- Test - lists.nanog.org

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

Yes that's right, just would of slowed down the process. Sent from my HTC ----- Reply message ----- From: "Ishmael Rufus" <sakamura(a)gmail.com> To: "james(a)smithwaysecurity.com" <james(a)smithwaysecurity.com> Cc: <paul(a)paulgraydon.co.uk>, <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 7:56 pm That doesn't stop the power of our US government. On Thu, Jan 19, 2012 at 5:53 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC > > ----- Reply message ----- > From: "Paul Graydon" <paul(a)paulgraydon.co.uk> > To: <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 7:27 pm > > > On 01/19/2012 12:41 PM, Ryan Gelobter wrote: >> The megaupload.com domain was seized today, has anyone noticed significant >> drops in network traffic as a result? >> >> http://www.scribd.com/doc/78786408/Mega-Indictment >> http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… > Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? > > http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate… >

1 0

Re: Megaupload.com seized
by Ishmael Rufus 19 Jan '12

19 Jan '12

That doesn't stop the power of our US government. On Thu, Jan 19, 2012 at 5:53 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > Wow, what suprised the servers were, all located offshore. > > Sent from my HTC > > ----- Reply message ----- > From: "Paul Graydon" <paul(a)paulgraydon.co.uk> > To: <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 7:27 pm > > > On 01/19/2012 12:41 PM, Ryan Gelobter wrote: >> The megaupload.com domain was seized today, has anyone noticed significant >> drops in network traffic as a result? >> >> http://www.scribd.com/doc/78786408/Mega-Indictment >> http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… > Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? > > http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate… >

1 0

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

Wow, what suprised the servers were, all located offshore. Sent from my HTC ----- Reply message ----- From: "Paul Graydon" <paul(a)paulgraydon.co.uk> To: <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 7:27 pm On 01/19/2012 12:41 PM, Ryan Gelobter wrote: > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… Ars Technica are implying it was quite a source of bandwidth usage within companies. I'm curious, are any interesting charts on an ISP side? http://arstechnica.com/business/news/2012/01/before-shutdown-megaupload-ate…

1 0

Re: Megaupload.com seized
by Ishmael Rufus 19 Jan '12

19 Jan '12

It's your typical FBI raid operation. Arrest everyone and seize all electronics. Then ask questions, weeks later. On Thu, Jan 19, 2012 at 5:44 PM, james(a)smithwaysecurity.com <james(a)smithwaysecurity.com> wrote: > You guys serous, when did the order come in to sezie the domain? > > Sent from my HTC > > ----- Reply message ----- > From: "Ryan Gelobter" <ryan.g(a)atwgpc.net> > To: "NANOG" <nanog(a)nanog.org> > Subject: Megaupload.com seized > Date: Thu, Jan 19, 2012 6:41 pm > > > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar…

1 0

Re: Megaupload.com seized
by james＠smithwaysecurity.com 19 Jan '12

19 Jan '12

You guys serous, when did the order come in to sezie the domain? Sent from my HTC ----- Reply message ----- From: "Ryan Gelobter" <ryan.g(a)atwgpc.net> To: "NANOG" <nanog(a)nanog.org> Subject: Megaupload.com seized Date: Thu, Jan 19, 2012 6:41 pm The megaupload.com domain was seized today, has anyone noticed significant drops in network traffic as a result? http://www.scribd.com/doc/78786408/Mega-Indictment http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar…

1 0

Re: Megaupload.com seized
by Scott Weeks 19 Jan '12

19 Jan '12

On Jan 19, 2012, at 5:41 PM, Ryan Gelobter wrote: > The megaupload.com domain was seized today, has anyone noticed significant > drops in network traffic as a result? > > http://www.scribd.com/doc/78786408/Mega-Indictment > http://techland.time.com/2012/01/19/feds-shut-down-megaupload-com-file-shar… ----------------------------------------------------------------- ------------ derek(a)derekivey.com wrote: -------------- From: Derek Ivey <derek(a)derekivey.com> Interesting… it looks like they seized the servers and didn't touch DNS. -bash-3.00$ nslookup megaupload.com Non-authoritative answer: Name: megaupload.com Address: 174.140.154.22 Name: megaupload.com Address: 174.140.154.23 Name: megaupload.com Address: 174.140.154.24 Name: megaupload.com Address: 174.140.154.20 Name: megaupload.com Address: 174.140.154.21 DNS still points to Mega Upload's IPs. --------------------------------------------------------------- Collecting client IP addresses to send notices to? >;-) I notice other IPs in the range ( for example, .223 and .123) say the same thing about UDP/53. scott ku# nmap -P0 -sU -p U:53 174.140.154.22 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.21 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.20 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.223 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -sU -p U:53 174.140.154.123 PORT STATE SERVICE 53/udp open|filtered domain ku# nmap -P0 -A 174.140.154.20 All 1000 scanned ports on 174.140.154.20 are filtered Too many fingerprints match this host to give specific OS details

1 0

Whois 172/12
by Ted Fischer 19 Jan '12

19 Jan '12

Hi all, Tearing what's left of my hair out. A customer is getting scanned by a host claiming to be "172.0.1.216". I know this is bogus, but I want to go back to the customer with as much authoritative umph as I can (heaven forbid they just take my word). I'm pretty sure I read somewhere once that 172/12 was "reserved" or something like that. All I can find now is that 172/8 is "administered by ARIN". Lots of information on 172.16/12, but not a peep about 172/12. If anybody could provide some insight as to the allocation/non-allocation of this block, it would be much appreciated. Thanks. Ted Fischer

15 17

US DOJ victim letter
by Jay Hennigan 19 Jan '12

19 Jan '12

We have received three emails from the US Department of Justice Victim Notification System to our ARIN POC address advising us that we may be the victim of a crime. Headers look legit. We have been frustrated in trying to follow the rabbit hole to get any useful information. we've jumped through hoops to get passwords that don't work and attempted to navigate a voice-mail system that resembles the "twisty maze of passages all different" from an old text adventure game. This *seems* to be legit, and I would think that the end result is likely to be a list of IP addresses associated with infected hosts. Has anyone else received the email? Is it legit? If so has anyone successfully navigated the maze, and if so how? Is it worth it? (And why don't they just send the list of infected IPs to the ARIN contact in the first place?) -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

12 11

RIS raw data
by andra.lutu＠imdea.org 19 Jan '12

19 Jan '12

Hi all, I am working on getting a better grasp on what data we have in the RIS project from RIPE. To this end, I am checking the export policies of the ASes peering with RIPE AS12654 at different IXPs. I am wondering if anybody knows what these ASes actually announce to the RIPE repositories? Do they dump their entire routing tables (including their internal routes) ? In some cases I saw the export policy ANNOUNCE ANY, is this consistent with a particular AS behaving like the RIPE AS was its customer? Another type of export policy is for example 'to AS12654: ANNOUNCE AS "YYY" '(where "YYY" is any AS peering with RIPE in the RIS project). How is this policy different from the previous one from the point of view of the routing feed the RIPE repository receives? Thank you for your help! Best regards, Andra

9 10

AlcaLu Adds Security to Routers
by Henry Linneweh 19 Jan '12

19 Jan '12

http://www.lightreading.com/document.asp?doc_id=216514&f_src=lrdailynewslet… -Henry

2 1