- Test - lists.nanog.org

Re: williams spamhaus blacklist
by Dr. Jeffrey Race 25 Sep '03

25 Sep '03

On Thu, 25 Sep 2003 08:29:42 +0100, Steve Linford wrote: >for the benefit of those providers on nanag who use our SBL system, >rest assured we will be removing the escalation 'any minute now' as >WCG are now in contact with us and I understand are pulling spammer >plugs. Elegant understatement of basic principle that only hitting the management scum over the head with a mallet will change their behavior. Leo, are you listening? In my judgment rehashing this issue on NANOG is 1000% appropriate because the people on this list are the ones who have to carry the bad news to their masters. Jeffrey Race

2 1

williams spamhaus blacklist
by Len Rose 25 Sep '03

25 Sep '03

gateway.wcg.com (65.77.117.10) is being blacklisted by the spamhaus service. Can someone at Williams Communications get this taken care of? Your mail server is being blocked by everyone who uses spamhaus and it's delaying important mail from your company to one of our customers.

13 17

Re: Verisign Responds
by Michael.Dillon＠radianz.com 25 Sep '03

25 Sep '03

>And the usual US-centric view... >Which congress person does Demon Netherlands, T-dialin, Wanadoo >France, Tiscali etc. go to? In the Netherlands, Germany, France, Italy and other countries people generally know who to go to to raise an issue with their governments. In some cases there is a direct equivalent of "your" elected representative unless the country uses proportional voting. In all cases, the ISP can contact their favorite political party and ask for advice and support in raising a complaint to the U.S. government who indirectly regulate Verisign through the Department of Commerce involvement in ICANN and IANA. It is especially important for ISPs outside the U.S.A. to also issue press releases to go along with their petition for government action because the publicity from the press release will often accomplish more than the petition itself. The goal should be to get your country's government to officially protest the U.S. government's support for Verisign's action in destabilising the Internet. When the number of protests reaches critical mass and are widespread enough, then the Department of Commerce will be forced to act. The failure of the DOC to act before this point forms an indirect support of Verisign's action by the U.S. government. --Michael Dillon

1 0

Re: Verisign Responds
by Michael.Dillon＠radianz.com 25 Sep '03

25 Sep '03

>> you are confused. and in any case this is off-topic. take it to namedroppers, >> but before you do, please read rfc's 1033, 1034, 1035, 2136, 2181, and 2317. >Can someone please tell me how a change to a critical component of the >Internet which has the capacity to cause harm is not an operational issue? He didn't say that. He said that there is a mailing list called "namedroppers" for discussion of DNS protocol changes and related DNS issues. And he also said that if you want to get very far with your proposal the list members would expect you to be familiar with the RFCs which document the existing DNS protocol. And even though he didn't say it, it is true that your proposal is not an operational issue. Now if somebody would actually code this new DNS protocol into a DNS server and a resolver (or some clients) then maybe it would become an operational issue. --Michael Dillon

1 0

Another DNS blacklist is taken down
by Justin Shore 25 Sep '03

25 Sep '03

I thought ya'll might be interested to hear that yet another DNS blacklist has been taken down out of fear of the DDoS attacks that took down Osirusoft, Monkeys.com, and the OpenRBL. Blackholes.compu.net suffered a joe-job earlier this week. Apparently the joe-jobbing was enough to convince some extremely ignorant mail admins that Compu.net is spamming and blocked mail from compu.net. Compu.net has also seen the effects of DDoS attacks on other DNS blacklist maintainers. They've decided that the risk to their actual business is too great and they are pulling the plug on their DNS blacklist before they come under the gun by spammers. http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3f70e839%2… Ron Guilmette, maintainer of the Monkeys.com blacklists has posted a farewell from Monkeys.com to news.admin.net-abuse.email. Ron cites the total lack of interest in the attacks by both big network providers and law enforcement authorities as the ultimate reason he's pulling the plug. http://groups.google.com/groups?q=%22Now+retired+from+spam+fighting%22&hl=e… It's truely a sad day for spam fighters everywhere. So, my question for NANOG is how does one go about attracting the attention of law enforcement when your network is under attack? How does the target of such an attack get a large network provider who's customers are part of the attack to pay attention? Is media attention the only way to pressure a response from either group? These DDoS attacks have received some attention in mainstream media: http://www.msnbc.com/news/959094.asp?0cv=TB10 http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b… Apparently it hasn't been enough. Legal remedies take too long and are cost prohibitive (unless you're the DoJ). Subpoenas and civil lawsuits take months if not years. Relief is needed in days if not hours. Justin

16 24

419 with a twist
by Stephen J. Wilcox 25 Sep '03

25 Sep '03

for amusement thought the list might like to see my latest 419 email with not a single african government official in sight. amused us all here anyhow, not seen anything like this before! the netblock is a nameless nigerian ISP inetnum: 81.199.82.0 - 81.199.83.255 netname: CIDR-COMMUNICATION-01 descr: Internet service provider country: NG ---------- Forwarded message ---------- Date: Tue, 23 Sep 2003 23:02:19 +0200 From: "CAPT TONY [LEADER]" <capttony(a)mail9.com> Reply-To: capt_tony2001(a)indiatimes.com Subject: US ARMY Dear Sir/Ma, We are teams of American coalition troops writing from Baghdad Iraq! We are urgently seeking for your willingness to secure the below consignments as shown in the attached photos! The goods were captured here in Baghdad, abandoned in one of the Saddam Hussein's Treasure House. However, the goods consist of Gold Bars, Gold coins and huge amount of fund in the sealed boxes! At this moment, we are intending to ship these goods outside Iraq for reasons of safekeeping on our behalf but due to law and restriction order, we are unable to transport the goods to AMERICA that is the reason why we are soliciting for your interest to assist us in receiving the goods on our behalf preferably in Europe. We are ready to meet to your demand on this basis with our intending 25% of the entire goods either in cash or in value. Therefore, we will appreciate your effort to reach back via email confirming your interest to assist us receive the consignment. As soon as we receive your positive reply, we shall furnish you with further details. Please, note, this issue must be handled with utmost confidentiality as to avoid publicity! Yours truly. Capt. STELLA .A (Team Leader)

2 1

workaround published for BIND8 and delegation-only
by Paul Vixie 25 Sep '03

25 Sep '03

so far, the BIND8 code itself has been resistant to this feature, but... see the current http://www.isc.org/products/BIND/delegation-only.html page.

1 0

Re: williams spamhaus blacklist
by Dr. Jeffrey Race 25 Sep '03

25 Sep '03

On Wed, 24 Sep 2003 20:01:48 -0400, Leo Bicknell wrote: >Blocking wcg's corporate mail servers is not the solution. It is the ONLY solution that works, as shown many times including the case just posted to this list about Sprint. >Sure, it may get >someone's attention at wcg, but it may also harm a lot of "innocent" >communications, sales talking to clients, other wiltel customers >requesting support, heck, the secretary ordering lunch to be >delivered. These people are also victims of bad corporate management and they should complain to their managers, not to their fellow victims. > >There are laws against spam. If you have evidence, sue in civil >court, or get a DA to go for it in criminal court. There are no presently enforceable laws for this kind of corporate abuse. The only thing that works is hitting the malafactors directly. Regarding BLs: no one forces anyone to use them. They are used because recipients don't want to get trash. Those with a quiet moment who want to see a novel, amusing and detailed ventilation of this issue may take a look at <http://www.camblab.com/nugget/spam_03.pdf> (some details dated) and <http://www.camblab.com/misc/univ_std.txt> (work in progress) I'd welcome any comments. Jeffrey Race

1 0

RE: what to do about joe-jobs?
by badkarma2＠canada.com 25 Sep '03

25 Sep '03

>Speaking of joe-jobs, what's the "proper" proceedure for >dealing with such? The company I work for is currently >undergoing an admitedly minor joe-job. (about 300 or so >bounces that I've seen since mid last week or so.) > >Any suggestions for dealing with this? What domains are you seeing the joe-jobs from? We see alot of joe jobbing attacks from the large webmail providers eg. yahoo.com, hotmail.com, aol.com, netscape.net, etc. A promising response that we've been following is Sender Permitted From http://spf.pobox.com . It's basically a reverse RBL. The owner of a domain identifies ip's that are allowed to send mail for that domain in a TXT DNS record. The rest are tagged with a wildcard deny or probably softdeny initially. If yahoo.com, hotmail.com etc alone just added the DNS records, we'd all be able to identify joe-jobbers of these domains. It won't help their own spam situation but it'd help our massive attacks of spoofed email. Spammers seem to use these big providers since blocking all of hotmail.com or yahoo.com is tough for other providers.

1 0

RE: williams spamhaus blacklist
by McBurnett, Jim 24 Sep '03

24 Sep '03

this is not without precedent.. Anyone from Cable and Wireless listening? If I remember correctly, Cable and Wireless was blocked last year or earlier this year by a similiar ploy. And I also seem to remember them making major complaints over on the SPAM-L list.. Later, J > -----Original Message----- > From: Leo Bicknell [mailto:bicknell@ufp.org] > Sent: Wednesday, September 24, 2003 6:30 PM > To: nanog(a)merit.edu > Subject: Re: williams spamhaus blacklist > > > In a message written on Wed, Sep 24, 2003 at 05:14:04PM > -0400, alex(a)pilosoft.com wrote: > > The moment they started blacklisting IPs that never sent spam. (AKA > > williams corporate mail servers). > > For those who care: > > http://www.spamhaus.org/sbl/sbl.lasso?query=SBL10731 > > I quote: > > ] WilTel Communications Group's Corporate Mail Relays > ] Continued hosting of Eddy Marin spam gang and others have > caused this > ] listing. Previous warnings and spam reports had no effect. > > So, they have decided since WilTil has one (alleged?) spammer > customer none of wiltel should be allowed to send or receive e-mail > anymore. > > The complete list of Williams issues is at: > > http://www.spamhaus.org/sbl/listings.lasso?isp=wcg > > As per usual, no amount of collateral damage is deemed unacceptable. > > -- > Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 > PGP keys at http://www.ufp.org/~bicknell/ > Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org >

1 0