- Test - lists.nanog.org

RE: UNITED.COM (United Airlines) has been down for days! Any info on this?
by Hannigan, Martin 04 Sep '05

04 Sep '05

> > United.COM works from everywhere I try it. MCI, AT&T, Internap, > > and Sprint. I can run tickets, check miles, and check my dining > > points. > > > > Since I started the thread a month ago... it seemed to me that the > problem(s) are intermittent and not always repeatable :( I > was able to see > some very odd things in the dns resolution area for their > site(s), which > others had confirmed being problematic over the last few > months as well. You started this? Thanks. I love IKYABWAI threads. :-) > I'd think that lastnight's 'problem' was just another > recurrence of the > same set of problems :( Maybe someone at Internap could tell them/ask them what's going on?

2 1

RE: Katrina could inundate New Orleans
by Dave Stewart 04 Sep '05

04 Sep '05

At 12:02 AM 8/29/2005, you wrote: >Some of this is on topic. Internet access is as important as the >lights or water being on. Right, get out, but it'll be good >to see reasonable updates on what's going on utilities wise >down there when the weather shifts. Y'know... I do have to wonder whether Internet access is nearly as important as power and communications (traditional comms, such as the PTSN). Granted, it'll be interesting to see how things shake out - but I just can't buy that getting the Internet working should/will be a really high priority.

7 6

RE: UNITED.COM (United Airlines) has been down for days! Any info on this?
by Hannigan, Martin 04 Sep '05

04 Sep '05

> Nice try, but the location that I was trying from did not use > "alternative root servers". > > FYI: They are "Inclusive Namespace Servers". United.COM works from everywhere I try it. MCI, AT&T, Internap, and Sprint. I can run tickets, check miles, and check my dining points. Currently linked via United News: "The aftermath of Hurricane Katrina is still causing cancellations and some flight irregularities. Check the status of your flight before traveling and read on for information about changing travel plans affected by the weather. We are attempting to recover to full operations as quickly as possible." Sounds like a local issue. -M<

2 1

New Orleans Comm Needs
by Jerry Dixon 04 Sep '05

04 Sep '05

I don't know how many of you have a Ham license but see below: In talking with communication providers in the region they just now got satellite phones and in process of assessing and repairing communication lines for New Orleans. They're still somewhat challenged with comms including at shelters. See the request below from ARRL. There is an HF net setup and efforts under way by NCS down there. -Jerry http://www.arrl.org Attention All Amateurs... Amateur Radio emergency communication volunteers needed! (Sep 2, 2005) -- The ARRL now is seeking experienced Amateur Radio emergency volunteers to help supplement communication for American Red Cross feeding and sheltering operations in Mississippi, Alabama and the Florida Panhandle--as many as 200 locations in all. Special consideration will be given to operators who have successfully completed the ARRL Amateur Radio Emergency Communications course training (Level I minimum) to serve as team leaders. These volunteer operators will help to provide communication and equipment for relief efforts in the aftermath of Hurricane Katrina. If you're interested and qualified, please send an e-mail message to Katrina(a)arrl.org, providing name, call sign, contact information and any equipment you're willing and able to take along on a field deployment for an indefinite period. Volunteers may face hardship conditions without the usual amenities and will need to provide their own transportation to the marshaling area. ---- Original message ---- >Date: Fri, 2 Sep 2005 19:59:40 GMT >From: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> >Subject: FCC COORDINATING TECH AID FOR KATRINA DISASTER >To: nanog(a)merit.edu > > >http://www.boingboing.net/2005/09/02/fcc_coordinating_tec.ht ml > >- ferg > > >-- >"Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ >

2 1

RE: FW: Need some help: IDEAS, Inc.
by Hannigan, Martin 04 Sep '05

04 Sep '05

> > > this is NOT a good solution, since a successful phish attack > > > in this case > > > would look exactly like the official red cross web site. > > > > How's that one work? > > One form of DirectNIC's redirection, which the phisher was > supposedly using > (I didn't check myself), uses a <FRAMESET> to hide the > redirect inside a > frame, thereby not showing the real address in the browser > without deeper > inspection. Understood. If it's being pointed at redcross.org, a known good guy site, that wouldn't be a problem, would it? It seems that if the scammer is removed from the operation, it's not really a problem anymore. I'm interested because I think there could be value in a page(s) on an SP that says "This site terminated due to fraudulent activity" and pointers to how to not be sucked into these things. > Personally, I'd prefer registrar lock myself, as that keeps > the distinction > between scam and non-scam clear. Registrar lock is preferred on my part. The redirect idea was creative. -M<

1 0

RE: FW: Need some help: IDEAS, Inc.
by Hannigan, Martin 04 Sep '05

04 Sep '05

> this is NOT a good solution, since a successful phish attack > in this case > would look exactly like the official red cross web site. How's that one work? -M<

2 1

UNITED.COM (United Airlines) has been down for days! Any info on this?
by John Palmer 04 Sep '05

04 Sep '05

The United Airlines website appears to be down and has been down for days. Is this a network issue or are they out of business??

8 8

FW: Need some help: IDEAS, Inc.
by Marcus H. Sachs 04 Sep '05

04 Sep '05

One of our incident handlers at the SANS Internet Storm Center has been trying to chase down the bogus Katrina assistance web sites. Below is a note of frustration he sent internally to us this morning. I asked if I could cross-post over to NANOG to see if any of you could assist. Thanks in advance! Marc ++++++++++++++++++++++++++++++++++++++++++++++++++++++ Marcus H. Sachs, P.E. KJ4WA : marc(a)sans.org Director, SANS Internet Storm Center : isc.sans.org Washington D.C. USA (EDT, GMT-4) : +1 703 707 9293 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ -----Original Message----- Sent: Saturday, September 03, 2005 9:32 AM Subject: Need some help: IDEAS, Inc. Morning all: Last night, I pulled a new copy of the .com and .net zone files down and did another grep for "katrina" domains. Obviously, there are now more... In the process of checking and cross-referencing, I found that our friends "IDEAS, Inc" are a little more "involved" than we originally thought: http://www.hurricanekatrinarelief.com http://www.hurricanekatrinapics.com http://www.hurricanekatrinaneworleans.com http://www.hurricanekatrinaflooding.com http://www.hurricanekatrinainfo.com http://www.hurricanekatrinamap.com http://www.hurricanekatrinanews.com http://www.hurricanekatrinapath.com http://www.hurricanekatrinaphoto.com http://www.hurricanekatrinaphotos.com http://www.hurricanekatrinarelieffund.com http://www.hurricanekatrinatracking.com http://www.hurricanekatrinaupdate.com http://www.hurricanekatrinavideos.com http://www.katrinadamage.com http://www.katrinapics.com http://www.katrinavideos.com http://www.neworleanshurricanekatrina.com ...and those are just the 18 I was able to find. Right now, there are two weak points to this particular house of cards. 1) The first site listed, "http://www.hurricanekatrinarelief.com" is what drives all of the others. Each of the other sites, loads the first one in an IFRAME. That makes it easy for the bastards to update them all. This site is hosted by Interland. Their final word on shutting these scumballs down until they could prove they were legitimate was: "We have been advised by our legal department that the local authorities should be contacted. The local authorities can submit a subpoena to our legal department. We will be glad to comply to such a request." ie. "We have no balls. Go away". 2) All of the other sites are hosted at the IP address 206.251.184.10. Immediate upstream is "datasync.net/.com" and they are located in (of course...) Louisiana. I've emailed them numerous times, and tried to call ("all circuits are busy..."), but they're probably running in lights-out mode right now. The IDEAS, Inc. scum MUST die, but I'm all out of ideas at this point... the only other possibility that I can think of it to take them out at the DNS level. All of the "slave" sites at 206.251.184.10 use DirectNIC for their DNS... Anyone got sway with them? Frankly, gang, I'm at my wits end on this one...

4 5

Tidbit from DirectNIC
by Michael.Dillon＠btradianz.com 03 Sep '05

03 Sep '05

>From downtown New Orleans... http://www.livejournal.com/users/interdictor/ -----snip----- Fox News is reporting that there is an operation underway to refill chillers at the Bell South building down the street to keep phone service available to much of the southeast United States. That is apparently where all the firetrucks are going to in the area, in case you were wondering. -----snip----- It is interesting to note that it is possible to bring in diesel and water to resupply BellSouth yet it is impossible to bring in water and food for the residents, not to mention a fleet of small boats that could have prevented thousands from dying trapped inside their attics. If you have a datacenter in a location that might be flooded by rivers or storm surges, do you have inflatable rafts among your emergency supplies? --Michael Dillon

13 22

Re: FW: Need some help: IDEAS, Inc.
by Jerry Dixon 03 Sep '05

03 Sep '05

Just an FYI, FBI and Secret Service are actively working these as they are identified. We definitely don't need more victims. If you don't feel you're getting the response needed contact US CERT: https://forms.us-cert.gov/report/ or http://www.us-cert.gov/contact.html We'll make sure the information gets into the right hands. I will say that I know many others on the list have been doing a great job of identifying sites as well as reporting. SANS ISC keep up the good work! The information goes into Federal Law Enforcement who also works with Local LE. Jerry ---- Original message ---- >Date: Sat, 3 Sep 2005 11:00:03 -0400 >From: "Marcus H. Sachs" <marc(a)sachsfamily.net> >Subject: FW: Need some help: IDEAS, Inc. >To: <nanog(a)merit.edu> >Cc: <handlers(a)sans.org> > > >One of our incident handlers at the SANS Internet Storm Center has been >trying to chase down the bogus Katrina assistance web sites. Below is a >note of frustration he sent internally to us this morning. I asked if I >could cross-post over to NANOG to see if any of you could assist. > >Thanks in advance! > >Marc > > >++++++++++++++++++++++++++++++++++++++++++++++++++++++ >Marcus H. Sachs, P.E. KJ4WA : marc(a)sans.org >Director, SANS Internet Storm Center : isc.sans.org >Washington D.C. USA (EDT, GMT-4) : +1 703 707 9293 >++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > >-----Original Message----- >Sent: Saturday, September 03, 2005 9:32 AM >Subject: Need some help: IDEAS, Inc. > > >Morning all: > >Last night, I pulled a new copy of the .com and .net zone files down and did >another grep for "katrina" domains. Obviously, there are now more... > >In the process of checking and cross-referencing, I found that our friends >"IDEAS, Inc" are a little more "involved" than we originally thought: > >http://www.hurricanekatrinarelief.com >http://www.hurricanekatrinapics.com >http://www.hurricanekatrinaneworleans.com >http://www.hurricanekatrinaflooding.com >http://www.hurricanekatrinainfo.com >http://www.hurricanekatrinamap.com >http://www.hurricanekatrinanews.com >http://www.hurricanekatrinapath.com >http://www.hurricanekatrinaphoto.com >http://www.hurricanekatrinaphotos.com >http://www.hurricanekatrinarelieffund.com >http://www.hurricanekatrinatracking.com >http://www.hurricanekatrinaupdate.com >http://www.hurricanekatrinavideos.com >http://www.katrinadamage.com >http://www.katrinapics.com >http://www.katrinavideos.com >http://www.neworleanshurricanekatrina.com > >...and those are just the 18 I was able to find. > >Right now, there are two weak points to this particular house of cards. > >1) The first site listed, "http://www.hurricanekatrinarelief.com" is what >drives all of the others. Each of the other sites, loads the first one in >an IFRAME. That makes it easy for the bastards to update them all. This >site is hosted by Interland. Their final word on shutting these scumballs >down until they could prove they were legitimate was: > >"We have been advised by our legal department that the local authorities >should be contacted. The local authorities can submit a subpoena to our >legal department. We will be glad to comply to such a request." > >ie. "We have no balls. Go away". > >2) All of the other sites are hosted at the IP address 206.251.184.10. >Immediate upstream is "datasync.net/.com" and they are located in (of >course...) Louisiana. I've emailed them numerous times, and tried to call >("all circuits are busy..."), but they're probably running in lights-out >mode right now. > >The IDEAS, Inc. scum MUST die, but I'm all out of ideas at this point... the >only other possibility that I can think of it to take them out at the DNS >level. All of the "slave" sites at 206.251.184.10 use DirectNIC for their >DNS... Anyone got sway with them? > >Frankly, gang, I'm at my wits end on this one... > >

1 0