Dophin, and as noted below, A portion of them are also being routed by JKS Media, and a subset of those are either hosted in and/or are getting DNS service from IP blocks registered to Media Breakaway.) As you will see below, a few of the ranges that I have identified as having been hijacked were already/previously blacklisted by Spamhaus some months ago. Also, in at least one case, Spamhaus records indicate that they too believe that the block in question was indeed hijacked. (It is always nice to have a second, confirming opinion.) I could speculate on the identity of the person or company which might most accurately be said to be "behind" all this, but I actually do not feel the need to do so in this instance. The data speaks for itself, and I do believe that any diligent researcher who really wants to dredge into it all will likely reach what I consider to be the proper conclusion(s). =========================================================================== All IP ranges containing assets of this specific snowshoe operation: -------------------------------------------------------------------- 8.24.248.0/21 - via AS19844 (gorack.net) 66.115.166.0/24 - NET-66-115-166-0-1 - via AS22384 (nationalnet.com) 66.115.167.0/24 - NET-66-115-167-0-1 - via AS22384 (nationalnet.com) 66.115.168.0/24 - NET-66-115-168-0-1 - via AS22384 (nationalnet.com) 66.115.172.0/24 - NET-66-115-172-0-1 - via AS22384 (nationalnet.com) 66.232.42.0/23 - via AS21510 (tristarcorp.net) 66.232.44.0/24 - via AS21510 (tristarcorp.net) 66.232.46.0/23 - via AS21510 (tristarcorp.net) 66.232.48.0/23 - via AS21510 (tristarcorp.net) 67.55.111.0/24 - "Masterly International S.A."[1] - via AS27257 (webair.com) 67.220.69.0/24 - via AS17048 (awknet.com) 69.6.29.0/24 - NET-69-6-29-0-1 - Media Breakaway - via AS32311 (jksmedia.net) 69.6.31.0/24 - NET-69-6-31-0-1 RRM LLC - via AS32311 (jksmedia.net) 69.6.36.0/24 - NET-69-6-36-0-1 - Media Breakaway - via AS32311 (jksmedia.net) 69.6.42.0/24 - via AS32311 (jksmedia.net) 69.6.43.0/24 - via AS32311 (jksmedia.net) 69.6.49.0/24 - NET-69-6-49-0-1 - Media Breakaway - via AS32311 (jksmedia.net) 69.6.56.0/24 - via AS32311 (jksmedia.net) 69.42.77.64/28 - "Masterly International S.A."[1] - via AS27257 (webair.com) 74.202.216.0/21 - Joytel Wireless - via AS4323 (twtelecom.net) 91.90.192.0/19 - via AS41331 (moda-ua.net/Ukraine) 93.171.64.0/21 - via AS27257 (webair.com) 173.239.8.0/24 - "Masterly International S.A."[1] - via AS27257 (webair.com) 173.239.9.0/24 - "Masterly International S.A."[1] - via AS27257 (webair.com) 198.23.32.0/20 - NET-198-23-32-0-1 - Was Hijacked - via AS11756 [5] (BitStorm) http://www.spamhaus.org/sbl/sbl.lasso?query=SBL101186 05-Jan-2011 22:17 GMT | SR22 198.57.64.0/20 - NET-198-57-64-0-1 - Was Hijacked (AS?) http://www.spamhaus.org/sbl/sbl.lasso?query=SBL101250 07-Jan-2011 21:28 GMT | SR03 199.88.32.0/20 - NET-199-88-32-0-1 - Hijacked - via AS29987 [3] 199.192.16.0/20 - NET-199-192-16-0-1 - Was hijacked (AS?) http://www.spamhaus.org/sbl/sbl.lasso?query=SBL101188 05-Jan-2011 22:08 GMT | SR22 199.196.192.0/19 - NET-199-196-192-0-1 - Hijacked - via AS8143 [2] 200.107.216.0/21 - GT-AGSA1-LACNIC - Hijacked - via AS27906 [7] 204.147.240.0/20 - NET-204-147-240-0-1 - Hijacked - via AS47024 [6] 206.246.104.0/22 - via AS11194 (nni.com) 207.22.224.0/19 - (NET-207-22-192-0-1) Hijacked - via AS8143 [2] [4] 207.178.179.0/24 - NET-207-178-179-0-1 - Prime Directive - via AS5033 207.178.191.0/24 - NET-207-178-191-0-1 - Prime Directive - via AS5033 207.178.192.0/24 - NET-207-178-192-0-1 - Prime Directive - via AS5033 207.199.128.0/18 - via AS11194 (nni.com) 207.231.96.0/21 - NET-207-231-96-0-1 - via AS11194 (nni.com) 209.141.0.0/20 - NET-209-141-0-0-1 - via AS12124 (thorn.net) 209.147.86.0/23 - via AS11194 (nni.com) 209.147.88.0/21 - via AS11194 (nni.com) 209.200.23.128/28 - "Masterly International S.A."[1] - via AS27257 (webair.com) Notes: ====== [1] "Masterly International S.A." -- Identified as snowshoer 2005-06-01 by rfg [2] AS8143 hijacked; JD47-ORG-ARIN revised 2010-11-22 4publicom.com - newly registered 2010-11-22 AS8143 is connected to the net only via AS19844 (gorack.com) [3] AS29987 hijacked; IPADM448-ARIN revised 2010-11-04; braziliancomputing.com - newly registered 2010-10-07 AS29987 is connected to the net only via AS3257 (tiscali.net) [4] Not currently inhabited [5] AS11756 hijacked; JR1271-ARIN revised 2010-07-08 jandamy.com - newly registered 2010-11-03 Company declared dead as of 09/22/2000: http://www.sunbiz.org/scripts/cordet.exe?action=DETFIL&inq_doc_number=P9600… AS11756 currently has -zero- peers (according to www.robtex.com) [6] AS47024 hijacked; NOC3622-ARIN - ARIN unable to validate since 2010-06-19 No company web site; 909-941-8100 - reassigned; 909-743-6182 - disconnected; intiumservices.com newly (re-)registered - 2010-11-04 AS47024 currenly connected only via AS3257 (tiscali.net) [7] AS27906 currently only routed via AS27524 (Xeex) according to robtex.com =========================================================================== As you can see, there is a large volume of material here, and a large amount of research went into it all. I have tried diligently to ensure the complete accuracy of all of the above information, however it is certainly possible that I may have made a mistake or two, here or there, or that circumstances and facts may have changed since I first began compiling this information two days ago. Certainly, no one should rely in any way upon the above information in the absence of your own independent due diligence. I hereby disavow any and all responsibility for any errors or omissions. The above information may only be used at the reader's own risk. This information is being published in accordance with 47 USC 230(c)(2)(B), to enable or make available to information content providers or others the technical means to restrict access to material described in 47 USC 230(c)(1). Via con dios, rfg P.S. ARIN's attempts, during July of last year, to validate various con- tacts that were the responsible parties for various IP allocations was a good and noble effort on ARIN's part. In the present context however it does seem a pity that more was not done with the various negative results from that valiant effort.

1 1

How is IPv6 deployment going in the APNIC region?
by Graham Beneke 15 Apr '11

15 Apr '11

Only 0.3 of a /8 left[1] before the rationing policy kicks in. I hope everyone is ready :-) [1] http://www.apnic.net/community/ipv4-exhaustion/graphical-information -- Graham Beneke

8 13

Contact for va.gov
by Nathan Eisenberg 15 Apr '11

15 Apr '11

Yes, two in one day. Wholesalers don't wipe device configs, apparently. Anyways, would a technical contact for va.gov please contact me off-list? Best Regards, Nathan Eisenberg

6 6

Contact for City of Panama City Beach, FL?
by Nathan Eisenberg 15 Apr '11

15 Apr '11

Could someone from the IT department for the City of Panama City Beach, Florida please contact me off-list? Best Regards, Nathan Eisenberg

4 4

switch networking help
by Deric Kwok 14 Apr '11

14 Apr '11

Hello I would like to ask general question about switch speed experience. How can I increase speed in switch port? ls it to combine more than one port? Any other solution? In combing ports, what are the advantages and disadvantages? Any info and experience. Thank you for your sharing.

2 1

Looking for Postmaster contact for js.pentagon.mil
by Mark Keymer 14 Apr '11

14 Apr '11

We have a client that we resent moved to some new address space (We have had the the space for a couple of years now) However it looks like the mail server for js.pentagon.mil are droping all packet to them. :( If anyone had some leads on a way to contact them. Please contact me off-list. We did try the number in the whois for the IP. The phone rang and rang. :( Thank you all. Sincerely, Mark Keymer

1 0

Syngenta space
by Eugen Leitl 13 Apr '11

13 Apr '11

Hi, sorry for the noise, but my contact at Syngenta says they have 147.0.0.0/8 168.0.0.0/8 and 172.0.0.0/8, which is obviously bogus. They do have a 168.246.0.0/16 however. Any tool to look the other two up quickly, without having to iterate through the entire second octet? Thanks! -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

15 17

historical pricing data
by Chris McDonald 13 Apr '11

13 Apr '11

This may be the wrong place to ask but maybe one of you could point me in a direction. I'm looking for [ideally] historical market pricing for mpls/ipl between as many as possible city pairs [with a focus toward Asia] as well as ip maybe 5 year back. Thanks, Chris

1 0

SDH 1+1 protected circuit and OSPF minimal setup on a single Juniper platform.
by Lorenzo Rossi 13 Apr '11

13 Apr '11

Hi, I have some doubts about the minimal configuration to handle an SDH 1+1 protected circuit with OSPF on a single Juniper router platform (one interface as the Working Circuit and another interface as the Protect Circuit). Reading the JunOS documentation, for instance the 9.4 JunOS version: http://www.juniper.net/techpubs/software/junos/junos94/swconfig-network-int… and using the various configuration snippet I tried to link together various pieces of configuration and the result is below: so-0/2/0 { framing { sdh; } sonet-options { aps { working-circuit bayward; authentication-key blarney; } } unit 0 { family inet { address 10.100.100.1/24; } } } so-1/3/0 { framing { sdh; } sonet-options { aps { protect-circuit bayward; authentication-key blarney; } } unit 0 { family inet { address 10.100.200.1/24; } } } lab@r1# show protocols ospf area 0.0.0.0 { interface so-0/2/0.0; interface so-1/3/0.0; } } If I'm not wrong the APS/MSP signaling protocol router implementation should set one of the two sonet interfaces as Up and the other as Down, so the OSPF should install in routing table only the IP network related to the Up interface. Am I wrong? Do you think I forgot some configuration pieces? Thanks and regards, Lorenzo

1 0

Level 3 Agrees to Purchase Global Crossing
by William Allen Simpson 13 Apr '11

13 Apr '11

http://www.bloomberg.com/news/print/2011-04-11/level-3-agrees-to-acquire-gl… The deal will combine two unprofitable companies with total revenue of $6.26 billion as of last year, and cut annualized capital spending by about $40 million, according to the statement. It will also help reduce the pressure on prices, which have declined by as much as 30 percent a year in the industry, said Donna Jaegers, an analyst at DA Davidson & Co. “This is what telecom has needed for a long time,” said Denver-based Jaegers, who recommends buying both stocks. “You have way too many players.”

15 16