- Test - lists.nanog.org

Tis the season to be cracking ...
by Roeland Meyer 10 Aug '01

10 Aug '01

Not only do we have SirCam and CodeRed, but just tday I started getting a bunch of [what looks like spam] email virii. They're all hitting my filters, but I thought y'all might have noticed similar things. This is two weeks before many Universitys open for business. That's right about the time I drop my EDU filters in place [having kids keeps you aware of these things]. I haven't seen this reported yet. It looks like we have a whole flock of wannabe virus writers out there this year. I'd block EDU permanently, but too many ICANN folks are on EDU addresses. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company t:01 925 373 3954 c:01 925 352 3615 f:01 925 373 9781

3 3

NetSol takes over .us TLD and does this
by up＠3.am 10 Aug '01

10 Aug '01

I thought this might be of interest: The whois for .us had been working a few weeks ago, but hadn't been since then. I dropped an email to action(a)isi.edu (who had been hosting the whois server until a few weeks ago) and cc'd usdomreg(a)nic.us and got the following responses: Date: Wed, 08 Aug 2001 12:21:22 -0700 From: IPC Computing Services <action(a)ISI.EDU> To: James Smallacombe <james(a)pil.net> Cc: action(a)ISI.EDU, action-team(a)ISI.EDU Subject: Re: {2001.08.445} .us TLD whois not in DNS > http://www.nic.us/register/whois.html > > Instructs one to use whois.isi.edu > > for whois queries on the .us TLD. It's not in DNS: > > [richard namedb james]$ traceroute whois.isi.edu > traceroute: unknown host whois.isi.edu > > Could you please look into this and let me know if either the website > is wrong or this will be fixed? At the request of the US Department of Commerce, USC/ISI transitioned all support for the US Domain to Verisign at the end of 2000. We appologize that the Verisign supported web site still points to USC/ISI resources but we have no control over their publication of data. IPC Computing Services ------- 31 hours later from the new registrar (Verisign): Date: Thu, 09 Aug 2001 19:27:10 -0400 From: US domreg <usdomreg(a)nic.us> To: James Smallacombe <james(a)pil.net> Cc: usreply(a)nic.us Subject: Re: .us TLD whois not in DNS Dear James, Thank you for contacting the US Domain Registry. The whois database was run by ISI until recently. The whois server has now been taken offline and so there is no .us whois server currently. We are currently working on a replacement but there is no estimate on how long that will take. In the meantime, if there are specific domains you wish to have information on, please email them to us and we will manually find the information for you. Regards, US Domain Registry www.nic.us usdomreg(a)nic.us =============================================================================== ok, so .us isn't very widely used, but why then, did the DOC give it to Verisign? James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

4 3

Re: Code Red 2 cleanup; reporting..
by David Luyer 10 Aug '01

10 Aug '01

On 10 Aug 2001 03:47:38 -0400, ken harris. wrote: > i haven't given this a whirl myself, but i came across > it and thought i'd at least share. > > "Code Red Autoresponder" : > < http://www.klippan.seths.se/default.phps > Dodgy whois lookup (and that's a redhat-ism too on the whois). You'd end up sending a heap of junk to bitbucket(a)ripe.net. >From the script: /* Get a whois output from whois.ripe.net */ @exec("/usr/bin/whois $ip(a)whois.ripe.net",$whois,$status); You need to consult ARIN and recurse to APNIC, RIPE, etc. One of the APNIC guys was complaining on aussie-isp about all the "your host has CodeRed" messages received by APNIC rather than people doing proper recursive lookups. David.

1 0

too late for the Oakland mtg....
by bmanning＠vacation.karoshi.com 10 Aug '01

10 Aug '01

http://www.srl.org --bill

1 0

Re: Code Red 2 cleanup; reporting..
by ken harris. 10 Aug '01

10 Aug '01

> If nothing is in place, great, I'll just throw e-mails to the > end-users I can find and/or their respective NSP. If something is > in place.. either unofficial or special contacts at the NSPs, great, I'll > go that route. i haven't given this a whirl myself, but i came across it and thought i'd at least share. "Code Red Autoresponder" : < http://www.klippan.seths.se/default.phps > -ken harris (i promised i wouldn't add to the cr noise. woops.)

1 0

Code Red 2 cleanup; reporting..
by z＠s0be.net 10 Aug '01

10 Aug '01

Helu, Is there an effort abound that would allow for lists of verified 'Code Red 2' infected hosts to be reported for cleanup/mitigation? By known 'Code Red 2' infected hosts, I mean that root.exe has been found to exist on the host. Finding the contact information for a lot of these is proving difficult being that a fair amount of the infected machines are Joe Blow broadband customers. Anyone? .z

9 11

RE: NetSol takes over .us TLD and does this
by Roeland Meyer 10 Aug '01

10 Aug '01

Duh! You haven't been keeping up. ICANN/DNSO/GA knew about this *months* ago. In fact, there is an RFP out for managing US. There's problems with the contract though, so there aren't many bidders. US is a royal mess that many don't want to touch. > -----Original Message----- > From: up(a)3.am [mailto:up@3.am] > Sent: Thursday, August 09, 2001 5:41 PM > To: nanog(a)merit.edu > Subject: NetSol takes over .us TLD and does this > > > > > I thought this might be of interest: > > The whois for .us had been working a few weeks ago, but > hadn't been since > then. I dropped an email to action(a)isi.edu (who had been hosting the > whois server until a few weeks ago) and cc'd usdomreg(a)nic.us > and got the > following responses: > > Date: Wed, 08 Aug 2001 12:21:22 -0700 > From: IPC Computing Services <action(a)ISI.EDU> > To: James Smallacombe <james(a)pil.net> > Cc: action(a)ISI.EDU, action-team(a)ISI.EDU > Subject: Re: {2001.08.445} .us TLD whois not in DNS > > > > http://www.nic.us/register/whois.html > > > > Instructs one to use whois.isi.edu > > > > for whois queries on the .us TLD. It's not in DNS: > > > > [richard namedb james]$ traceroute whois.isi.edu > > traceroute: unknown host whois.isi.edu > > > > Could you please look into this and let me know if either > the website > > is wrong or this will be fixed? > > > At the request of the US Department of Commerce, USC/ISI transitioned > all support for the US Domain to Verisign at the end of 2000. We > appologize that the Verisign supported web site still points to > USC/ISI resources but we have no control over their publication of > data. > > IPC Computing Services > > ------- > 31 hours later from the new registrar (Verisign): > > Date: Thu, 09 Aug 2001 19:27:10 -0400 > From: US domreg <usdomreg(a)nic.us> > To: James Smallacombe <james(a)pil.net> > Cc: usreply(a)nic.us > Subject: Re: .us TLD whois not in DNS > > > Dear James, > > Thank you for contacting the US Domain Registry. > > The whois database was run by ISI until recently. The whois > server has > now > been taken offline and so there is no .us whois server > currently. We are > currently working on a replacement but there is no estimate > on how long > that > will take. In the meantime, if there are specific domains you wish to > have > information on, please email them to us and we will manually find the > information for you. > > Regards, > > US Domain Registry > www.nic.us > usdomreg(a)nic.us > > ============================================================== > ================= > > > ok, so .us isn't very widely used, but why then, did the DOC > give it to > Verisign? > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am http://3.am =========================================================================

3 2

Netrail files Chap 11
by Craig Klingler 10 Aug '01

10 Aug '01

Unfortunate for the many fine people at Netrail http://atlanta.bcentral.com/atlanta/stories/2001/08/06/daily59.html

2 1

Re: Strange trace to netsol...
by John Fraizer 10 Aug '01

10 Aug '01

Just in case anyone felt like telling me to contact Winstar directly, they don't have an entry at puck.nether.net and email addresses to noc(a)winstar.net bounces. (Was the NOC the first thing to get the AXE as part of the Ch 11 restructure?) --- John Fraizer EnterZone, Inc ---------- Forwarded message ---------- Date: Thu, 9 Aug 2001 18:13:10 -0700 From: Mail Delivery Subsystem <MAILER-DAEMON(a)winstar.net> To: nanog(a)Overkill.EnterZone.Net Subject: Returned mail: User unknown The original message was received at Thu, 9 Aug 2001 18:13:08 -0700 from mail.winstar.net [207.98.129.30] ----- The following addresses had permanent fatal errors ----- \jbuskirk (expanded from: <support(a)noc.seattle.winstar.net>) \mlanham (expanded from: <support(a)noc.seattle.winstar.net>) \mguled (expanded from: <support(a)noc.seattle.winstar.net>) \noc (expanded from: <support(a)noc.seattle.winstar.net>) ----- Transcript of session follows ----- 550 \jbuskirk... User unknown 550 \mlanham... User unknown 550 \mguled... User unknown 550 \noc... User unknown

2 1

Re: Strange trace to netsol...
by John Fraizer 10 Aug '01

10 Aug '01

Just as expected. It appears that it was a typo on someones part while configuring a ptp link. Notice that hop #2 no longer uses a UUnet address. Strange that the person who built the ptp circuit didn't catch it. 1 1.ATM6-0.CMH-0.WINSTAR.NET (209.140.29.9) [AS 5696] 0 msec 0 msec 4 msec 2 69.winstar.net (65.36.1.69) [AS 5696] 16 msec 16 msec 20 msec 3 pos2-0.wdc1-bb1.winstar.net (216.172.247.117) [AS 5696] 24 msec 24 msec 24 msec 4 7.atm8-0.vienna-0.winstar.net (65.36.0.130) [AS 5696] 24 msec 24 msec 24 msec 5 internic-goodnet.internic.net (209.54.51.90) [AS 5696] 28 msec 28 msec 24 msec 6 www.netsol.com (216.168.224.111) [AS 6245] 24 msec 28 msec 28 msec --- John Fraizer EnterZone, Inc On Thu, 9 Aug 2001, John Fraizer wrote: > Did someone at WINSTAR typo an address on a ptp link? > > > 1 1.ATM6-0.CMH-0.WINSTAR.NET (209.140.29.9) [AS 5696] 4 msec 0 msec 4 msec > 2 4Cust5.tnt36.lax3.da.uu.net (63.36.1.69) [AS 701] 20 msec 20 msec 16 msec > 3 pos2-0.wdc1-bb1.winstar.net (216.172.247.117) [AS 5696] 20 msec 24 msec 24 msec > 4 7.atm8-0.vienna-0.winstar.net (65.36.0.130) [AS 5696] 24 msec 24 msec 24 msec > 5 internic-goodnet.internic.net (209.54.51.90) [AS 5696] 24 msec 28 msec 28 msec > 6 www.netsol.com (216.168.224.111) [AS 6245] 28 msec 28 msec 28 msec > > --- > John Fraizer > EnterZone, Inc

1 0