- Test - lists.nanog.org

Re: Update on mail bombing threats--not so funny
by Vadim Antonov 09 Jan '97

09 Jan '97

Allan Chong <allan(a)bellsouth.net> wrote: >One possible solution is just to have recourse after the fact. >If you as an ISP have their credit card/phone billing, and have >a policy that explicitly states that either.... >Even despite the inevitable chargebacks, many spammers would decide that >fighting with the credit card company isn't worth it. How are you proposing collecting any debts from a spammer in Brazilia? BTW, to be able collect such charges you _must_ be able to prove that the spammer have seen the price list. That is kind of hard to do when you don't have spammer's return address. Implied contracts have been commonly found non-binding by the courts (a typical example would be to open a cafe, wait when people walk in and then tell them "our admission fee is $100 -- please pay up, or we call police"). --vadim

1 0

Re: Update on mail bombing threats--not so funny
by Paul Ferguson 09 Jan '97

09 Jan '97

At 01:19 PM 1/9/97 -0800, Vadim Antonov wrote: > >The solution is source address filtering at edges, to relieve attackers >from the benefit of forged source addresses, and reverse lookup Yet another application for draft-ferguson-ingress-filtering-01.txt. :-) - paul >authentication in MTAs -- just do not accept any mail coming from an >invalid source address, or source address not corresponding to what >is in Sender, Reply-To or From field. >

1 0

NANOG Meeting Attendee List
by Pam Ciesla 09 Jan '97

09 Jan '97

Is available on the NANOG web page. If you are not on the list and should be please contact me. If you registered this afternoon it is possible your name was not added to the list and will be added the next time the list is updated. Alan Koenigsberg & Brian Tackett will be added at a later time. Pam Ciesla

1 0

Re: Domain names for ISP infrastructure links
by Vadim Antonov 09 Jan '97

09 Jan '97

>> That may sound silly, but there's a merit in the >> idea that domain names can successfully replace the >> SNMP's object IDs. SNMP and DNS then become the same >> protocol. >Cool. I can now dream of a day when nslookup for a router returns something >lovely like: >1.3.6.1.2.1.11 >-dorian ;) Nah, that's when your network monitor sends query for an integer number RR to in-bytes.0.0.ethernet.interface.cisco0.san-jose.halter.net and when you type "mail postmaster(a)halter.net" you generate request to postmaster.mail.halter.net when you do "netscape http://halter.net/funpages-dir/funpage.html" then mozilla version 100219382973.117 retrieves html.funpage.funpages-dir.http.halter.net and when you do "cat //rodan.halter.net/mnt1/ftp/pub/junk/README" some global NFS opens file at README.junk.pub.ftp.mnt1.nfs.rodan.halter.net and when your command is "telnet rodan.halter.net" the DNS will get to login.rodan.halter.net. Note that all names are constructed using the simple rule: <application-specific part>.<service name>.<host name>.<domain> --vadim

5 5

Re: Spammer's Spotlite #1 (fwd)
by Cameo Wood 09 Jan '97

09 Jan '97

---------- Forwarded message ---------- Date: Thu, 09 Jan 1997 00:08:15 -0500 From: "Jeremy J. Olson" <olson(a)ici.net> Newsgroups: alt.ascii-art Subject: Re: Spammer's Spotlite #1 } >>Subject: Spammer's Spotlite #1 } >>From: Christopher Fenn <eyebeam(a)earthlink.net> } >>Date: Fri, 03 Jan 1997 18:45:38 +0100 } >> } >>First in a series! Collect them all! [snipping for brevity] } Unfortunately this spam was a forgery done for revenge by the real } spammer and the responses have caused Joe Doll to close his site. } } Be very careful of these inflammatory spams they are often forgeries } intended to cause real trouble for the person being forged. See: alt.lets.kill.yuri.rutman I recently saw this new NG pop up and posted asking who Yuri Rutman is. Someone wrote back saying he was the forger of the Joes.com (and another minoxidil <sp?> spam). Jeremy J. Olson <olson(a)ici.net> \ / http://www.ici.net/cust_pages/olson/olson.html U /O\ Mors ad Spammers!

1 0

Update on mail bombing threats--words fail me--enjoy the laugh
by Howard C. Berkowitz 09 Jan '97

09 Jan '97

I posted recently about a recent mailbombing threat apparently originating from Cyberpromo. Many of you may have received this, but I must share it for those who haven't seen it...the specter of Cyberpromo being victimized by Nasty Evil Spammers had me laughing so hard tears ran down my face and my ribs hurt. Howard ------ Received: from cyber3.7.nostoppingittop (daemon(a)[206.154.151.19]) by mail.clark.net (8.7.3/8.6.5) with ESMTP id UAA24805 for <hcb(a)clark.net>; Mon, 6 Jan 1997 20:51:28 -0500 (EST) Received: (from daemon@localhost) by cyber3.7.nostoppingittop (8.7.4/8.7.3) id UAA05715; Mon, 6 Jan 1997 20:53:44 -0500 (EST) Date: Mon, 6 Jan 1997 20:53:44 -0500 (EST) Message-Id: <199701070153.UAA05715(a)cyber3.7.nostoppingittop> From: abusebot(a)savetrees.com (Mail AutoResponder) To: "howard c. berkowitz" <hcb(a)clark.net> Subject: RESPONSE FROM CYBERPROMO Version 1-4-97: Cyber Promotions has recently terminated several accounts for abuse of our policies. (Updated TOS at end of message). Cyber Promotions will not tolerate irresponsible commercial email activities. The following email accounts have been *recently TERMINATED... *noci(a)cyberpromo.com 1-4-97: Spamming with THREATS! jrtkjs(a)savetrees.com 10-9-96: Forgery and spamming INTERNET jrtkjs(a)answerme.com "" "" "" "" "" "" dollars(a)savetrees.com Non-existant account. The account was forged by the people who opened the accounts above. info1(a)cyberpromo.com 10-8-96: Unsolicited ads to INTERNET addresses changes(a)answerme.com 9-30-96: Unsolicited ads to INTERNET addresses changes(a)cyberpromo.com 9-30-96: Unsolicited ads to INTERNET addresses changes(a)savetrees.com 9-30-96: Unsolicited ads to INTERNET addresses catalog(a)savetrees.com 9-30-96: Unsolicited ads to INTERNET addresses catalog(a)cyberpromo.com 9-30-96: Unsolicited ads to INTERNET addresses catalog(a)answerme.com 9-30-96: Unsolicited ads to INTERNET addresses eleven(a)answerme.com 9-28-96: Forgeries eleven(a)savetrees.com 9-28-96: Forgeries eleven(a)answerme.com 9-28-96: Forgeries tsahk(a)cyberpromo.com 9-27-96: Unsolicited ads to INTERNET addresses tsahk(a)answerme.com 9-27-96: Unsolicited ads to INTERNET addresses icssender(a)omni.cyberpromo.com 9-19-96: FORGED unsolicited email, making it appear that Cyberpromo's auto-sender was responsible. If you are in receipt of the message, please look through the headers and complain to the appropriate postmasters. networkes(a)answerme.com 9-17-96: Ignored remove requests networkes(a)cyberpromo.com 9-17-96: Ignored remove requests networkes(a)savetrees.com 9-17-96: Ignored remove requests reminders(a)answerme.com 9-17-96: Unsolicited ads to INTERNET addresses reminders(a)savetrees.com 9-17-96: Unsolicited ads to INTERNET addresses reminders(a)cyberpromo.com 9-17-96: Unsolicited ads to INTERNET addresses salespromo(a)answerme.com 9-16-96: Unsolicited ads to INTERNET addresses salespromo(a)savetrees.com "" "" "" "" salespromo(a)cyberpromo.com "" "" "" "" promo(a)answerme.com "" "" "" "" promo(a)savetrees.com "" "" "" "" promo(a)cyberpromo.com "" "" "" "" info4free(a)answerme.com "" "" "" "" info4free(a)savetrees.com "" "" "" "" info4free(a)cyberpromo.com "" "" "" "" manda(a)cyberpromo.com 8-28: Massive abuse to INTERNET addresses / FORGERY manda(a)answerme.com 8-28: Massive abuse to INTERNET addresses / FORGERY website(a)cyberpromo.com 8-27: excessive abuse to AOL / removals ignored sevenmil(a)cyberpromo.com 8-27: excessive abuse / all removals ignored sevenmil(a)answerme.com 8-27: "" "" "" "" "" "" vera(a)cyberpromo.com vera(a)answerme.com zol(a)answerme.com website(a)answerme.com allied(a)cyberpromo.com allied(a)answerme.com lists(a)cyberpromo.com lists(a)answerme.com Cyber Promotions is *not* in business to annoy people. We are in the business of sending (and assisting in sending) commercial (and noncommercial) email to people who are *not* offended by the receipt of these messages. Unfortunately, due to many experiences (many of which were out of our control) we have had some problems accomplishing our goals without upsetting some people. We are truly sorry about that fact, and we plan to "clean up the streets" as best as we can. Some people have been under the impression that all email that appears to come from cyberpromo.com, is from Cyber Promotions. That is not true. Most of the complaints that we have recently received have been in reaction to people who have "autoresponders" and "virtual email addresses" on our system. In that case, their mail would have referenced an account on our system, but originated from a different site. Unfortunately, software like Pegasus enables their mail to appear as if it came from us, directly. But, their true origination is still evident in the headers. You can determine where it originated if you know how to decode headers. But when doing so, remember that Pegasus, for example, actually logs into *our* sendmail. At this time, the only messages that originate from Cyber Promotions, use our proprietary Cyber Sender 5.0+ protocol which will always be indicated in the organization: header. Due to these "look alikes," it could appear that recipients' remove request were being ignored. WE DO NOT IGNORE REMOVE REQUESTS. Please note: we have no control over mail that originates from other sites, that travel through our SMTP (relay-host) servers. We will simply terminate any accounts that we maintain, that is referred to in their abusive mail. ATTENTION PRODIGY MEMBERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type both of your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. You probably have one address like xazd35r(a)prodigy.com and another address like sanford(a)prodigy.com. ATTENTION PIPELINE MEMBERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. You should type your email id followed by the following THREE domains. @usa.pipeline.com, @pipeline.com, @nyc.pipeline.com. Even if you feel that your address is definately only one of the three possibilities, you should still remove all three addresses (each on its own line). ATTENTION INTERNET USERS: It has come to Cyber Promotions' attention, that some of you are having a major problem removing yourselves from our lists. This can be attributed to the "alias" that your outgoing mail may contain. If you are having problems, please send an email to manremove(a)cyberpromo.com and type your email addresses in the body of the message, each on its own line, without any comments. The subject line is ignored. If your email address could contain an alias like mail.domain.com or if you may have more that one email address that points to another email address, you should remove them all. If you wish to remove *every* email address in your domain, please contact us, and we will "grep" out every possibility. REVISED TERMS OF SERVICE: 1. We do not allow postings to inappropriate newsgroups with reference to your account because such postings result in *MUCH* more negative response than positive. 2. We prohibit the advertising of offensive material (ie. pornography, weapons, etc). 3. You may not use the account to participate in illegal activities. 4. Our TOS strictly prohibits the sending of mass commercial emails to INTERNET addresses, unless expressed permission has been granted to you by the recipient. In addition, you *must* honor all requests for removal from your mailing list in a diligent manner. Our service can be used in conjunction with advertisements that you place with a bulk email company other than your own or us, as long as they follow the same guidelines. 5. Cyber Promotions reserves the right to terminate any account for any reason at any time, without notice.

2 1

APRICOT '97
by David R. Conrad 09 Jan '97

09 Jan '97

Apologies for duplicates and possible inappropriate-ness, however this is just to remind those people outside the AP region who are coming to APRICOT that the rooms blocked out for the conference are released TOMORROW. If you haven't registered and would like to attend, please do so ASAP. See http://www.apricot.net for details. Regards, -drc

1 0

Re: Domain names for ISP infrastructure links
by Peter Lothberg 09 Jan '97

09 Jan '97

> 4. Are people actually interested in pursuing this formally? If a spec was > written would you change your DNS names to conform? I belong in the group of people that need to change domain names for router interfaces, (and we have already been flamed, thankyou), so that's why I brought up the issue on how to name interfaces, so when chaninging, we don't do something else that is viewed wrong. > Would you be willing > to set up a formal registration process with the IANA for 2(or 3) letter > pop codes to be consistant? Hello mr US centric.. Airports are three or four letters and they are not globally unique. --Peter

1 0

Re: Domain names for ISP infrastructure links
by John Curran 08 Jan '97

08 Jan '97

At 17:25 1/7/97, John W. Stewart III wrote: >conventions are fine > >and it's helpful to users and operators alike for names to >contain a fair amount of information > >but "standardizing" with fixed-width fields, pop codes, >next-hop router, etc. doesn't seem that productive when >providers are gonna do what they want anyway. No... we're going to mandate OID-style router names for the world's Internet providers: <isoc-tree>.<internet-infrastructure branch>. <iso country code>.<city ordinal>.<provider #>. <facility #>.<rack #>.<shelf #>.<router ordinal> Great fun to watch (it could be happening this way in the alternate universe next door.) ;-) /John

6 5

RE: Agenda items for February
by Paul Ferguson 08 Jan '97

08 Jan '97

At 11:03 AM 1/8/97 -0600, Chris A. Icide wrote: >Would anyone be interested in a short discussion on something like >"Properties of an improved routing protocol"? > This type of discussion would be better served taking place within the IETF, not NANOG. $.02, - paul >My thought here is just a short discussion (Round Table) that might >throw proposed ideas for an improved routing protocol. > >For example: > > Supports policy based routing (BGP stuff) > supports server - server and server - client modes > supports link quality, delay, reliability, etc > supports QOS > >etc., etc., > >Chris A. Icide >Nap.Net, L.L.C. >

2 1