- Test - lists.nanog.org

Anybody at Amazon AWS?
by Anne P. Mitchell, Esq. 04 Dec '14

04 Dec '14

Anybody have a contact at Amazon AWS? I sent in a spam complaint, and got back the below response - while I give them kudos for actually, you know, responding, I'm pretty sure that we can all agree that "sending the same canned message to email addresses scraped off websites" is the very definition of spam, yet somehow the EC2 abuse team seems to consider it a perfectly acceptable explanation - I'd sure love to discuss this with someone with a clue at Amazon AWS --- Our customer has responded to your abuse report and provided the following information "The below emails were sent individually to the recipient using a canned message. There is no automation or mass emailing at all. Our publisher representative personally visited each of the below websites, decided they were right for our service and emailed them individually. The emails are sent through gmail using a web interface to their API. Let me know if you require any additional information. Dwayne" If you are satisfied with the above information, there is no need to respond to this notice. If you are not satisfied, please respond with a clear, succinct reason for dissatisfaction and what results you desire from our customer. We will make every reasonable attempt to work with you and our customer to resolve this matter. Thank you, The EC2 Abuse team --- Anne Anne P. Mitchell, Esq. CEO/President ISIPP SuretyMail Email Accreditation & Certification Your mail system + SuretyMail accreditation = delivered to their inbox! http://www.SuretyMail.com/ http://www.SuretyMail.eu/ Author: Section 6 of the Federal CAN-SPAM Act of 2003 Member, California Bar Cyberspace Law Committee Ret. Professor of Law, Lincoln Law School of San Jose https://www.linkedin.com/in/annemitchell 303-731-2121 | amitchell(a)isipp.com | @AnnePMitchell | Facebook/AnnePMitchell

3 2

Re: How to track DNS resolution sources
by Notify Me 04 Dec '14

04 Dec '14

Hi Nick and List Yes it's possible. The dud DNS response in some parts of the internet was the public IP address being used by their proxy server. I'm not sure what the proxy is, but it's a windows box. I was going to try to dig trace but by then the poisoning suddenly stopped happening. Any other ideas on how to deal with this ? What can I proactively do in case it happens again? On Thursday, 4 December 2014, Nicholas Oas <nicholas.oas(a)gmail.com> wrote: > Is it possible that your client site has a helpful firewall that is > performing DNS doctoring? > > http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/dns-alg-nat-… > > The first time I encountered this neither myself nor my customer expected > it. We upgraded the firewall and suddenly their external hostname > resolution was coming back with internal IP addresses, as defined by the > firewall's NAT table. > > Note this only really happens with NAT. If the spoofed records are > internal its most likely something else. > > On Wed, Dec 3, 2014 at 11:22 AM, Notify Me <notify.sina(a)gmail.com > <javascript:_e(%7B%7D,'cvml','notify.sina(a)gmail.com');>> wrote: > >> Hi! >> >> I hope I'm wording this correctly. I had a incident at a client site where >> a DNS record was being spoofed. How does one track down the IP address >> that's returning the false records ? What tool can one use? >> >> Thanks! >> >> >> >> >> -- >> Sent from MetroMail >> > > -- Sent from MetroMail

1 0

Comcast residential DNS contact
by Grant Ridder 04 Dec '14

04 Dec '14

Can someone from Comcast that works with the customer resolvers ( cdns01.comcast.net / cdns02.comcast.net) please contact me off list? The 01 resolver is sometimes not returning complete results when the DNS query type is set to ANY for $dayjob's domain. -Grant

12 18

Comcast IPv6 issues..?
by Stephen Frost 03 Dec '14

03 Dec '14

Hey all, Getting delays and seeing some pretty funky routes inside Comcast. All traces start from Ashburn, VA (2001:4830:167b::) and go to Chicago, IL (2610:150:4b0f::). Coming from Occaid/SIXXS (over a tunnel) through HE.net and have seen: Ashburn -> San Jose -> New York -> Chicago ----- 3 sixxs-asbnva-gw.customer.occaid.net (2001:4830:e6:7::2) 9.955 ms 10.583 ms 10.17 ms 4 iad0-b0-ge2.hotnic.net (2001:4810:0:100::1) 9.726 ms 11.004 ms 9.956 ms 5 10gigabitethernet2-2.core1.ash1.he.net (2001:504:0:2::6939:1) 10.069 ms 10.674 ms 12.465 ms 6 2001:559::db5 (2001:559::db5) 94.83 ms 95.593 ms 94.768 ms 7 pos-2-2-0-0-cr01.sanjose.ca.ibone.comcast.net (2001:558:0:f58d::1) 96.779 ms 99.591 ms 94.964 ms 8 he-0-7-0-0-cr01.newyork.ny.ibone.comcast.net (2001:558:0:f5ba::2) 89.969 ms 91.143 ms 92.507 ms 9 he-0-11-0-0-cr01.350ecermak.il.ibone.comcast.net (2001:558:0:f5b8::2) 97.411 ms 88.731 ms 87.457 ms 10 he-0-10-0-0-pe04.350ecermak.il.ibone.comcast.net (2001:558:0:f8cc::2) 87.444 ms 88.756 ms 87.505 ms 11 2001:550:2:2::32:2 (2001:550:2:2::32:2) 89.812 ms 88.774 ms 87.558 ms ----- Ashburn -> New York (but with lots of latency..) -> Chicago ----- 3 sixxs-asbnva-gw.customer.occaid.net (2001:4830:e6:7::2) 9.549 ms 10.652 ms 10.107 ms 4 iad0-b0-ge2.hotnic.net (2001:4810:0:100::1) 9.975 ms 11.044 ms 10.009 ms 5 10gigabitethernet2-2.core1.ash1.he.net (2001:504:0:2::6939:1) 17.423 ms 11.05 ms 12.27 ms 6 2001:559::db5 (2001:559::db5) 95.197 ms 95.968 ms 94.793 ms 7 he-2-6-0-0-cr01.ashburn.va.ibone.comcast.net (2001:558:0:f8d2::1) 105.158 ms 101.428 ms 94.993 ms 8 he-0-7-0-0-cr01.newyork.ny.ibone.comcast.net (2001:558:0:f5ba::2) 89.735 ms 90.266 ms 92.577 ms 9 he-0-11-0-0-cr01.350ecermak.il.ibone.comcast.net (2001:558:0:f5b8::2) 89.813 ms 92.963 ms 92.383 ms 10 he-0-10-0-0-pe04.350ecermak.il.ibone.comcast.net (2001:558:0:f8cc::2) 87.401 ms 88.15 ms 87.085 ms 11 2001:550:2:2::32:2 (2001:550:2:2::32:2) 122.387 ms 124.288 ms 122.409 ms ----- Ashburn -> Chicago -> New York -> Chicago ----- 3 sixxs-asbnva-gw.customer.occaid.net (2001:4830:e6:7::2) 9.926 ms 10.183 ms 9.978 ms 4 iad0-b0-ge2.hotnic.net (2001:4810:0:100::1) 9.961 ms 11.37 ms 9.973 ms 5 10gigabitethernet2-2.core1.ash1.he.net (2001:504:0:2::6939:1) 9.95 ms 18.258 ms 9.951 ms 6 2001:559::db5 (2001:559::db5) 94.959 ms 96.413 ms 95.001 ms 7 he-1-10-0-0-cr01.chicago.il.ibone.comcast.net (2001:558:0:f552::1) 92.457 ms 92.964 ms 89.965 ms 8 he-0-7-0-0-cr01.newyork.ny.ibone.comcast.net (2001:558:0:f5ba::2) 89.789 ms 91.291 ms 97.333 ms 9 he-0-11-0-0-cr01.350ecermak.il.ibone.comcast.net (2001:558:0:f5b8::2) 87.518 ms 95.961 ms 87.506 ms 10 he-0-10-0-0-pe04.350ecermak.il.ibone.comcast.net (2001:558:0:f8cc::2) 87.406 ms 86.414 ms 87.425 ms 11 2001:550:2:2::32:2 (2001:550:2:2::32:2) 87.517 ms 86.589 ms 87.506 ms ----- Thoughts? Thanks, Stephen

2 3

Transparent hijacking of SMTP submission...
by joel jaeggli 03 Dec '14

03 Dec '14

I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27 Nov 2014 19:17:44 GMT ehlo bogus.com 250-nagasaki.bogus.com Hello XXXXXXXXXXXXXXX.wa.comcast.net [XXX.XXX.XXX.XXX], pleased to meet you 250 ENHANCEDSTATUSCODES J@mb-aye:~$telnet 2001:418:1::81 587 Trying 2001:418:1::81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27 Nov 2014 19:18:33 GMT ehlo bogus.com 250-nagasaki.bogus.com Hello [IPv6:2601:7:2380:XXXX:XXXX:XXXX:c1ae:7d73], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN 250-STARTTLS 250-DELIVERBY 250 HELP that's essentially a downgrade attack on my ability to use encryption which seems to be in pretty poor taste frankly.

14 27

IPligence contact?
by George, Wes 03 Dec '14

03 Dec '14

if anyone has a live-person contact at geolocation provider IPligence (http://www.ipligence.com/) and can hit me up off-list, I would appreciate it. Thanks, Wesley George Time Warner Cable Anything below this line has been added by my company’s mail server, I have no control over it. ----------- This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

1 0

Google contact: apps vs IPv6 issue
by Max Tulyev 03 Dec '14

03 Dec '14

Hello! Could someone advice a good contact inside Google? I'm operating a IPv6 tunnel broker http://tb.netassist.ua/ Now there are a number of complaints tunnel broker users can't access Google Apps with the reason "We're sorry, but this service is not available in your country". IPv4 access to same pages from Ukraine is OK, and MaxMind GeoIP replies our IPv6 network we are using in our service is "NetAssist, Ukraine".

2 1

How to track DNS resolution sources
by Notify Me 03 Dec '14

03 Dec '14

Hi! I hope I'm wording this correctly. I had a incident at a client site where a DNS record was being spoofed. How does one track down the IP address that's returning the false records ? What tool can one use? Thanks! -- Sent from MetroMail

4 4

Phasing out of copper
by Jean-Francois Mezei 03 Dec '14

03 Dec '14

Currently in the midst of a CRTC policy hearing in Canada on future of competition in ISPs. Incumbents claim they have no plans to retire their copper plant after deploying FTTP/FTTH. (strategically to convince regulator that keeping ISPs on copper is fine and no need to let them access FTTP). For my reply I am trying to get more authoritative info to show that incumbents do have plans to retire the copper plant once enough customers have migrated to FTTP ( I heard that 80% migration is the tip-ver where they convert the rest of customers to FTTP to be able to shutddown the copper). Anyone have pointers to documents or experiences that would help me convince the regulator that incumbents deploy FTTP with eventual goal to be able to shutdown their old copper instead of perpetually maintaining both systems ? Also being discussed is removing regulations for access to ULL (unbundled local loops). In areas being upgraded to FTTP, are there services that really need copper ULLs and do not have an FTTP equivalent ? (home alarm systems ?). When an incumbent states for the record that "retiring copper is not in their current plans", I know that it means that it isn't in their short term plans. But I need some evidence of what other telcos do to help show the incumbent is "spinning". Any help appreciated.

12 15

Hibernia/Atrato contacts
by Alistair Mackenzie 03 Dec '14

03 Dec '14

Hi, Does anyone have a contact for a sales/account manager at Hibernia/Atrato located in the UK timezone or even +1? Please contact me off list with the details. Thanks, Alistair

1 1