- Test - lists.nanog.org

BKA Wiesbaden - Abteilung Cybercrime (Not sure if this is a phishing E-mail or real...)
by Glen A. Pearce 26 Apr '23

26 Apr '23

Hi All: I received an E-mail with an attachment claiming something on my network is infected and that I should look at the attachment to find out what. Normally I think everything with an attachment is phishing to get me to run malware but: #1: The sites linked to in it seem to be legit German government websites based on Wikipedia entries that haven't changed in several years. (Looked at archive.org) #2: The attachment is a .txt file which I've normally assumed to be safe. #3: None of the usual dead giveaways that most phishing E-mails have. If it is a phishing E-mail it has got to be the cleverest one I've ever seen, though someone would try to be cleaver considering the target would be holders of IP blocks. I right clicked and checked properties to make sure the attached ip_addresses.txt file really is a text file and not some fancy trickery with reverse direction characters ( As seen on https://www.youtube.com/watch?v=ieQUy8YTbFU ) I tried poking around to see if there was some vulnerability in notepad (or some versions of it) that I didn't know about and only found a vulnerability in the text editor on Macs but nothing with Windows Notepad. The other thing I felt was a bit off is that the originating mail server is in Deutsche Telekom AG space and not IP Space registered to the German government. I'm thinking someone could rent some IP space from Deutsche Telekom AG with a connection to them in a data center and get the DNS delegated to them so they could set the reverse DNS to whatever they want. A lot of effort to try to look legit by coming out of Germany and having a government domain in the reverse DNS to look like a plausible legit outsourcing but again Network operators are the target audience so the normal tricks that work on the general public won't work with this group so I can see someone going that far. I'll attach the E-mail below with all headers. Has anyone else gotten these? Is there some security risk opening it in Windows Notepad that I don't know about or is it actually safe to open this? Return-Path: <abuse(a)cyber.bka.de> Delivered-To: [REDACTED] Received: from ezp08-pco.easydns.vpn ([10.5.10.148]) by ezb03-pco.easydns.vpn with LMTP id oCfeBO/yEmTokhgAzaFxkQ (envelope-from <abuse(a)cyber.bka.de>) for <[REDACTED]>; Thu, 16 Mar 2023 10:43:59 +0000 Received: from smtp.easymail.ca ([127.0.0.1]) by ezp08-pco.easydns.vpn with LMTP id WCB5BO/yEmSHdgEABcrfzg (envelope-from <abuse(a)cyber.bka.de>); Thu, 16 Mar 2023 10:43:59 +0000 Received: from localhost (localhost [127.0.0.1]) by smtp.easymail.ca (Postfix) with ESMTP id 0DC85557DF for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:59 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at ezp08-pco.easydns.vpn X-Spam-Flag: NO X-Spam-Score: 0.075 X-Spam-Level: X-Spam-Status: No, score=0.075 required=4 tests=[BAYES_00=-1.9, DEAR_SOMETHING=1.973, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from smtp.easymail.ca ([127.0.0.1]) by localhost (ezp08-pco.easydns.vpn [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d0XbPteZN-Io for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:55 +0000 (UTC) Received: from mail.cyber.bka.de (mail.cyber.bka.de [80.146.190.22]) by smtp.easymail.ca (Postfix) with ESMTPS id 0BC0C557DC for <arin(a)ve4.ca>; Thu, 16 Mar 2023 10:43:54 +0000 (UTC) Date: Thu, 16 Mar 2023 10:43:53 +0000 To: arin(a)ve4.ca From: BKA Wiesbaden - Abteilung Cybercrime <abuse(a)cyber.bka.de> Reply-To: BKA Wiesbaden - Abteilung Cybercrime <abuse(a)cyber.bka.de> Subject: Information regarding possible infection with malware Message-ID: <M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA(a)emailapi.apps.cc.bka> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="b1_M47LJRZpjy1zymUJDKsNtrYm3RimkafZfZTqeZpauZA" Content-Transfer-Encoding: 8bit Dear Sir or Madam, As part of criminal proceedings, the German Federal Criminal Police Office (Bundeskriminalamt) has been informed about public IP addresses and timestamps which indicate a potential infection by the malicious software "Bumblebee" of one or more systems behind the respective public IP address. Within this letter, the BKA is providing you with the data of the respective IP addresses which have been assigned to you as the appropriate provider. You are asked to take appropriate measures to inform your customers about the potential infection. The following information will be provided: 1. Public IP address 2. Last known timestamp of contact by the public IP address 3. Possible system name or username on the potentially infected system The following information may be sent to your customers in addition to the message of concern. What should you do now? 1. Donâ€™t panic! 2. Check your systems/networks for possible infections. If other institutions have already made you aware of infected systems recently, follow the action guidelines which you may have received from them. 3. For further information on cleaning up infections, please visit the English website of the Federal Office for Information Security (BSI): https://www.bsi.bund.de/EN/Themen/Verbraucherinnen-und-Verbraucher/Informat… Yours sincerely, Bundeskriminalamt Wiesbaden -- Glen A. Pearce gap(a)ve4.ca Network Manager, Webmaster, Bookkeeper, Fashion Model and Shipping Clerk. Very Eager 4 Tees http://www.ve4.ca ARIN Handle VET-17

7 8

UltraDNS contact
by Matthew Crocker 26 Apr '23

26 Apr '23

Can anyone from UltraDNS contact me off list please? I have some security issues I’d like to discuss with you. Thanks -Matt

1 0

OARC 41- Call for Contributions
by John Todd 26 Apr '23

26 Apr '23

OARC 41 will be a two-day hybrid meeting and the tentative dates are 6th-7th September to be co-located with ICANN DNS Symposium in Asia. The Programme Committee is seeking contributions from the community. All DNS-related subjects and suggestions for discussion topics are welcome. For inspiration, we provide a non-exhaustive list of ideas: * Operations: Any operational gotchas, lessons learned from an outage, details/reasons for a recent outage (how to improve TTR, tooling) * Deployment: DNS config management and release process.Monitoring: Log ingestion pipeline, analytics infrastructure, anomaly detection * Scaling: DNS performance management and metrics. Increasing DNS Server Efficiency * Security/Privacy: DNSSEC signing and validation, key storage, rollovers, qname minimization, DoH/DoT The presentations can be either a full-length presentation - 20 mins (+5 mins Q/A) or a lightning presentation - 10 mins (+5 mins for Q/A) Workshop Milestones: 2023-04-16 Submissions open via Indico 2023-06-10 Deadline for submission (23:59 UTC) 2023-06-27 Preliminary list of contributions published 2023-07-11 Full agenda published 2023-08-08 Deadline for slideset submission and Rehearsal 2023-09-06 OARC 41 Workshop - Day1 2023-09-07 OARC 41 Workshop - Day2 The Registration page and details for presentation submission are published at: <https://www.dns-oarc.net/oarc41> To allow the Programme Committee to make objective assessments of submissions, so as to ensure the quality of the workshop, submissions SHOULD include slides. Draft slides are acceptable on submission. Example guidelines for presentation slides: https://www.grammarly.com/blog/presentation-tips/ Additional information for speakers of OARC 41: * Your talk will be broadcast live and recorded for future reference * Your presentation slides will be available for delegates and others to download and refer to, before, during and after the meeting * Remote speakers have mandatory rehearsal on 2023-08-08 at 14:00 UTC. It would be very useful to have your slides (even if draft) ready for this. Note: DNS-OARC provides registration fee waivers for the workshop to support those who are part of underrepresented groups to speak at and/or attend DNS-OARC. More details will be provided when registration opens. If you have questions or concerns you can contact the Programme Committee: https://www.dns-oarc.net/oarc/programme via submissions(a)dns-oarc.net OARC depends on sponsorship to fund its workshops and associated social events. Please contact sponsor(a)dns-oarc.net if your organization is interested in becoming a sponsor. (Please note that OARC is run on a non-profit basis, and is not in a position to reimburse expenses or time for speakers at its meetings.) John Todd, for the DNS-OARC Programme Committee -- John Todd - jtodd(a)quad9.net General Manager - Quad9 Recursive Resolver

1 0

IPv4 Subnet 23.151.232.0/24 blackholed?
by Neel Chauhan 26 Apr '23

26 Apr '23

Hi, I recently got the IPv4 allocation 23.151.232.0/24 from ARIN. I also had my hosting company ReliableSite announce it to the internet. Right now, I can only access networks that peer with ReliableSite via internet exchanges, such as Google, CloudFlare, OVH, Hurricane Electric, et al. It seems the Tier 1 ISPs (e.g. Lumen, Cogent, AT&T, et al.) are blackholing the IPv4 subnet 23.151.232.0/24. Could someone who works at a Tier 1 NOC please check and remove the blackhole if any exists? Normally when ReliableSite announced my prior (then-leased) IPv4 space it gets propagated via BGP almost immediately. This time it's not going through at all. Best, Neel Chauhan

6 6

Reverse DNS for eyeballs?
by Forrest Christian (List Account) 25 Apr '23

25 Apr '23

I have a feeling that I might be stepping into a can of worms by asking this, but.. What's the current thinking around reverse DNS on IPs used by typical residential/ small business customers. Way way back in the day I used to generate "filler" reverse dns for all of these ranges .. that is, records like "45.100.51.198.in-addr.arpa IN PTR 198-51-100‐45.dialup.example.com", and then add a forward A record to match. We had a procedure to override this generic domain upon customer request when a static IP was assigned, such as for a mail server. As time has marched on, and other people were responsible for the reverse dns zones, cruft from old customers no longer with us has accumulated in the reverse DNS override file and I recently discovered that many newer ranges are either nonexistent or not updated. As I'm in the process of cleaning up several other related messes, I'm feeling I should clean this one up too. I've kinda felt for a while now that reverse dns isn't really needed for the customer IPs but before I dump the whole thing overboard and switch to returning NXDOMAIN unless the customer really needs a reverse dns record I figured I'd ask what the current thinking is for these among the internet community. I'm not talking about reverse dns for infrastructure/router IPs here, as I still feel those need to be kept up to date. This is just for the individual end user IPs.

11 13

Re: Windstream/Kinetic OSP assistance/clie sought
by Justin Streiner 24 Apr '23

24 Apr '23

Other people on their street do have Kinetic, and I believe Windstream laid cable from the street to their house, but they are being told there are no facilities to connect them to an OLT or some other type of termination device. Thank you jms On Sat, Apr 22, 2023, 23:58 Alex Ryu <moonhunt(a)gmail.com> wrote: > It is new construction home, it may be HoA, so it is controlled by HoA > which may have some deal with one provider for landline. > > So it may be dictated by HoA until it reach to certain level when that > binding deal is expired. > > > > > > Sent from Mail <https://go.microsoft.com/fwlink/?LinkId=550986> for > Windows > > > > *From: *Justin Streiner <streinerj(a)gmail.com> > *Sent: *Saturday, April 22, 2023 10:46 PM > *To: *NANOG <nanog(a)nanog.org> > *Subject: *Windstream/Kinetic OSP assistance/clie sought > > > > Some of my family recently moved to an area of North Carolina where > high-speed residential Internet connectivity options seem to be very > limited. Outside of the options below, the only thing they're able to get > is satellite Internet service, and the performance has been very poor > > > > They moved into an area where the neighbors have Kinetic (Windstream's > Internet service) but my relatives have been told that there are no > facilities available for them. This is new construction, so perhaps it's > possible that their address hasn't been added into whatever systems > Windstream/Kinetic use for service pre-qualification? > > > > Is there anyone I can talk to at Winstream to find out if it is indeed > possible to get service at their address, or if there is way I can get past > the gatekeepers? > > > > Any guidance from someone in the know at Windstream would be greatly > appreciated. > > > > Thank you > > jms > > > > >

2 1

SoCal T-Mobile IPv4 sites inaccessible
by Samuel Jackson 24 Apr '23

24 Apr '23

I posted this on the outages mailing-list too, and I am hoping to get more eyeballs on this while also checking in to see if this is isolated to just us. On T-Mobile, we do not seem to be able to get to ipv4 sites. ipv4.google.com does not load, ipv6.google.com does. Even www.t-mobile.com does not seem to be working. I Tried this with LTE (phone) and their home-internet service. Anyone else seeing this? Thanks in advance.

1 0

Windstream/Kinetic OSP assistance/clie sought
by Justin Streiner 22 Apr '23

22 Apr '23

Some of my family recently moved to an area of North Carolina where high-speed residential Internet connectivity options seem to be very limited. Outside of the options below, the only thing they're able to get is satellite Internet service, and the performance has been very poor They moved into an area where the neighbors have Kinetic (Windstream's Internet service) but my relatives have been told that there are no facilities available for them. This is new construction, so perhaps it's possible that their address hasn't been added into whatever systems Windstream/Kinetic use for service pre-qualification? Is there anyone I can talk to at Winstream to find out if it is indeed possible to get service at their address, or if there is way I can get past the gatekeepers? Any guidance from someone in the know at Windstream would be greatly appreciated. Thank you jms

1 0

Re: Reverse DNS for eyeballs?
by Willy Manga 22 Apr '23

22 Apr '23

. On 22/04/2023 16:00, nanog-request(a)nanog.org wrote: > [...] > [..] Really, reverse DNS these > days is mostly only useful for: > > - mail servers (where it shows a modicum of control and clue) > - infrastructure/router IPs (so mtr/traceroute can show useful info) - Peers in an Internet eXchange Point ( a subset of the previous bullet point) -- Willy Manga @ongolaboy https://ongola.blogspot.com/

1 0

Looking to work through GeoIP issue with Square
by Frank Bulk 21 Apr '23

21 Apr '23

My google-fu is failing me - I'm looking to find out which GeoIP service Square uses, or a path to work through a GeoIP issue with them. A client of ours uses Square and unfortunately one of the blocks (23.247.204.0/22) we received at ARIN was at one time associated with France. As you can imagine, they've geo-fenced some of their financial services. The GeoIP issue was fixed on MaxMind many months ago, and another client worked through this issue with AWS, but apparently Square uses yet another data source. If someone can help me on or pm me off-list, that would be great. Thanks, Frank AS53347 AS18883

1 0