- Test - lists.nanog.org

Kaiwan.com a SPAM Source?
by Chris A. Icide 18 Nov '97

18 Nov '97

*WARNING* Configuration of your router with the following file may cause multiple configuration errors. Do not configure your router with the following information. Recently today, Nap.Net's coprorate mail exhanger (does not support relaying) was e-mail bombed. Upon tracking this down, we found that the attack was sourcing from kaiwan.com. Our NOC contacted thier contact per InterNIC database, and asked them about the attack, thinking it might have been relayed through them or such. However, the nice gentleman on the phone (read irony into that please) said that that in fact was not the case. The had a script that when it identifies SPAM, it parses the header, retrieves the path of the spam, gets the contact info from the InterNIC database, and then sends multiple emails out to the path of the SPAM for each one received. An automated Denial of Service attack. How nice. Kaiwan.com has been completely uncooperative. Nap.Net has a strict AUP, and has agressively addressed any SPAM complaints addressed against any of it's downstream customers. However, unfortunately a customer must SPAM at least once before we can identify such SPAM. Automated scripts like this are of no help, and in fact possibly cause more harm than help. Just an FYI, it was either steam here, or add a network statement to my BGP config that contains more specific routes of kaiwan.com. This seemed a little less drastic. Chris A. Icide ---------------------------------------------------------------------- Chris A. Icide Genuity, Inc. / Nap.Net, L.L.C. Sr. Network Engineer 4041 North Central Ave. Suite 400 602-207-6409 Phoenix, AZ 85012 - Notice: NVRAM invalid, possibly due to write erase. Press RETURN to get started! - PGP Keys located at pgpkeys.mit.edu or http://nap.net/~chris/keys.html ----------------------------------------------------------------------

2 1

Re: Oooops
by Gerald Andrew Winters 18 Nov '97

18 Nov '97

Hello Richard, If there is a problem we can take care of we'd like to know about it. Can you give us a little more info? What did you notice? --Gerald (Merit) > From: Richard Irving <rirving(a)onecall.net> > > Those who use the RA may want to check the routes............ > You may not be going where you think you are right now.....

1 0

Oooops
by Richard Irving 18 Nov '97

18 Nov '97

Those who use the RA may want to check the routes............ You may not be going where you think you are right now..... Richard

1 0

General spam issues
by Phil Lawlor 18 Nov '97

18 Nov '97

Nanog is probably not the right forum to discuss spam generally. Please take issues to nana.e or the spam-l list. Correct me if I am wrong. Phil Lawlor President AGIS Voice - 313-730-1130 Fax - 313-563-6119

1 0

.DE Zone corrupted !!!!
by Winfried Haug 18 Nov '97

18 Nov '97

Hello together, the Root Server for the germany TLD .DE (ns.nic.de) seems to be corrupted. No queries for .DE Domains are answered. Only domains for which ns.nic.de is secondary are currently available. I just called the supervisor engineer from the DENIC and they are just on the way to solve the problem :_) So it is just a question of hours... Winfried Winfried Haug | SEICOM.DE & SCHWABEN.DE | Tel. 07121 9770- 0 Laiblinsplatz 12 | Internet+ISDN access & consulting | Fax. 07121 9770-19 72793 Pfullingen | Access in STGT + RT + TUE + BB + LB | Rack 07127 989-X haug(a)schwaben.net| 150*ISDN (64kb/X.75) / 100 * K56flex | Rack 0711 9675-X haug(a)seicom.net |SAP-OSS * FTP * TELNET * NETNEWS * IRC | Rack 07121 709-X * 4 MBit DE-CIX * 2 MBit INXS * 1 MBit Ebone * 2 Mbit Belwue * 0 Mbit WIN German ISP will shut down their WIN-Links. Visit www.decix.de/winpresse.html

1 0

triplets...
by Marc Hurst 18 Nov '97

18 Nov '97

Is anyone else getting multiple copies of the same message? Its kinda annoying.... M>:/

4 3

Re:hmm -- Get a load of this. Fwd'd
by James D. Butt 18 Nov '97

18 Nov '97

>From nanog(a)merit.edu Mon Nov 17 18:30:54 1997 >Received: from www.RVC.CC.IL.US (www.RVC.CC.IL.US [207.142.145.2]) by mozart.lib.uchicago.edu (8.8.5/8.6.4) with SMTP id SAA21563 for <marilyn-request(a)mozart.lib.uchicago.edu>; Mon, 17 Nov 1997 18:30:54 -0600 >Received: from merit.edu (166.72.5.121) by www.RVC.CC.IL.US > (EMWAC SMTPRS 0.81) with SMTP id <B0000000018(a)www.RVC.CC.IL.US>; > Mon, 17 Nov 1997 18:44:02 -0600 >Date: Mon, 17 Nov 1997 18:44:02 -0600 >Message-ID: <B0000000018(a)www.RVC.CC.IL.US> >From: NANOG Mailing List <nanog(a)merit.edu> >Subject: subscribe In looking at this message that someone forwarded me.. It looks like the message originated at one of our customers web servers.. I have called and left messages for the sysadmins of this school.. We do not have any after hours numbers. Does anyone else have the bounces with headers so that I can verify or not that it is this customer? I will say that it is sorta ironic that I started this thread and it seems to be originating from one of our customers... :-( -------------------------------------------------------------------------- James D. Butt 'J.D.' Network Engineer Voice 319-557-8463 Network Operations Center Fax 319-557-9771 MidWest Communications, Inc. Pager 319-557-6347 241 Main St. noc(a)mwci.net Dubuque, IA 52001 jbutt(a)mwci.net --------------------------------------------------------------------------

4 4

Agis - Still Spam Central
by Reid Fishler 18 Nov '97

18 Nov '97

>From Harris-Marketing's Home page: In our efforts to make commercial email a viable alternative to offline advertising and more socially acceptable, we've taken pains to design and implement our own system, which does not require that each advertiser download and implement the removes on an individual basis, but is a resident feature within the Savoynet servers that prevents the sending of any email to your email address once it has been added to the filter... Any and all UCE (unsolicited commercial email) will be routed through the Harris Marketing Inc/Savoynet.com filtration system. >From Agis's AUP: Customers may not send unsolicited bulk mail messages ("junk mail" or "spam") to any person who does not wish to receive it. If a recipient asks to stop receiving email the customer must not send that person any further email. >From Agis's AUP Action Page: Harris Marketing aka Savoynet - 11/11/97 - Warning Also, 'Investigation numbers': ST-1007, ST-1011, ST-1014, ST-1015, ST-1016, and ST-1021 are all on this one customer of Agis. So my question is, what does it take for Agis to Implement it's AUP? It seems to me that the AUP was more of a PR move rather than an actual policy, and the proof of that is on Agis's on web site. Reid Fishler Lightning Internet Services, LLC

1 0

AOL reporting problems
by Rodney Joffe 18 Nov '97

18 Nov '97

FYI http://www.news.com/News/Alerts/0,34,11031,00.html#2briefz2 Rodney Joffe Chief Technology Officer Genuity Inc., a Bechtel company http://www.genuity.net

1 0

Re:ns4.internic.net was returning false aa nxdomain
by David H. Holtzman 18 Nov '97

18 Nov '97

We've fixed the problem. We are now in the process of determining why this happened. David H. Holtzman Sr VP Engineering, Network Solutions dholtz(a)internic.net

1 0