- Test - lists.nanog.org

LiquidWeb contact re phishing 24 days
by Jonathan M 29 May '20

29 May '20

Greetings, If anyone can help me reach a contact at LiquidWeb, there appears to be phishing on its network for 24 days now and I cannot get a response from them or an acknowledgement of receipt of our notices Yes, we filled our web forms as early as May 5. I can be reached at jonathan-m(a)riskiq.net or if Liquid Web can just respond to the notice, that would be great! They just need to email notice335282(a)irt.riskiq.net. Thanks for any help you can provide here! By the way, I could not find the phish myself, but I preserved it at https://perma.cc/LR8N-SMTH from a RiskIQ crawl that I just looked over internally. The snapshot was taken Fri May 29 05:38:44 PDT 2020 From Chrome Below is an example of what we are sending them: From RiskIQ Incident Response Team <notice335282(a)irt.riskiq.net> To abuse(a)liquidweb.com Sent At May 18, 2020 8:02 PM Subject Important Notice - Phishing Materials on Your Network / Incident ID: 54873584 / IP Address: 69.167.190.92 / ASN: LIQUID-WEB-INC - Liquid Web, Inc., US 2020-05-18 19:53:03 +0300 Team, please see the notice below from our incident response team beneath my signature block. However, I need to point out a few things here. I personally spoke with your team on 2020-03-19 12:49:00 +0200, where we discussed you purchased Nexcess, and that is why there is a different technical abuse contact. I had also re-submitted a ticket referencing the prior ticket and someone at LiquidWeb was opening a ticket on the call to make sure they are on top of this. On 2020-03-24 20:13:44 +0200, Scott at LiquidWeb was investigating this tenacious event. I was told that if this is a repeat offender, you will terminate the account all together, but you woouldn't be able to share that info with us for privacy reasons. However, your team was conducting at the moment an internal investigation to see if they need to take different measures. At that time, Scott put me on hold while he reached out to the security team. At 2020-03-24 20:35:13 +0200, the Security supervisor was looking this over and it was going to take some time for them to decide best course of action. The site was then down. I was told that if it re-surfaces, we can list the UTC date and time stamps that it came back online and your team might then be able to take further action without a court order. You said that if you check the logs, and it doesn’t match up, we would have to get the courts involved. We have preserved a lot of evidence that the phishing has gone back up again after you took it down. For example, for your reference, we have uploaded a screenshot at https://perma.cc/SL7L-6XUE This screenshot in the PERMA record captures hXXps://zionhighschools[.]com/wp-content/themes/ivy-school/vc_templates/american-express/home/?cmd=www.ssaonline-account-service.com-update_submit&amp%3bid=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb&amp%3bsession=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb Load Date: Mon May 18 08:13:18 PDT 2020 IP Address: 69.167.190.92 HTTP Method: GET Response Code 200 Response Message OK Content Type text/htmlCharacter SetUTF-8Is HTML Page true Is From Cache false Local Content Length 2.00 K Overall Content Length 319.19 K Local Response Time 4.97 s Overall Response Time5.87 s CPU Time76 ms Dependent Requests 5 Window Name: TopLevelWindow@79c734a4 Please take appropriate action. See all the confirmed URLs in the notice below. Thanks, Jonathan Matkowsky , Vice President - Digital Risk (SME)* Incident Investigation & Intelligence (i3) Phone +1.888.415.4447 (USA) | +44 (0)203 282 7149 (UK) RiskIQ: World Leader in Attack Surface Management *GIAC-GLEG; IAPP-FIP; Active Attorney Admissions: NY, WA This email does not create an attorney-client relationship or constitute legal advice. ***We have defanged URLs in this notice. In the identity and location of the phishing materials, please substitute "." for "[dot]", "http" for "hxxp", and "https" for "hxxps"*** ******* ***** ***** ****** ******** *Summary* *Threat Activity Type*: Phishing *Industry Impact*: Financial *Spoofed Brand*: American Express *Date and Time of Abuse:*: 2020-05-05 06:32 AM PDT *IP Address*: 69.167.190.92 *ASN*: LIQUID-WEB-INC - Liquid Web, Inc., US *Identify and Location of Phishing Materials*: hxxps://zionhighschools[dot]com/wp-content/themes/ivy-school/vc_templates/american-express/home/?cmd=www.ssaonline-account-service.com-update_submit&%3bid=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb&%3bsession=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb hxxp://zionhighschools[dot]com/wp-content/themes/ivy-school/vc_templates/american-express/home/ hxxps://zionhighschools[dot]com/wp-content/themes/ivy-school/vc_templates/american-express/home/?cmd=www.ssaonline-account-service.com-update_submit&id=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb&session=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb hxxps://zionhighschools[dot]com/wp-content/themes/ivy-school/vc_templates/american-express/home/?cmd=www.ssaonline-account-service.com-update_submit&id=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb&session=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb hxxp://zionhighschools[dot]com/wp-content/themes/ivy-school/vc_templates/american-express/home/?cmd=www.ssaonline-account-service.com-update_submit&id=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb&session=93dd5ecd270aecd21435f29da5626bcb93dd5ecd270aecd21435f29da5626bcb (individually or collectively, “*Phishing Materials*”) ******* ***** ***** ****** ******** Greetings, Per the above summary, we write on behalf of American Express to request your assistance to mitigate a confirmed threat that appears to utilise your network resources for fraudulent purposes by hosting the Phishing Materials as identified above. We would appreciate it if you would take all reasonable and appropriate steps to ensure your network resources are no longer being used to facilitate or contribute to this confirmed threat, which may include temporarily suspending the account until the Phishing Materials have been removed. If you need any support or additional information during the course of your investigation, please let us know by reply email at your earliest convenience. Thank you for your support in safeguarding the public. Sincerely, Digital Threat Incident Response Team RiskIQ, Inc. 22 Battery St., 10th Floor, San Francisco CA 94111 USA www.riskiq.com Incident 54873584 -- ******************************************************************* This message was sent from RiskIQ, and is intended only for the designated recipient(s). It may contain confidential or proprietary information and may be subject to confidentiality protections. If you are not a designated recipient, you may not review, copy or distribute this message. If you receive this in error, please notify the sender by reply e-mail and delete this message. Thank you. *******************************************************************

2 1

LF Microsoft Bing/Cache (edge) contact?
by Austin, Jeremy H. 28 May '20

28 May '20

We have an (apparently now defunct) on-premise Microsoft Bing cache. Traffic has dropped off from it over the last few months. Unlike the other cache programs, we haven’t heard anything proactive from MS – the contact who set this up with us long ago moved on to other companies. It also appears that the program is now called Microsoft Edge Caching. We’d like to continue to host a Microsoft cache, no matter the name. Based on https://www.peeringdb.com/net/694 we could be looking to ioc(a)microsoft.com<mailto:ioc@microsoft.com> and peering(a)microsoft.com<mailto:peering@microsoft.com>, and per https://peering.azurewebsites.net/Peering/Caching we should be looking to ispnode(a)microsoft.com<mailto:ispnode@microsoft.com> for inquiries about the current cache program. However despite being listed as the address of record for peering inquiries, ispnode(a)microsoft.com<mailto:ispnode@microsoft.com> bounces external emails, apparently using a mailing list (member whitelist). The other two addresses haven’t produced any responses. Does anyone have a current contact for Microsoft’s edge caching program, or work there yourself? Regards, Jeremy Austin Alaska Communications ________________________________ This transmittal may contain confidential information intended solely for the addressee. If you are not the intended recipient, you are hereby notified that you have received this transmittal in error; any review, dissemination, distribution or copying of this transmittal is strictly prohibited. If you have received this communication in error, please notify us immediately by reply or by telephone at 907-297-3000 and ask to speak with the message sender. In addition, please immediately delete this message and all attachments. Thank you. Alaska Communications

1 0

Google NOC contact me
by Kaiser, Erich 28 May '20

28 May '20

Been trying to reach someone from the Google NOC for almost 24hrs now and no response, not even a reply email to several of mine. Please contact me offlist. Erich Kaiser The Fusion Network erich(a)gotfusion.net Office: 815-570-3101

1 0

telia - texas - 10:30 a.m. central time - issues ?
by Aaron Gould 28 May '20

28 May '20

In the Texas area, particularly, south central, Austin area... anyone know of any issues with Telia Internet today around 10:32 a.m. central time ? I had good bgp session and good route 0/0 from them, but little to no internet packets were flowing. -Aaron

5 8

Tierpoint abuse contact
by David Shaw 27 May '20

27 May '20

Hi, I could really use some help reaching someone at Tierpoint for a spam problem coming from 216.27.63.177, 216.27.63.154, 216.27.63.196, and other addresses in that block. I've sent countless emails to their abuse contact with no response, had daily calls with their NOC (very polite, but ultimately unable to do more than take a message). It's been almost a month now, and while I don't like asking on NANOG, after emailing and calling for weeks, I'm out of other options. Any pointers would be very welcomed. David

2 1

Amazon Prime Video Contact
by Nathan Gerencser 27 May '20

27 May '20

Anybody have a contact at Amazon that could help clear up an issue with an IP prefix being blocked from accessing the Prime Video service? Thanks in advance. Nathan Gerencser, Network Engineer MetaLINK Technologies

2 1

Did I miss a problem: FCC and CISA stress need for access during pandemic
by Sean Donelan 27 May '20

27 May '20

I have not heard of any problems with access for ISP and communications workers in any U.S. state or locality during the pandemic. Did I miss a big problem requiring the FCC chairman and CISA Director send a letter? https://www.fcc.gov/document/fcc-cisa-stress-need-communications-industry-a… Federal Communications Commission Chairman Ajit Pai and the Cybersecurity and Infrastructure Security Agency (CISA) Director Christopher Krebs today sent a letter to the nation’s governors encouraging them to provide necessary access and resources to the communications workers helping to keep Americans connected during the COVID-19 pandemic. [...] The letter includes these key points: - Highlights recent guidance from CISA related to the essential critical infrastructure workforce and 911 centers during the pandemic - Asks that certain communications industry entities and personnel be declared essential to the pandemic response and afforded all appropriate access and resources - Asks that states consider prioritizing the distribution of personal protective equipment to communications personnel when available - Underscores the role of various communications industry personnel to supporting consumers’ remote emergency communications needs - Encourages industry and government to work together to prioritize and complete communications infrastructure and next generation 911 projects - Calls on states to facilitate the maintenance, repair, and provisioning of communications infrastructure and services by providing online access to relevant government functions, such as the permitting process, where not already available electronically.

4 4

NANOG 79 - Lightning Talks submissions extended to 5/31
by Vincent Celindro 26 May '20

26 May '20

Hello NANOG community, The Program Committee has extended the deadline to submit Lightning Talks to May 31st 2020 10pm EDT. Lightning Talks will be presented virtually on Tuesday June 2nd 2020. A lightning talk is a very short presentation/speech by any attendee on any topic relevant to the NANOG audience. These are limited to ten minutes; this will be strictly enforced. If you have a topic that's timely and interesting, we encourage you to consider presenting it. Please submit an abstract via https://www.nanog.org/meetings/submit- lightning-talk. You will be notified if you have been selected on Monday June 1st. If you have any questions please contact nanogpc(a)nanog.org. Come share your ideas and insights. Thank You, Vincent Celindro NANOG - Program Committee Chair

1 0

How to Make the Most of a Virtual Conference
by NANOG Marketing 26 May '20

26 May '20

*Ten tips from Angela Reyna of Kentik* “We’re all longing for more connected times with less distance. For now, the best thing we can do is be present, and make the most of these virtual opportunities." While nothing can totally replace the experience of gathering IRL, virtual conferences are still an amazing way to share, discover, and connect with your community. That’s why we love these tips for making the most of any virtual conference, shared with us by Angela Reyna, Senior Marketing Manager at Kentik — up now, on NANOG Stories. Read the Feature <https://www.nanog.org/stories/ten-tips-virtual-conference/>

1 0

Network issues in Israel/Middle East
by John Von Essen 26 May '20

26 May '20

I know this is outside the scope of “North America”, but has anyone else been fielding more issues related to network health/congestion in the middle east, specifically Israel? Our users in Israel are primarily served from India-based resources (AWS/Azure), both of which have cloud capacity issues in India that I’m aware of. Also, the majority of our users in Israel that have been reporting slowness seem to be mostly behind the ISP Bezeq. If we force them to route to Ireland (which is technically farther away form a latency standpoint) things are much better, so I’m wondering if just Bezeq (or everyone in Israel) is just experiencing 3rd party-related network congestion to Mumbai. Thanks John

4 4