- Test - lists.nanog.org

Re: Wired mag article on spammers playing traceroute gameswith trojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>Actually, in the case of the wired article (removeform.com) it seems to be >connected to a site in Florida. I asked my programmer (gabor(a)sentex.net) >to decode the obfuscated java script/page that is served up by one of the >zombies (On FreeBSD fetch -B 18192 -o danger.html >http://www.removeform.com/d - I got it from 207.5.215.72 at the time). I >have attached it as a zip file with its contents. You will note that the >form post goes back to > >form action="http://207.36.47.68/cgi-bin/addinfo.cgi" > > >OrgName: CyberGate, Inc. >OrgID: CYBG >Address: 3250 W. Commercial Blvd. Suite 200 >City: Ft. Lauderdale >StateProv: FL >PostalCode: 33309 >Country: US This appears to be a rather prolific spammer. At first I thought they were affiliated with www.skynetweb.com because they have the same address, including suite number, but it now appears that they are really affiliated with these guys: http://www.affinity.com/about/our_team/our_team.htm John --

4 3

RE: contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 09 Oct '03

09 Oct '03

We are listed in no-more-funn.moensted.dk as 127.0.0.2 which is described as: + NERD-CA ip-space assigned to Canada: ca.countries.nerd.dk -> 127.0.0.2 216.220.40/24 is in ca, rejected based on geographical location about: Please see our webpage for more information about: This zone lists ONLY based on geographic information about: The zone does NOT contain known spammers, nor open relays We do cop to being Canadian, but that's about it. I hope yahoo isn't keying on this RBL. -mark ...and we've already filled out the retest form at Yahoo. On Thu, 9 Oct 2003, Thor Larholm wrote: > If you read through all of that page, you will notice that Yahoo itself > has a re-test script you can use to trigger a verification. > > http://add.yahoo.com/fast/help/us/mail/cgi_retest > > Yahoo is not your only problem, if you look at > http://moensted.dk/spam/?addr=216.220.40.247 you will notice that > several DNSBL lists that IP address. No-more-fun believes it to be a > "Direct spam source" and ArixDictStale says it has performed active > dictionary attacks within the last 3 months. > > If you want to positively check whether you are an open relay, I would > recommend testing through ORDB at http://ordb.org/submit/ > > > Regards > Thor Larholm > PivX Solutions, LLC - Senior Security Researcher > > -----Original Message----- > From: Mark Jeftovic [mailto:markjr@easydns.com] > Sent: Thursday, October 09, 2003 1:23 PM > To: nanog(a)merit.org > Subject: contact at yahoo mail? (they think we're an open relay :< ) > > > > > Today our email forwarders started getting this from yahoo.com mail > handlers: > > 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see > help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection > closed by foreign host. > > Which when you go look at that page basically tells you you're probably > an open relay (which we're not), etc. > > Can any mail admins at Yahoo contact me offlist, or post what the > restrictions are or at what levels this will kick in? > > -mark > > -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

2 1

Need contact at Everyone Internet
by Mike Batchelor 09 Oct '03

09 Oct '03

I am seeking a contact at Everyone Internet (EV1.NET) who can address a routing problem at EV1's borders that is causing our users to be unable to reach many popular sites hosted there, or that have DNS servers there. We've tried contacting them by telephone, only to be referred to noc(a)ev1.net. We have sent mail there from outside our network, but have received no response. If someone from Everyone Internet is reading this, I would very much appreciate a response. If you cannot get email to me, please call at 213-739-5173. Or if you know how to reach someone at the EV1 NOC for problems of this sort, I'd appreciate that as well. Thank you. --- "The avalanche has already begun. It is too late for the pebbles to vote." -- Kosh

1 0

Fw: Broadband World Forum Conference Proceedings
by Alan Spicer 09 Oct '03

09 Oct '03

IEC Broadband World Forum Proceedings CD-ROM --- Alan Spicer (a_spicerNOSPAM(a)bellsouth.net) http://aspicer.homelinux.net/ Systems and Network Administration, and Telecommunications (954) 977-5245 ----- Original Message ----- From: Julie Brandt To: a_spicer(a)bellsouth.net Sent: Thursday, October 09, 2003 11:04 AM Subject: Broadband World Forum Conference Proceedings The Broadband World Forum 2003 combined high-level educational programming with high-impact exhibits to explore the range of business strategies and technology alternatives available to today's decision-makers in building tomorrow's next-generation broadband networks. With more than 100 speakers, the World Forum 2003 provided its educational conference attendees with current and in-depth information on the status of the broadband industry. The educational sessions featured discussions of today's most critical issues, including broadband rollout, mobility applications, DSL advances, FTTx, emerging wireless technologies, the status of the global marketplace, and much more. If you were unable to attend the World Forum in London, you can still benefit from the insight and expertise of the industry leaders who presented within the educational program. See below for your IEC Web Registrant Discount on the CD-ROM proceedings of the Broadband World Forum 2003. This CD-ROM contains comprehensive information on the latest technology advancements and current market trends from the thought leaders who are guiding today's global broadband industry. Topics covered include: a.. xDSL b.. Optical access c.. Metro-area networks d.. Gigabit Ethernet topologies e.. 802.11x, 802.16, and 3G wireless f.. Satellite last-mile access solutions g.. High-speed mobile Internet h.. Emerging broadband architectures i.. Revenue-driving applications, services, and content delivery A few of the featured presentations featured in this Proceedings CD-ROM include: a.. Gilles Coullon, Chief Technical Officer, France Telecom b.. Bernard Delvaux, Executive Vice President, Belgacom c.. Yves Goblet, Deputy Chief Executive Officer, Bouygues Telecom d.. Leif Aarthun Ims, Vice President, Telenor e.. Roland Kittel, Member of the Board of Management, Deutsche Telekom AG f.. Stefano Pileri, President, Telecom Italia g.. Krish Prabhu, Vice Chairman of the Board of Directors, ECI Telecom h.. Mario Mella, Network Planning Director, Fastweb i.. Rupert Gavin, Chief Executive, BBC Worldwide j.. Jean-Claude Vandenbosch, President, Belgacom Wireline k.. Jong-Lok Yoon, Executive Vice President, KT l.. Manuel Echánove Pasquin, General Manager, Telefónica de España m.. Pinny Chaviv, President and CEO, Inovia Broadband Access Division, ECI Telecom n.. David Cleevely, Chairman, Analysys Group o.. Joe Crupi, Vice President-Broadband Communications, Texas Instruments p.. Rupert Gavin, Chief Executive, BBC Worldwide q.. Anders Gustafsson, President, Tellabs International r.. Martin Harriman, Chief Marketing Officer, Marconi s.. Markku Hynninen, Vice President-Broadband Systems Division, Nokia Networks t.. Adam Joffe, Vice President of Information Technology and Chief Technology Officer, Sony Online Entertainment u.. Hack Kim, Executive Vice President, R&D Center, Samsung v.. Krish Prabhu, Vice-Chairman of the Board of Directors, ECI Telecom w.. Michel Rahier, President, Fixed Networks Division, and Chief Operating Officer, Fixed Communications Group, Alcatel x.. Anton Schaaf, Member of the Group Executive Management, Siemens ICN y.. Mike Short, Vice President, O2, and Chairman - Mobile Data Association z.. Hiroaki (Harry) Takeichi, Corporate Vice President and Group President, Network Systems Group, Fujitsu aa.. Christian Wolff, Vice President & General Manager, Infineon Technologies Don't miss this limited opportunity to learn from this impressive lineup of business leaders and technology innovators who are driving the broadband industry. Order your Broadband World Forum 2003 proceedings CD-ROM today for $295.00 ($495.00 retail). To receive this exclusive IEC Web Registrant Discount for your organization, simply reply "yes" to this e-mail or call Julie Brandt, IEC Publications Manager, at +1-312-559-3730. For a complete table of contents of the Broadband World Forum Proceedings CD-ROM visit http://www.iec.org/pubs/proceedings/2003/bbwf_2003_toc.html, call +1-312-559-3730, or e-mail the IEC Publications Department at publications(a)iec.org. -------------------------------------------------------------------------- The International Engineering Consortium periodically sends e-mails to constituents and other professionals in the communications industry announcing new research reports, upcoming seminars, and or other IEC initiatives. If you would prefer not to receive further e-mail messages from the IEC, click here. Please email any comments to support(a)iec.org

1 0

Re: Wired mag article on spammers playing traceroute gameswith trojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>>> Michael Airhart <mairhart(a)cisco.com> 10/9/03 1:57:06 PM >>> > >How many times have you received SPAM selling a product from a U.S. based >company? I have received plenty.... follow the money.... Hank has it right. > >M >(speaking only for myself) Well, Cisco has a sales office in the same building as CyberGate/Affinity/Skywebnet. Can you send a few of your people over to suite 200 and see if you can take care of that problem for us? :-) John --

1 0

Re: Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

> > Let's also assume someone sets up a popular webpage with malware >> HTML causing it, perhaps with a time delay, to issue rapid GETs to >> deliberately nonexistent domains. > >You don't even have to imagine that. > >Imagine a long-term port 80 Denial of Service (DoS) attack against a >given website (using the website url rather than IP, which is not >uncommon). > >Imagine the attacked domain administrator removes their DNS records >from the registry to alleviate the attack. > >The attack is now directed at the Verisign Sitefinder service. > > Adam OUCH. Yet worse.

2 1

Re: Wired mag article on spammers playing traceroute gameswithtrojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>OrgName: CyberGate, Inc. >>OrgID: CYBG >>Address: 3250 W. Commercial Blvd. Suite 200 >>City: Ft. Lauderdale >>StateProv: FL >>PostalCode: 33309 >>Country: US > >This appears to be a rather prolific spammer. At first I thought they >were affiliated with www.skynetweb.com because they have the same >address, including suite number, but it now appears that they are really >affiliated with these guys: > >http://www.affinity.com/about/our_team/our_team.htm > >John I decided to revise the way I phrased this. I should have said that this is a rather prolific home for spammers. I doubt Affinity or its associates are doing much spamming of their own. It does appear that Affinity, et. al., are hosting the page that is accepting information from that javascript. Affinity ought to know who is paying for that site and it seems like law enforcement might be rather interested in that information. John --

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 09 Oct 2003 14:36:53 -0400, Mike Tancsa wrote: >OrgName: CyberGate, Inc. This is a notorious spam-enabler about which I had a quarrel with AT&T management several years back to get them thrown off the AT&T network. I had to take it to their lawyers since the abuse staff would do nothing. Jeffrey Race

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 9 Oct 2003 10:28:30 -0700 (PDT), Andy Ellifson wrote: >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? This is an easy one. Again, see <http://www.camblab.oom/misc/univ_std.txt>

1 0

RE: Finding ASN from IP address
by Austad, Jay 09 Oct '03

09 Oct '03

There's a tool out there called "tracesroute" (note the "s") that will also provide the AS number of every ip it lists. > -----Original Message----- > From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] > Sent: Thursday, October 09, 2003 12:46 PM > To: Avleen Vig > Cc: nanog(a)merit.edu > Subject: Re: Finding ASN from IP address > > > > Avleen Vig writes on 10/9/2003 10:19 PM: > > > I want to create a mapping of IP addresses to ASN, for a > specific like > > of IP addresses. Eg: > > 1.2.3.4 > > 12.34.56.78 > > > > etc, gathered from my system logs. > > > > What is the best way of doing this? > > Rob Thomas (cymru.com) has something like this - see below. > > -- > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > manager, outblaze.com security and antispam operations > > > > * To: apops(a)apops.net > > * Subject: [apops] New Team Cymru IP2ASN whois server > > * From: Rob Thomas <robt(a)cymru.com> > > * Date: Fri, 26 Sep 2003 01:56:11 -0500 (CDT) > > * List-archive: <http://www.apnic.net/mailing-lists/apops/> > > * List-help: <mailto:apops-request@apops.net?subject=help> > > * List-id: Asia Pacific Operators Forum <apops.apops.net> > > * List-post: <mailto:apops@apops.net> > > * List-subscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=subscribe> > > * List-unsubscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=unsubscribe> > > * Sender: apops-admin(a)apops.net > > > > Fellow networkers, > > > > Team Cymru is happy to announce the availability of a public whois > > server dedicated to mapping IP numbers to ASNs, located at > > whois.cymru.com. You can find the link to this tool at: > > > > http://www.cymru.com/BGP/whois.html > > > > This link has been added to our main BGP data page available at: > > > > http://www.cymru.com/BGP/index.html > > > > We have also extended the functionality of this daemon to > support BULK > > IP submissions for those who wish to further optimize their > queries with > > netcat. > > > > Following is a quick overview of how to use it: > > > > $ whois -h whois.cymru.com <IP> > > > > Where <IP> is replaced by the IP you'd like to map, like so: > > > > $ whois -h whois.cymru.com 4.2.2.1 > > ASN | IP | Name > > 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications > > > > You can also include port information, and/or timestamps in your > > queries. Be sure to include quotes around your queries, or > the daemon > > will interpret your request as multiple lines: > > > > $ whois -h whois.cymru.com "4.2.2.1 -0600 GMT" > > ASN | IP | Info | Name > > 3356 | 4.2.2.1 | -0600 GMT | LEVEL3 Level 3 > > Communications > > > > For instructions on how to submit BULK queries via netcat, > simply issue > > the following command: > > > > $ whois -h whois.cymru.com help > > > > We hope you find this tool useful. Stay tuned for more features! > > > > If you have any comments or suggestions as to how we might > improve this > > service, feel free to let us know! > > > > Thanks, > > Rob, for Team Cymru. > > -- > > Rob Thomas > > http://www.cymru.com > > ASSERT(coffee != empty); > > > > > >

1 0