HIJACKED: 148.163.0.0/16 -- WTF? Level3 is now doing IP hijacking??
As I already mentioned, 159.223.0.0/16, which is actually registered to the Hoechst Celanese Corporation, has quite obviously been hijacked and is being used & abused by snowshoe spammers as we speak. And Spamhaus, at least, has known about this for more than three months already. What Spamhaus apparently didn't/doesn't know is that Hoechst Celanese has/had _another_ /16 that they abandoned also, i.e. 148.163.0.0/16 and that the same spammers have hijacked this one too, and that they are, quite apparently, using and abusing this one also. (I don't why Spamhaus didn't list this /16 as hijacked also. All I can say is that I apparently do research on cases like these which is a bit deeper than their's.) Anyway, this case is a lot more remarkable than the case of 159.223.0.0/16 for the simple reason that it isn't just some podunk little NSP that is announcing the routes to this one. Nope, in this case the company that's responsible for announcing the routes to the hijacked space would appear to be Level3. (I encourage people to double-check me on that. But I'm pretty sure that I have NOT made a mistake here.) So, um, assuming that I am correct, who the bleep was it, inside of Level3, who thought that it would be a Swell Idea to start routing hijacked /16s for snowshoe spammers? Inquiring minds want to know. (BTW, strangely, up until last night, ARIN whois knew about 148.163.0.0/16. But it seems to have developed a case of Alzheimer's overnight with respect to this one specific block. As Spock would say "Facinating." But I still have a copy of the relevant ARIN whois record for this block from last nite, and yes, it was/is registered to Hoechst Celanese Corporation.) Regards, rfg P.S. Some evidence suggests that the company that may actually be most directly responsible for both of these two big-time /16 hijackings is this one: http://www.logicnext.com/ This is apparently a non-descript little Indian "outsourcing" company trying hard to make it look like they are more than they are. There is a definite tie-in between this company and the person or persons or entity that is pro- viding reverse DNS for the various spammer snowshoe blocks within both 159.223.0.0/16 and 148.163.0.0/16. But I'm not going to elaborate further. P.P.S. Here is some of the spammer snowshoe crap that currently exists within 148.163.0.0/16: 148.163.1.3 mail.touchscreen-gloves.net 148.163.1.11 mail11.touchscreen-gloves.net 148.163.1.12 mail12.touchscreen-gloves.net 148.163.1.13 mail13.touchscreen-gloves.net 148.163.1.14 mail14.touchscreen-gloves.net 148.163.1.15 mail15.touchscreen-gloves.net 148.163.1.16 mail16.touchscreen-gloves.net 148.163.1.17 mail17.touchscreen-gloves.net 148.163.1.18 mail18.touchscreen-gloves.net 148.163.1.19 mail19.touchscreen-gloves.net 148.163.1.20 mail20.touchscreen-gloves.net 148.163.1.21 mail21.touchscreen-gloves.net 148.163.1.22 mail22.touchscreen-gloves.net 148.163.1.23 mail23.touchscreen-gloves.net 148.163.1.24 mail24.touchscreen-gloves.net 148.163.1.25 mail25.touchscreen-gloves.net 148.163.1.26 mail26.touchscreen-gloves.net 148.163.1.27 mail27.touchscreen-gloves.net 148.163.1.28 mail28.touchscreen-gloves.net 148.163.1.29 mail29.touchscreen-gloves.net 148.163.1.30 mail30.touchscreen-gloves.net 148.163.1.31 mail31.touchscreen-gloves.net 148.163.1.32 mail32.touchscreen-gloves.net 148.163.1.33 mail33.touchscreen-gloves.net 148.163.1.34 mail34.touchscreen-gloves.net 148.163.1.35 mail35.touchscreen-gloves.net 148.163.1.36 mail36.touchscreen-gloves.net 148.163.1.37 mail37.touchscreen-gloves.net 148.163.1.38 mail38.touchscreen-gloves.net 148.163.1.39 mail39.touchscreen-gloves.net 148.163.1.40 mail40.touchscreen-gloves.net 148.163.1.41 mail41.touchscreen-gloves.net 148.163.1.42 mail42.touchscreen-gloves.net 148.163.1.43 mail43.touchscreen-gloves.net 148.163.1.44 mail44.touchscreen-gloves.net 148.163.1.45 mail45.touchscreen-gloves.net 148.163.1.46 mail46.touchscreen-gloves.net 148.163.1.47 mail47.touchscreen-gloves.net 148.163.1.48 mail48.touchscreen-gloves.net 148.163.1.49 mail49.touchscreen-gloves.net 148.163.1.50 mail50.touchscreen-gloves.net 148.163.1.51 mail51.touchscreen-gloves.net 148.163.1.52 mail52.touchscreen-gloves.net 148.163.1.53 mail53.touchscreen-gloves.net 148.163.1.54 mail54.touchscreen-gloves.net 148.163.1.55 mail55.touchscreen-gloves.net 148.163.1.56 mail56.touchscreen-gloves.net 148.163.1.57 mail57.touchscreen-gloves.net 148.163.1.58 mail58.touchscreen-gloves.net 148.163.1.59 mail59.touchscreen-gloves.net 148.163.1.60 mail60.touchscreen-gloves.net 148.163.1.61 mail61.touchscreen-gloves.net 148.163.1.62 mail62.touchscreen-gloves.net 148.163.1.63 mail63.touchscreen-gloves.net 148.163.1.64 mail64.touchscreen-gloves.net 148.163.1.65 mail65.touchscreen-gloves.net 148.163.1.66 mail66.touchscreen-gloves.net 148.163.1.67 mail67.touchscreen-gloves.net 148.163.1.68 mail68.touchscreen-gloves.net 148.163.1.69 mail69.touchscreen-gloves.net 148.163.1.70 mail70.touchscreen-gloves.net 148.163.1.71 mail71.touchscreen-gloves.net 148.163.1.72 mail72.touchscreen-gloves.net 148.163.1.73 mail73.touchscreen-gloves.net 148.163.1.74 mail74.touchscreen-gloves.net 148.163.1.75 mail75.touchscreen-gloves.net 148.163.1.76 mail76.touchscreen-gloves.net 148.163.1.77 mail77.touchscreen-gloves.net 148.163.1.78 mail78.touchscreen-gloves.net 148.163.1.79 mail79.touchscreen-gloves.net 148.163.1.80 mail80.touchscreen-gloves.net 148.163.1.81 mail81.touchscreen-gloves.net 148.163.1.82 mail82.touchscreen-gloves.net 148.163.1.83 mail83.touchscreen-gloves.net 148.163.1.84 mail84.touchscreen-gloves.net 148.163.1.85 mail85.touchscreen-gloves.net 148.163.1.86 mail86.touchscreen-gloves.net 148.163.1.87 mail87.touchscreen-gloves.net 148.163.1.88 mail88.touchscreen-gloves.net 148.163.1.89 mail89.touchscreen-gloves.net 148.163.1.90 mail90.touchscreen-gloves.net 148.163.1.91 mail91.touchscreen-gloves.net 148.163.1.92 mail92.touchscreen-gloves.net 148.163.1.93 mail93.touchscreen-gloves.net 148.163.1.94 mail94.touchscreen-gloves.net 148.163.1.95 mail95.touchscreen-gloves.net 148.163.1.96 mail96.touchscreen-gloves.net 148.163.1.97 mail97.touchscreen-gloves.net 148.163.1.98 mail98.touchscreen-gloves.net 148.163.1.99 mail99.touchscreen-gloves.net 148.163.1.100 mail100.touchscreen-gloves.net 148.163.1.101 mail101.touchscreen-gloves.net 148.163.1.102 mail102.touchscreen-gloves.net 148.163.1.103 mail103.touchscreen-gloves.net 148.163.1.104 mail104.touchscreen-gloves.net 148.163.1.105 mail105.touchscreen-gloves.net 148.163.1.106 mail106.touchscreen-gloves.net 148.163.1.107 mail107.touchscreen-gloves.net 148.163.1.108 mail108.touchscreen-gloves.net 148.163.1.109 mail109.touchscreen-gloves.net 148.163.1.110 mail110.touchscreen-gloves.net 148.163.1.111 mail111.touchscreen-gloves.net 148.163.1.112 mail112.touchscreen-gloves.net 148.163.1.113 mail113.touchscreen-gloves.net 148.163.1.114 mail114.touchscreen-gloves.net 148.163.1.115 mail115.touchscreen-gloves.net 148.163.1.116 mail116.touchscreen-gloves.net 148.163.1.117 mail117.touchscreen-gloves.net 148.163.1.118 mail118.touchscreen-gloves.net 148.163.1.119 mail119.touchscreen-gloves.net 148.163.1.120 mail120.touchscreen-gloves.net 148.163.1.121 mail121.touchscreen-gloves.net 148.163.1.122 mail122.touchscreen-gloves.net 148.163.1.123 mail123.touchscreen-gloves.net 148.163.1.124 mail124.touchscreen-gloves.net 148.163.1.125 mail125.touchscreen-gloves.net 148.163.1.126 mail126.touchscreen-gloves.net 148.163.1.127 mail127.touchscreen-gloves.net 148.163.1.128 mail128.touchscreen-gloves.net 148.163.1.129 mail129.touchscreen-gloves.net 148.163.1.130 mail130.touchscreen-gloves.net 148.163.1.131 mail131.touchscreen-gloves.net 148.163.1.132 mail132.touchscreen-gloves.net 148.163.1.133 mail133.touchscreen-gloves.net 148.163.1.134 mail134.touchscreen-gloves.net 148.163.1.135 mail135.touchscreen-gloves.net 148.163.1.136 mail136.touchscreen-gloves.net 148.163.1.137 mail137.touchscreen-gloves.net 148.163.1.138 mail138.touchscreen-gloves.net 148.163.1.139 mail139.touchscreen-gloves.net 148.163.1.140 mail140.touchscreen-gloves.net 148.163.1.141 mail141.touchscreen-gloves.net 148.163.1.142 mail142.touchscreen-gloves.net 148.163.1.143 mail143.touchscreen-gloves.net 148.163.1.144 mail144.touchscreen-gloves.net 148.163.1.145 mail145.touchscreen-gloves.net 148.163.1.146 mail146.touchscreen-gloves.net 148.163.1.147 mail147.touchscreen-gloves.net 148.163.1.148 mail148.touchscreen-gloves.net 148.163.1.149 mail149.touchscreen-gloves.net 148.163.1.150 mail150.touchscreen-gloves.net 148.163.1.151 mail151.touchscreen-gloves.net 148.163.1.152 mail152.touchscreen-gloves.net 148.163.1.153 mail153.touchscreen-gloves.net 148.163.1.154 mail154.touchscreen-gloves.net 148.163.1.155 mail155.touchscreen-gloves.net 148.163.1.156 mail156.touchscreen-gloves.net 148.163.1.157 mail157.touchscreen-gloves.net 148.163.1.158 mail158.touchscreen-gloves.net 148.163.1.159 mail159.touchscreen-gloves.net 148.163.1.160 mail160.touchscreen-gloves.net 148.163.1.161 mail161.touchscreen-gloves.net 148.163.1.162 mail162.touchscreen-gloves.net 148.163.1.163 mail163.touchscreen-gloves.net 148.163.1.164 mail164.touchscreen-gloves.net 148.163.1.165 mail165.touchscreen-gloves.net 148.163.1.166 mail166.touchscreen-gloves.net 148.163.1.167 mail167.touchscreen-gloves.net 148.163.1.168 mail168.touchscreen-gloves.net 148.163.1.169 mail169.touchscreen-gloves.net 148.163.1.170 mail170.touchscreen-gloves.net 148.163.1.171 mail171.touchscreen-gloves.net 148.163.1.172 mail172.touchscreen-gloves.net 148.163.1.173 mail173.touchscreen-gloves.net 148.163.1.174 mail174.touchscreen-gloves.net 148.163.1.175 mail175.touchscreen-gloves.net 148.163.1.176 mail176.touchscreen-gloves.net 148.163.1.177 mail177.touchscreen-gloves.net 148.163.1.178 mail178.touchscreen-gloves.net 148.163.1.179 mail179.touchscreen-gloves.net 148.163.1.180 mail180.touchscreen-gloves.net 148.163.1.181 mail181.touchscreen-gloves.net 148.163.1.182 mail182.touchscreen-gloves.net 148.163.1.183 mail183.touchscreen-gloves.net 148.163.1.184 mail184.touchscreen-gloves.net 148.163.1.185 mail185.touchscreen-gloves.net 148.163.1.186 mail186.touchscreen-gloves.net 148.163.1.187 mail187.touchscreen-gloves.net 148.163.1.188 mail188.touchscreen-gloves.net 148.163.1.189 mail189.touchscreen-gloves.net 148.163.1.190 mail190.touchscreen-gloves.net 148.163.1.191 mail191.touchscreen-gloves.net 148.163.1.192 mail192.touchscreen-gloves.net 148.163.1.193 mail193.touchscreen-gloves.net 148.163.1.194 mail194.touchscreen-gloves.net 148.163.1.195 mail195.touchscreen-gloves.net 148.163.1.196 mail196.touchscreen-gloves.net 148.163.1.197 mail197.touchscreen-gloves.net 148.163.1.198 mail198.touchscreen-gloves.net 148.163.1.199 mail199.touchscreen-gloves.net 148.163.1.200 mail200.touchscreen-gloves.net 148.163.1.201 mail201.touchscreen-gloves.net 148.163.1.202 mail202.touchscreen-gloves.net 148.163.1.203 mail203.touchscreen-gloves.net 148.163.1.204 mail204.touchscreen-gloves.net 148.163.1.205 mail205.touchscreen-gloves.net 148.163.1.206 mail206.touchscreen-gloves.net 148.163.1.207 mail207.touchscreen-gloves.net 148.163.1.208 mail208.touchscreen-gloves.net 148.163.1.209 mail209.touchscreen-gloves.net 148.163.1.210 mail210.touchscreen-gloves.net 148.163.1.211 mail211.touchscreen-gloves.net 148.163.1.212 mail212.touchscreen-gloves.net 148.163.1.213 mail213.touchscreen-gloves.net 148.163.1.214 mail214.touchscreen-gloves.net 148.163.1.215 mail215.touchscreen-gloves.net 148.163.1.216 mail216.touchscreen-gloves.net 148.163.1.217 mail217.touchscreen-gloves.net 148.163.1.218 mail218.touchscreen-gloves.net 148.163.1.219 mail219.touchscreen-gloves.net 148.163.1.220 mail220.touchscreen-gloves.net 148.163.1.221 mail221.touchscreen-gloves.net 148.163.1.222 mail222.touchscreen-gloves.net 148.163.1.223 mail223.touchscreen-gloves.net 148.163.1.224 mail224.touchscreen-gloves.net 148.163.1.225 mail225.touchscreen-gloves.net 148.163.1.226 mail226.touchscreen-gloves.net 148.163.1.227 mail227.touchscreen-gloves.net 148.163.1.228 mail228.touchscreen-gloves.net 148.163.1.229 mail229.touchscreen-gloves.net 148.163.1.230 mail230.touchscreen-gloves.net 148.163.1.231 mail231.touchscreen-gloves.net 148.163.1.232 mail232.touchscreen-gloves.net 148.163.1.233 mail233.touchscreen-gloves.net 148.163.1.234 mail234.touchscreen-gloves.net 148.163.1.235 mail235.touchscreen-gloves.net 148.163.1.236 mail236.touchscreen-gloves.net 148.163.1.237 mail237.touchscreen-gloves.net 148.163.1.238 mail238.touchscreen-gloves.net 148.163.1.239 mail239.touchscreen-gloves.net 148.163.1.240 mail240.touchscreen-gloves.net 148.163.1.241 mail241.touchscreen-gloves.net 148.163.1.242 mail242.touchscreen-gloves.net 148.163.1.243 mail243.touchscreen-gloves.net 148.163.1.244 mail244.touchscreen-gloves.net 148.163.1.245 mail245.touchscreen-gloves.net 148.163.1.246 mail246.touchscreen-gloves.net 148.163.1.247 mail247.touchscreen-gloves.net 148.163.1.248 mail248.touchscreen-gloves.net 148.163.1.249 mail249.touchscreen-gloves.net 148.163.1.250 mail250.touchscreen-gloves.net 148.163.1.251 mail251.touchscreen-gloves.net 148.163.1.252 mail252.touchscreen-gloves.net 148.163.1.253 mail253.touchscreen-gloves.net 148.163.1.254 mail254.touchscreen-gloves.net 148.163.2.4 mail.ipadgloves.net 148.163.2.11 mail11.ipadgloves.net 148.163.2.12 mail12.ipadgloves.net 148.163.2.13 mail13.ipadgloves.net 148.163.2.14 mail14.ipadgloves.net 148.163.2.15 mail15.ipadgloves.net 148.163.2.16 mail16.ipadgloves.net 148.163.2.17 mail17.ipadgloves.net 148.163.2.18 mail18.ipadgloves.net 148.163.2.19 mail19.ipadgloves.net 148.163.2.20 mail20.ipadgloves.net 148.163.2.21 mail21.ipadgloves.net 148.163.2.22 mail22.ipadgloves.net 148.163.2.23 mail23.ipadgloves.net 148.163.2.24 mail24.ipadgloves.net 148.163.2.25 mail25.ipadgloves.net 148.163.2.26 mail26.ipadgloves.net 148.163.2.27 mail27.ipadgloves.net 148.163.2.28 mail28.ipadgloves.net 148.163.2.29 mail29.ipadgloves.net 148.163.2.30 mail30.ipadgloves.net 148.163.2.31 mail31.ipadgloves.net 148.163.2.32 mail32.ipadgloves.net 148.163.2.33 mail33.ipadgloves.net 148.163.2.34 mail34.ipadgloves.net 148.163.2.35 mail35.ipadgloves.net 148.163.2.36 mail36.ipadgloves.net 148.163.2.37 mail37.ipadgloves.net 148.163.2.38 mail38.ipadgloves.net 148.163.2.39 mail39.ipadgloves.net 148.163.2.40 mail40.ipadgloves.net 148.163.2.41 mail41.ipadgloves.net 148.163.2.42 mail42.ipadgloves.net 148.163.2.43 mail43.ipadgloves.net 148.163.2.44 mail44.ipadgloves.net 148.163.2.45 mail45.ipadgloves.net 148.163.2.46 mail46.ipadgloves.net 148.163.2.47 mail47.ipadgloves.net 148.163.2.48 mail48.ipadgloves.net 148.163.2.49 mail49.ipadgloves.net 148.163.2.50 mail50.ipadgloves.net 148.163.2.51 mail51.ipadgloves.net 148.163.2.52 mail52.ipadgloves.net 148.163.2.53 mail53.ipadgloves.net 148.163.2.54 mail54.ipadgloves.net 148.163.2.55 mail55.ipadgloves.net 148.163.2.56 mail56.ipadgloves.net 148.163.2.57 mail57.ipadgloves.net 148.163.2.58 mail58.ipadgloves.net 148.163.2.59 mail59.ipadgloves.net 148.163.2.60 mail60.ipadgloves.net 148.163.2.61 mail61.ipadgloves.net 148.163.2.62 mail62.ipadgloves.net 148.163.2.63 mail63.ipadgloves.net 148.163.2.64 mail64.ipadgloves.net 148.163.2.65 mail65.ipadgloves.net 148.163.2.66 mail66.ipadgloves.net 148.163.2.67 mail67.ipadgloves.net 148.163.2.68 mail68.ipadgloves.net 148.163.2.69 mail69.ipadgloves.net 148.163.2.70 mail70.ipadgloves.net 148.163.2.71 mail71.ipadgloves.net 148.163.2.72 mail72.ipadgloves.net 148.163.2.73 mail73.ipadgloves.net 148.163.2.74 mail74.ipadgloves.net 148.163.2.75 mail75.ipadgloves.net 148.163.2.76 mail76.ipadgloves.net 148.163.2.77 mail77.ipadgloves.net 148.163.2.78 mail78.ipadgloves.net 148.163.2.79 mail79.ipadgloves.net 148.163.2.80 mail80.ipadgloves.net 148.163.2.81 mail81.ipadgloves.net 148.163.2.82 mail82.ipadgloves.net 148.163.2.83 mail83.ipadgloves.net 148.163.2.84 mail84.ipadgloves.net 148.163.2.85 mail85.ipadgloves.net 148.163.2.86 mail86.ipadgloves.net 148.163.2.87 mail87.ipadgloves.net 148.163.2.88 mail88.ipadgloves.net 148.163.2.89 mail89.ipadgloves.net 148.163.2.90 mail90.ipadgloves.net 148.163.2.91 mail91.ipadgloves.net 148.163.2.92 mail92.ipadgloves.net 148.163.2.93 mail93.ipadgloves.net 148.163.2.94 mail94.ipadgloves.net 148.163.2.95 mail95.ipadgloves.net 148.163.2.96 mail96.ipadgloves.net 148.163.2.97 mail97.ipadgloves.net 148.163.2.98 mail98.ipadgloves.net 148.163.2.99 mail99.ipadgloves.net 148.163.2.100 mail100.ipadgloves.net 148.163.2.101 mail101.ipadgloves.net 148.163.2.102 mail102.ipadgloves.net 148.163.2.103 mail103.ipadgloves.net 148.163.2.104 mail104.ipadgloves.net 148.163.2.105 mail105.ipadgloves.net 148.163.2.106 mail106.ipadgloves.net 148.163.2.107 mail107.ipadgloves.net 148.163.2.108 mail108.ipadgloves.net 148.163.2.109 mail109.ipadgloves.net 148.163.2.110 mail110.ipadgloves.net 148.163.2.111 mail111.ipadgloves.net 148.163.2.112 mail112.ipadgloves.net 148.163.2.113 mail113.ipadgloves.net 148.163.2.114 mail114.ipadgloves.net 148.163.2.115 mail115.ipadgloves.net 148.163.2.116 mail116.ipadgloves.net 148.163.2.117 mail117.ipadgloves.net 148.163.2.118 mail118.ipadgloves.net 148.163.2.119 mail119.ipadgloves.net 148.163.2.120 mail120.ipadgloves.net 148.163.2.121 mail121.ipadgloves.net 148.163.2.122 mail122.ipadgloves.net 148.163.2.123 mail123.ipadgloves.net 148.163.2.124 mail124.ipadgloves.net 148.163.2.125 mail125.ipadgloves.net 148.163.2.126 mail126.ipadgloves.net 148.163.2.127 mail127.ipadgloves.net 148.163.2.128 mail128.ipadgloves.net 148.163.2.129 mail129.ipadgloves.net 148.163.2.130 mail130.ipadgloves.net 148.163.2.131 mail131.ipadgloves.net 148.163.2.132 mail132.ipadgloves.net 148.163.2.133 mail133.ipadgloves.net 148.163.2.134 mail134.ipadgloves.net 148.163.2.135 mail135.ipadgloves.net 148.163.2.136 mail136.ipadgloves.net 148.163.2.137 mail137.ipadgloves.net 148.163.2.138 mail138.ipadgloves.net 148.163.2.139 mail139.ipadgloves.net 148.163.2.140 mail140.ipadgloves.net 148.163.2.141 mail141.ipadgloves.net 148.163.2.142 mail142.ipadgloves.net 148.163.2.143 mail143.ipadgloves.net 148.163.2.144 mail144.ipadgloves.net 148.163.2.145 mail145.ipadgloves.net 148.163.2.146 mail146.ipadgloves.net 148.163.2.147 mail147.ipadgloves.net 148.163.2.148 mail148.ipadgloves.net 148.163.2.149 mail149.ipadgloves.net 148.163.2.150 mail150.ipadgloves.net 148.163.2.151 mail151.ipadgloves.net 148.163.2.152 mail152.ipadgloves.net 148.163.2.153 mail153.ipadgloves.net 148.163.2.154 mail154.ipadgloves.net 148.163.2.155 mail155.ipadgloves.net 148.163.2.156 mail156.ipadgloves.net 148.163.2.157 mail157.ipadgloves.net 148.163.2.158 mail158.ipadgloves.net 148.163.2.159 mail159.ipadgloves.net 148.163.2.160 mail160.ipadgloves.net 148.163.2.161 mail161.ipadgloves.net 148.163.2.162 mail162.ipadgloves.net 148.163.2.163 mail163.ipadgloves.net 148.163.2.164 mail164.ipadgloves.net 148.163.2.165 mail165.ipadgloves.net 148.163.2.166 mail166.ipadgloves.net 148.163.2.167 mail167.ipadgloves.net 148.163.2.168 mail168.ipadgloves.net 148.163.2.169 mail169.ipadgloves.net 148.163.2.170 mail170.ipadgloves.net 148.163.2.171 mail171.ipadgloves.net 148.163.2.172 mail172.ipadgloves.net 148.163.2.173 mail173.ipadgloves.net 148.163.2.174 mail174.ipadgloves.net 148.163.2.175 mail175.ipadgloves.net 148.163.2.176 mail176.ipadgloves.net 148.163.2.177 mail177.ipadgloves.net 148.163.2.178 mail178.ipadgloves.net 148.163.2.179 mail179.ipadgloves.net 148.163.2.180 mail180.ipadgloves.net 148.163.2.181 mail181.ipadgloves.net 148.163.2.182 mail182.ipadgloves.net 148.163.2.183 mail183.ipadgloves.net 148.163.2.184 mail184.ipadgloves.net 148.163.2.185 mail185.ipadgloves.net 148.163.2.186 mail186.ipadgloves.net 148.163.2.187 mail187.ipadgloves.net 148.163.2.188 mail188.ipadgloves.net 148.163.2.189 mail189.ipadgloves.net 148.163.2.190 mail190.ipadgloves.net 148.163.2.191 mail191.ipadgloves.net 148.163.2.192 mail192.ipadgloves.net 148.163.2.193 mail193.ipadgloves.net 148.163.2.194 mail194.ipadgloves.net 148.163.2.195 mail195.ipadgloves.net 148.163.2.196 mail196.ipadgloves.net 148.163.2.197 mail197.ipadgloves.net 148.163.2.198 mail198.ipadgloves.net 148.163.2.199 mail199.ipadgloves.net 148.163.2.200 mail200.ipadgloves.net 148.163.2.201 mail201.ipadgloves.net 148.163.2.202 mail202.ipadgloves.net 148.163.2.203 mail203.ipadgloves.net 148.163.2.204 mail204.ipadgloves.net 148.163.2.205 mail205.ipadgloves.net 148.163.2.206 mail206.ipadgloves.net 148.163.2.207 mail207.ipadgloves.net 148.163.2.208 mail208.ipadgloves.net 148.163.2.209 mail209.ipadgloves.net 148.163.2.210 mail210.ipadgloves.net 148.163.2.211 mail211.ipadgloves.net 148.163.2.212 mail212.ipadgloves.net 148.163.2.213 mail213.ipadgloves.net 148.163.2.214 mail214.ipadgloves.net 148.163.2.215 mail215.ipadgloves.net 148.163.2.216 mail216.ipadgloves.net 148.163.2.217 mail217.ipadgloves.net 148.163.2.218 mail218.ipadgloves.net 148.163.2.219 mail219.ipadgloves.net 148.163.2.220 mail220.ipadgloves.net 148.163.2.221 mail221.ipadgloves.net 148.163.2.222 mail222.ipadgloves.net 148.163.2.223 mail223.ipadgloves.net 148.163.2.224 mail224.ipadgloves.net 148.163.2.225 mail225.ipadgloves.net 148.163.2.226 mail226.ipadgloves.net 148.163.2.227 mail227.ipadgloves.net 148.163.2.228 mail228.ipadgloves.net 148.163.2.229 mail229.ipadgloves.net 148.163.2.230 mail230.ipadgloves.net 148.163.2.231 mail231.ipadgloves.net 148.163.2.232 mail232.ipadgloves.net 148.163.2.233 mail233.ipadgloves.net 148.163.2.234 mail234.ipadgloves.net 148.163.2.235 mail235.ipadgloves.net 148.163.2.236 mail236.ipadgloves.net 148.163.2.237 mail237.ipadgloves.net 148.163.2.238 mail238.ipadgloves.net 148.163.2.239 mail239.ipadgloves.net 148.163.2.240 mail240.ipadgloves.net 148.163.2.241 mail241.ipadgloves.net 148.163.2.242 mail242.ipadgloves.net 148.163.2.243 mail243.ipadgloves.net 148.163.2.244 mail244.ipadgloves.net 148.163.2.245 mail245.ipadgloves.net 148.163.2.246 mail246.ipadgloves.net 148.163.2.247 mail247.ipadgloves.net 148.163.2.248 mail248.ipadgloves.net 148.163.2.249 mail249.ipadgloves.net 148.163.2.250 mail250.ipadgloves.net 148.163.2.251 mail251.ipadgloves.net 148.163.2.252 mail252.ipadgloves.net 148.163.2.253 mail253.ipadgloves.net 148.163.2.254 mail254.ipadgloves.net 148.163.3.4 mail.minidatasystems.com 148.163.3.11 mail11.minidatasystems.com 148.163.3.12 mail12.minidatasystems.com 148.163.3.13 mail13.minidatasystems.com 148.163.3.14 mail14.minidatasystems.com 148.163.3.15 mail15.minidatasystems.com 148.163.3.16 mail16.minidatasystems.com 148.163.3.17 mail17.minidatasystems.com 148.163.3.18 mail18.minidatasystems.com 148.163.3.19 mail19.minidatasystems.com 148.163.3.20 mail20.minidatasystems.com 148.163.3.21 mail21.minidatasystems.com 148.163.3.22 mail22.minidatasystems.com 148.163.3.23 mail23.minidatasystems.com 148.163.3.24 mail24.minidatasystems.com 148.163.3.25 mail25.minidatasystems.com 148.163.3.26 mail26.minidatasystems.com 148.163.3.27 mail27.minidatasystems.com 148.163.3.28 mail28.minidatasystems.com 148.163.3.29 mail29.minidatasystems.com 148.163.3.30 mail30.minidatasystems.com 148.163.3.31 mail31.minidatasystems.com 148.163.3.32 mail32.minidatasystems.com 148.163.3.33 mail33.minidatasystems.com 148.163.3.34 mail34.minidatasystems.com 148.163.3.35 mail35.minidatasystems.com 148.163.3.36 mail36.minidatasystems.com 148.163.3.37 mail37.minidatasystems.com 148.163.3.38 mail38.minidatasystems.com 148.163.3.39 mail39.minidatasystems.com 148.163.3.40 mail40.minidatasystems.com 148.163.3.41 mail41.minidatasystems.com 148.163.3.42 mail42.minidatasystems.com 148.163.3.43 mail43.minidatasystems.com 148.163.3.44 mail44.minidatasystems.com 148.163.3.45 mail45.minidatasystems.com 148.163.3.46 mail46.minidatasystems.com 148.163.3.47 mail47.minidatasystems.com 148.163.3.48 mail48.minidatasystems.com 148.163.3.49 mail49.minidatasystems.com 148.163.3.50 mail50.minidatasystems.com 148.163.3.51 mail51.minidatasystems.com 148.163.3.52 mail52.minidatasystems.com 148.163.3.53 mail53.minidatasystems.com 148.163.3.54 mail54.minidatasystems.com 148.163.3.55 mail55.minidatasystems.com 148.163.3.56 mail56.minidatasystems.com 148.163.3.57 mail57.minidatasystems.com 148.163.3.58 mail58.minidatasystems.com 148.163.3.59 mail59.minidatasystems.com 148.163.3.60 mail60.minidatasystems.com 148.163.3.61 mail61.minidatasystems.com 148.163.3.62 mail62.minidatasystems.com 148.163.3.63 mail63.minidatasystems.com 148.163.3.64 mail64.minidatasystems.com 148.163.3.65 mail65.minidatasystems.com 148.163.3.66 mail66.minidatasystems.com 148.163.3.67 mail67.minidatasystems.com 148.163.3.68 mail68.minidatasystems.com 148.163.3.69 mail69.minidatasystems.com 148.163.3.70 mail70.minidatasystems.com 148.163.3.71 mail71.minidatasystems.com 148.163.3.72 mail72.minidatasystems.com 148.163.3.73 mail73.minidatasystems.com 148.163.3.74 mail74.minidatasystems.com 148.163.3.75 mail75.minidatasystems.com 148.163.3.76 mail76.minidatasystems.com 148.163.3.77 mail77.minidatasystems.com 148.163.3.78 mail78.minidatasystems.com 148.163.3.79 mail79.minidatasystems.com 148.163.3.80 mail80.minidatasystems.com 148.163.3.81 mail81.minidatasystems.com 148.163.3.82 mail82.minidatasystems.com 148.163.3.83 mail83.minidatasystems.com 148.163.3.84 mail84.minidatasystems.com 148.163.3.85 mail85.minidatasystems.com 148.163.3.86 mail86.minidatasystems.com 148.163.3.87 mail87.minidatasystems.com 148.163.3.88 mail88.minidatasystems.com 148.163.3.89 mail89.minidatasystems.com 148.163.3.90 mail90.minidatasystems.com 148.163.3.91 mail91.minidatasystems.com 148.163.3.92 mail92.minidatasystems.com 148.163.3.93 mail93.minidatasystems.com 148.163.3.94 mail94.minidatasystems.com 148.163.3.95 mail95.minidatasystems.com 148.163.3.96 mail96.minidatasystems.com 148.163.3.97 mail97.minidatasystems.com 148.163.3.98 mail98.minidatasystems.com 148.163.3.99 mail99.minidatasystems.com 148.163.3.100 mail100.minidatasystems.com 148.163.3.101 mail101.minidatasystems.com 148.163.3.102 mail102.minidatasystems.com 148.163.3.103 mail103.minidatasystems.com 148.163.3.104 mail104.minidatasystems.com 148.163.3.105 mail105.minidatasystems.com 148.163.3.106 mail106.minidatasystems.com 148.163.3.107 mail107.minidatasystems.com 148.163.3.108 mail108.minidatasystems.com 148.163.3.109 mail109.minidatasystems.com 148.163.3.110 mail110.minidatasystems.com 148.163.3.111 mail111.minidatasystems.com 148.163.3.112 mail112.minidatasystems.com 148.163.3.113 mail113.minidatasystems.com 148.163.3.114 mail114.minidatasystems.com 148.163.3.115 mail115.minidatasystems.com 148.163.3.116 mail116.minidatasystems.com 148.163.3.117 mail117.minidatasystems.com 148.163.3.118 mail118.minidatasystems.com 148.163.3.119 mail119.minidatasystems.com 148.163.3.120 mail120.minidatasystems.com 148.163.3.121 mail121.minidatasystems.com 148.163.3.122 mail122.minidatasystems.com 148.163.3.123 mail123.minidatasystems.com 148.163.3.124 mail124.minidatasystems.com 148.163.3.125 mail125.minidatasystems.com 148.163.3.126 mail126.minidatasystems.com 148.163.3.127 mail127.minidatasystems.com 148.163.3.128 mail128.minidatasystems.com 148.163.3.129 mail129.minidatasystems.com 148.163.3.130 mail130.minidatasystems.com 148.163.3.131 mail131.minidatasystems.com 148.163.3.132 mail132.minidatasystems.com 148.163.3.133 mail133.minidatasystems.com 148.163.3.134 mail134.minidatasystems.com 148.163.3.135 mail135.minidatasystems.com 148.163.3.136 mail136.minidatasystems.com 148.163.3.137 mail137.minidatasystems.com 148.163.3.138 mail138.minidatasystems.com 148.163.3.139 mail139.minidatasystems.com 148.163.3.140 mail140.minidatasystems.com 148.163.3.141 mail141.minidatasystems.com 148.163.3.142 mail142.minidatasystems.com 148.163.3.143 mail143.minidatasystems.com 148.163.3.144 mail144.minidatasystems.com 148.163.3.145 mail145.minidatasystems.com 148.163.3.146 mail146.minidatasystems.com 148.163.3.147 mail147.minidatasystems.com 148.163.3.148 mail148.minidatasystems.com 148.163.3.149 mail149.minidatasystems.com 148.163.3.150 mail150.minidatasystems.com 148.163.3.151 mail151.minidatasystems.com 148.163.3.152 mail152.minidatasystems.com 148.163.3.153 mail153.minidatasystems.com 148.163.3.154 mail154.minidatasystems.com 148.163.3.155 mail155.minidatasystems.com 148.163.3.156 mail156.minidatasystems.com 148.163.3.157 mail157.minidatasystems.com 148.163.3.158 mail158.minidatasystems.com 148.163.3.159 mail159.minidatasystems.com 148.163.3.160 mail160.minidatasystems.com 148.163.3.161 mail161.minidatasystems.com 148.163.3.162 mail162.minidatasystems.com 148.163.3.163 mail163.minidatasystems.com 148.163.3.164 mail164.minidatasystems.com 148.163.3.165 mail165.minidatasystems.com 148.163.3.166 mail166.minidatasystems.com 148.163.3.167 mail167.minidatasystems.com 148.163.3.168 mail168.minidatasystems.com 148.163.3.169 mail169.minidatasystems.com 148.163.3.170 mail170.minidatasystems.com 148.163.3.171 mail171.minidatasystems.com 148.163.3.172 mail172.minidatasystems.com 148.163.3.173 mail173.minidatasystems.com 148.163.3.174 mail174.minidatasystems.com 148.163.3.175 mail175.minidatasystems.com 148.163.3.176 mail176.minidatasystems.com 148.163.3.177 mail177.minidatasystems.com 148.163.3.178 mail178.minidatasystems.com 148.163.3.179 mail179.minidatasystems.com 148.163.3.180 mail180.minidatasystems.com 148.163.3.181 mail181.minidatasystems.com 148.163.3.182 mail182.minidatasystems.com 148.163.3.183 mail183.minidatasystems.com 148.163.3.184 mail184.minidatasystems.com 148.163.3.185 mail185.minidatasystems.com 148.163.3.186 mail186.minidatasystems.com 148.163.3.187 mail187.minidatasystems.com 148.163.3.188 mail188.minidatasystems.com 148.163.3.189 mail189.minidatasystems.com 148.163.3.190 mail190.minidatasystems.com 148.163.3.191 mail191.minidatasystems.com 148.163.3.192 mail192.minidatasystems.com 148.163.3.193 mail193.minidatasystems.com 148.163.3.194 mail194.minidatasystems.com 148.163.3.195 mail195.minidatasystems.com 148.163.3.196 mail196.minidatasystems.com 148.163.3.197 mail197.minidatasystems.com 148.163.3.198 mail198.minidatasystems.com 148.163.3.199 mail199.minidatasystems.com 148.163.3.200 mail200.minidatasystems.com 148.163.3.201 mail201.minidatasystems.com 148.163.3.202 mail202.minidatasystems.com 148.163.3.203 mail203.minidatasystems.com 148.163.3.204 mail204.minidatasystems.com 148.163.3.205 mail205.minidatasystems.com 148.163.3.206 mail206.minidatasystems.com 148.163.3.207 mail207.minidatasystems.com 148.163.3.208 mail208.minidatasystems.com 148.163.3.209 mail209.minidatasystems.com 148.163.3.210 mail210.minidatasystems.com 148.163.3.211 mail211.minidatasystems.com 148.163.3.212 mail212.minidatasystems.com 148.163.3.213 mail213.minidatasystems.com 148.163.3.214 mail214.minidatasystems.com 148.163.3.215 mail215.minidatasystems.com 148.163.3.216 mail216.minidatasystems.com 148.163.3.217 mail217.minidatasystems.com 148.163.3.218 mail218.minidatasystems.com 148.163.3.219 mail219.minidatasystems.com 148.163.3.220 mail220.minidatasystems.com 148.163.3.221 mail221.minidatasystems.com 148.163.3.222 mail222.minidatasystems.com 148.163.3.223 mail223.minidatasystems.com 148.163.3.224 mail224.minidatasystems.com 148.163.3.225 mail225.minidatasystems.com 148.163.3.226 mail226.minidatasystems.com 148.163.3.227 mail227.minidatasystems.com 148.163.3.228 mail228.minidatasystems.com 148.163.3.229 mail229.minidatasystems.com 148.163.3.230 mail230.minidatasystems.com 148.163.3.231 mail231.minidatasystems.com 148.163.3.232 mail232.minidatasystems.com 148.163.3.233 mail233.minidatasystems.com 148.163.3.234 mail234.minidatasystems.com 148.163.3.235 mail235.minidatasystems.com 148.163.3.236 mail236.minidatasystems.com 148.163.3.237 mail237.minidatasystems.com 148.163.3.238 mail238.minidatasystems.com 148.163.3.239 mail239.minidatasystems.com 148.163.3.240 mail240.minidatasystems.com 148.163.3.241 mail241.minidatasystems.com 148.163.3.242 mail242.minidatasystems.com 148.163.3.243 mail243.minidatasystems.com 148.163.3.244 mail244.minidatasystems.com 148.163.3.245 mail245.minidatasystems.com 148.163.3.246 mail246.minidatasystems.com 148.163.3.247 mail247.minidatasystems.com 148.163.3.248 mail248.minidatasystems.com 148.163.3.249 mail249.minidatasystems.com 148.163.3.250 mail250.minidatasystems.com 148.163.3.251 mail251.minidatasystems.com 148.163.3.252 mail252.minidatasystems.com 148.163.3.253 mail253.minidatasystems.com 148.163.3.254 mail254.minidatasystems.com 148.163.6.2 balancetutor.com 148.163.6.3 joletta.balancetutor.com 148.163.6.4 hill.balancetutor.com 148.163.6.5 papagena.balancetutor.com 148.163.6.6 guerin.balancetutor.com 148.163.6.7 laurelle.balancetutor.com 148.163.6.8 smolik.balancetutor.com 148.163.6.9 deterred.balancetutor.com 148.163.6.10 olvido.balancetutor.com 148.163.6.11 ninuza.balancetutor.com 148.163.6.12 hortono.balancetutor.com 148.163.6.13 hu.balancetutor.com 148.163.6.14 kopatski.balancetutor.com 148.163.6.15 pippi.balancetutor.com 148.163.6.16 lezlie.balancetutor.com 148.163.6.17 sobrevivientes.balancetutor.com 148.163.6.18 ramme.balancetutor.com 148.163.6.19 gullible.balancetutor.com 148.163.6.20 chandelier.balancetutor.com 148.163.6.21 lac.balancetutor.com 148.163.6.22 eigenvector.balancetutor.com 148.163.6.23 madres.balancetutor.com 148.163.6.24 marcasson.balancetutor.com 148.163.6.25 perfidy.balancetutor.com 148.163.6.26 narcisco.balancetutor.com 148.163.6.27 toumanova.balancetutor.com 148.163.6.28 toni.balancetutor.com 148.163.6.29 wabash.balancetutor.com 148.163.6.30 bencze.balancetutor.com 148.163.6.31 recrudescent.balancetutor.com 148.163.6.32 sw.balancetutor.com 148.163.6.33 blin.balancetutor.com 148.163.6.34 anthropoid.balancetutor.com 148.163.6.35 whitish.balancetutor.com 148.163.6.36 dilber.balancetutor.com 148.163.6.37 thimble.balancetutor.com 148.163.6.38 blaine.balancetutor.com 148.163.6.39 speedway.balancetutor.com 148.163.6.40 lieux.balancetutor.com 148.163.6.41 frackowiak.balancetutor.com 148.163.6.42 shih.balancetutor.com 148.163.6.43 aynesworth.balancetutor.com 148.163.6.44 partovi.balancetutor.com 148.163.6.45 painter.balancetutor.com 148.163.6.46 libertarian.balancetutor.com 148.163.6.47 frechette.balancetutor.com 148.163.6.48 square.balancetutor.com 148.163.6.49 spiry.balancetutor.com 148.163.6.50 rouverol.balancetutor.com 148.163.6.51 tedious.balancetutor.com 148.163.6.52 silvie.balancetutor.com 148.163.6.53 thomajan.balancetutor.com 148.163.6.54 macchiavelli.balancetutor.com 148.163.6.55 burpelson.balancetutor.com 148.163.6.56 orphans.balancetutor.com 148.163.6.57 shoddy.balancetutor.com 148.163.6.58 manzanita.balancetutor.com 148.163.6.59 johnette.balancetutor.com 148.163.6.60 remigio.balancetutor.com 148.163.6.61 macedonia.balancetutor.com 148.163.6.62 essence.balancetutor.com 148.163.6.63 carnie.balancetutor.com 148.163.6.64 nydia.balancetutor.com 148.163.6.65 yurka.balancetutor.com 148.163.6.66 cutters.balancetutor.com 148.163.6.67 matilde.balancetutor.com 148.163.6.68 bagashvili.balancetutor.com 148.163.6.69 exclusion.balancetutor.com 148.163.6.70 italiana.balancetutor.com 148.163.6.71 haggart.balancetutor.com 148.163.6.72 rails.balancetutor.com 148.163.6.73 suzerainty.balancetutor.com 148.163.6.74 jonsy.balancetutor.com 148.163.6.75 kuhlenbeck.balancetutor.com 148.163.6.76 frommer.balancetutor.com 148.163.6.77 harleman.balancetutor.com 148.163.6.78 oilcloth.balancetutor.com 148.163.6.79 colleen.balancetutor.com 148.163.6.80 descrieres.balancetutor.com 148.163.6.81 estrade.balancetutor.com 148.163.6.82 dittenhoffer.balancetutor.com 148.163.6.83 longhand.balancetutor.com 148.163.6.84 felic.balancetutor.com 148.163.6.85 takash.balancetutor.com 148.163.6.86 mutant.balancetutor.com 148.163.6.87 butchery.balancetutor.com 148.163.6.88 tummel.balancetutor.com 148.163.6.89 polarography.balancetutor.com 148.163.6.90 lanyan.balancetutor.com 148.163.6.91 alberty.balancetutor.com 148.163.6.92 maynes.balancetutor.com 148.163.6.93 toot.balancetutor.com 148.163.6.94 bronson.balancetutor.com 148.163.6.95 zeon.balancetutor.com 148.163.6.96 vrain.balancetutor.com 148.163.6.97 obsequious.balancetutor.com 148.163.6.98 spell.balancetutor.com 148.163.6.99 narration.balancetutor.com 148.163.6.100 mairesse.balancetutor.com 148.163.6.101 perez.balancetutor.com 148.163.6.102 dhery.balancetutor.com 148.163.6.103 lukather.balancetutor.com 148.163.6.104 genin.balancetutor.com 148.163.6.105 culliford.balancetutor.com 148.163.6.106 panamanian.balancetutor.com 148.163.6.107 biroff.balancetutor.com 148.163.6.108 pansie.balancetutor.com 148.163.6.109 meantime.balancetutor.com 148.163.6.110 dixieland.balancetutor.com 148.163.6.111 pair.balancetutor.com 148.163.6.112 minuscule.balancetutor.com 148.163.6.113 gennini.balancetutor.com 148.163.6.114 tyzack.balancetutor.com 148.163.6.115 joined.balancetutor.com 148.163.6.116 mira.balancetutor.com 148.163.6.117 ladyfern.balancetutor.com 148.163.6.118 torquil.balancetutor.com 148.163.6.119 inconvenient.balancetutor.com 148.163.6.120 survive.balancetutor.com 148.163.6.121 melisent.balancetutor.com 148.163.6.122 tabbs.balancetutor.com 148.163.6.123 herlihy.balancetutor.com 148.163.6.124 radiometer.balancetutor.com 148.163.6.125 auria.balancetutor.com 148.163.6.126 dorin.balancetutor.com 148.163.6.127 whimbrel.balancetutor.com 148.163.6.128 corps.balancetutor.com 148.163.6.129 collegiate.balancetutor.com 148.163.6.130 belli.balancetutor.com 148.163.6.131 comptroller.balancetutor.com 148.163.6.132 librate.balancetutor.com 148.163.6.133 staph.balancetutor.com 148.163.6.134 fuortes.balancetutor.com 148.163.6.135 berova.balancetutor.com 148.163.6.136 mansel.balancetutor.com 148.163.6.137 pulpit.balancetutor.com 148.163.6.138 gabriello.balancetutor.com 148.163.6.139 leondopolous.balancetutor.com 148.163.6.140 threatt.balancetutor.com 148.163.6.141 newcomer.balancetutor.com 148.163.6.142 simpkins.balancetutor.com 148.163.6.143 operand.balancetutor.com 148.163.6.144 pater.balancetutor.com 148.163.6.145 berger.balancetutor.com 148.163.6.146 grenzpostens.balancetutor.com 148.163.6.147 lucinda.balancetutor.com 148.163.6.148 svelta.balancetutor.com 148.163.6.149 guttenberg.balancetutor.com 148.163.6.150 brea.balancetutor.com 148.163.6.151 bop.balancetutor.com 148.163.6.152 komora.balancetutor.com 148.163.6.153 fipps.balancetutor.com 148.163.6.154 essie.balancetutor.com 148.163.6.155 kawsadze.balancetutor.com 148.163.6.156 haigh.balancetutor.com 148.163.6.157 handyman.balancetutor.com 148.163.6.158 hampton.balancetutor.com 148.163.6.159 canadian.balancetutor.com 148.163.6.160 infanticide.balancetutor.com 148.163.6.161 buckholder.balancetutor.com 148.163.6.162 rebelling.balancetutor.com 148.163.6.163 coypu.balancetutor.com 148.163.6.164 katherine.balancetutor.com 148.163.6.165 upriver.balancetutor.com 148.163.6.166 dagg.balancetutor.com 148.163.6.167 forslund.balancetutor.com 148.163.6.168 para.balancetutor.com 148.163.6.169 bachir.balancetutor.com 148.163.6.170 greis.balancetutor.com 148.163.6.171 jochi.balancetutor.com 148.163.6.172 jobina.balancetutor.com 148.163.6.173 moonbeam.balancetutor.com 148.163.6.174 dupe.balancetutor.com 148.163.6.175 punch.balancetutor.com 148.163.6.176 extracurricular.balancetutor.com 148.163.6.177 argibay.balancetutor.com 148.163.6.178 yida.balancetutor.com 148.163.6.179 litvinoff.balancetutor.com 148.163.6.180 threaten.balancetutor.com 148.163.6.181 sesta.balancetutor.com 148.163.6.182 castenada.balancetutor.com 148.163.6.183 interiors.balancetutor.com 148.163.6.184 plummet.balancetutor.com 148.163.6.185 finial.balancetutor.com 148.163.6.186 cuneo.balancetutor.com 148.163.6.187 hyperthermia.balancetutor.com 148.163.6.188 caspar.balancetutor.com 148.163.6.189 caucasian.balancetutor.com 148.163.6.190 penella.balancetutor.com 148.163.6.191 peg.balancetutor.com 148.163.6.192 yordanoff.balancetutor.com 148.163.6.193 bargarian.balancetutor.com 148.163.6.194 love.balancetutor.com 148.163.6.195 halleck.balancetutor.com 148.163.6.196 debouny.balancetutor.com 148.163.6.197 korry.balancetutor.com 148.163.6.198 cornea.balancetutor.com 148.163.6.199 lurk.balancetutor.com 148.163.6.200 footloose.balancetutor.com 148.163.6.201 guilbert.balancetutor.com 148.163.6.202 goes.balancetutor.com 148.163.6.203 roarke.balancetutor.com 148.163.6.204 ricardo.balancetutor.com 148.163.6.205 nuits.balancetutor.com 148.163.6.206 jacquie.balancetutor.com 148.163.6.207 peruse.balancetutor.com 148.163.6.208 finck.balancetutor.com 148.163.6.209 ambengat.balancetutor.com 148.163.6.210 joanna.balancetutor.com 148.163.6.211 nolan.balancetutor.com 148.163.6.212 braid.balancetutor.com 148.163.6.213 octopus.balancetutor.com 148.163.6.214 mcvilches.balancetutor.com 148.163.6.215 brokerage.balancetutor.com 148.163.6.216 seaboard.balancetutor.com 148.163.6.217 gandett.balancetutor.com 148.163.6.218 posey.balancetutor.com 148.163.6.219 lonette.balancetutor.com 148.163.6.220 abundant.balancetutor.com 148.163.6.221 arsenal.balancetutor.com 148.163.6.222 aleksa.balancetutor.com 148.163.6.223 kilman.balancetutor.com 148.163.6.224 drain.balancetutor.com 148.163.6.225 moory.balancetutor.com 148.163.6.226 stressful.balancetutor.com 148.163.6.227 heu.balancetutor.com 148.163.6.228 glutinous.balancetutor.com 148.163.6.229 yuichi.balancetutor.com 148.163.6.230 requena.balancetutor.com 148.163.6.231 rubin.balancetutor.com 148.163.6.232 gidon.balancetutor.com 148.163.6.233 dashboard.balancetutor.com 148.163.6.234 absolute.balancetutor.com 148.163.6.235 molieri.balancetutor.com 148.163.6.236 exotic.balancetutor.com 148.163.6.237 stooge.balancetutor.com 148.163.6.238 lloyd.balancetutor.com 148.163.6.239 mastery.balancetutor.com 148.163.6.240 idi.balancetutor.com 148.163.6.241 traviata.balancetutor.com 148.163.6.242 awl.balancetutor.com 148.163.6.243 amiss.balancetutor.com 148.163.6.244 wilhelmina.balancetutor.com 148.163.6.245 aerobic.balancetutor.com 148.163.6.246 sherrill.balancetutor.com 148.163.6.247 idelle.balancetutor.com 148.163.6.248 fekkesh.balancetutor.com 148.163.6.249 serio.balancetutor.com 148.163.6.250 pernicious.balancetutor.com 148.163.6.251 tump.balancetutor.com 148.163.6.252 jolys.balancetutor.com 148.163.6.253 limpy.balancetutor.com 148.163.6.254 dowell.balancetutor.com 148.163.8.2 determineindividualize.com 148.163.8.3 dully.determineindividualize.com 148.163.8.4 honori.determineindividualize.com 148.163.8.5 selwart.determineindividualize.com 148.163.8.6 laina.determineindividualize.com 148.163.8.7 orfeo.determineindividualize.com 148.163.8.8 gila.determineindividualize.com 148.163.8.9 eucharist.determineindividualize.com 148.163.8.10 belaieva.determineindividualize.com 148.163.8.11 conferee.determineindividualize.com 148.163.8.12 georgy.determineindividualize.com 148.163.8.13 gambelli.determineindividualize.com 148.163.8.14 dater.determineindividualize.com 148.163.8.15 trainload.determineindividualize.com 148.163.8.16 eshtor.determineindividualize.com 148.163.8.17 pertinent.determineindividualize.com 148.163.8.18 hartfield.determineindividualize.com 148.163.8.19 victorien.determineindividualize.com 148.163.8.20 lifeblood.determineindividualize.com 148.163.8.21 ifkovich.determineindividualize.com 148.163.8.22 revkah.determineindividualize.com 148.163.8.23 coessens.determineindividualize.com 148.163.8.24 throley.determineindividualize.com 148.163.8.25 chigger.determineindividualize.com 148.163.8.26 hawn.determineindividualize.com 148.163.8.27 sulfite.determineindividualize.com 148.163.8.28 eleomore.determineindividualize.com 148.163.8.29 clean.determineindividualize.com 148.163.8.30 habicht.determineindividualize.com 148.163.8.31 maurine.determineindividualize.com 148.163.8.32 gallberry.determineindividualize.com 148.163.8.33 salvesen.determineindividualize.com 148.163.8.34 tevis.determineindividualize.com 148.163.8.35 calvet.determineindividualize.com 148.163.8.36 loury.determineindividualize.com 148.163.8.37 py.determineindividualize.com 148.163.8.38 complicity.determineindividualize.com 148.163.8.39 sharif.determineindividualize.com 148.163.8.40 noteworthy.determineindividualize.com 148.163.8.41 diggers.determineindividualize.com 148.163.8.42 hellenpolis.determineindividualize.com 148.163.8.43 jarol.determineindividualize.com 148.163.8.44 shaun.determineindividualize.com 148.163.8.45 actaeon.determineindividualize.com 148.163.8.46 danika.determineindividualize.com 148.163.8.47 furtive.determineindividualize.com 148.163.8.48 convolute.determineindividualize.com 148.163.8.49 favio.determineindividualize.com 148.163.8.50 molinari.determineindividualize.com 148.163.8.51 adan.determineindividualize.com 148.163.8.52 wren.determineindividualize.com 148.163.8.53 expressman.determineindividualize.com 148.163.8.54 nielson.determineindividualize.com 148.163.8.55 puffball.determineindividualize.com 148.163.8.56 rivere.determineindividualize.com 148.163.8.57 felicitous.determineindividualize.com 148.163.8.58 juttner.determineindividualize.com 148.163.8.59 boarder.determineindividualize.com 148.163.8.60 benares.determineindividualize.com 148.163.8.61 enke.determineindividualize.com 148.163.8.62 shaefer.determineindividualize.com 148.163.8.63 oestergaard.determineindividualize.com 148.163.8.64 contort.determineindividualize.com 148.163.8.65 jacinto.determineindividualize.com 148.163.8.66 enclave.determineindividualize.com 148.163.8.67 munier.determineindividualize.com 148.163.8.68 zak.determineindividualize.com 148.163.8.69 heilmann.determineindividualize.com 148.163.8.70 golddiggers.determineindividualize.com 148.163.8.71 sugath.determineindividualize.com 148.163.8.72 mochow.determineindividualize.com 148.163.8.73 mitchael.determineindividualize.com 148.163.8.74 bambang.determineindividualize.com 148.163.8.75 ebeling.determineindividualize.com 148.163.8.76 hearne.determineindividualize.com 148.163.8.77 farmwoman.determineindividualize.com 148.163.8.78 nabbing.determineindividualize.com 148.163.8.79 revengers.determineindividualize.com 148.163.8.80 indiscreet.determineindividualize.com 148.163.8.81 beasely.determineindividualize.com 148.163.8.82 ampere.determineindividualize.com 148.163.8.83 kenobi.determineindividualize.com 148.163.8.84 janeta.determineindividualize.com 148.163.8.85 conduct.determineindividualize.com 148.163.8.86 penance.determineindividualize.com 148.163.8.87 perovic.determineindividualize.com 148.163.8.88 twa.determineindividualize.com 148.163.8.89 dubitable.determineindividualize.com 148.163.8.90 majerhofer.determineindividualize.com 148.163.8.91 contentious.determineindividualize.com 148.163.8.92 francesca.determineindividualize.com 148.163.8.93 porphyry.determineindividualize.com 148.163.8.94 terrorist.determineindividualize.com 148.163.8.95 neutronium.determineindividualize.com 148.163.8.96 brandenburg.determineindividualize.com 148.163.8.97 deyl.determineindividualize.com 148.163.8.98 mural.determineindividualize.com 148.163.8.99 decryption.determineindividualize.com 148.163.8.100 crystallography.determineindividualize.com 148.163.8.101 palmberg.determineindividualize.com 148.163.8.102 otti.determineindividualize.com 148.163.8.103 pettyjohn.determineindividualize.com 148.163.8.104 eightieth.determineindividualize.com 148.163.8.105 thermonuclear.determineindividualize.com 148.163.8.106 spione.determineindividualize.com 148.163.8.107 embassy.determineindividualize.com 148.163.8.108 korano.determineindividualize.com 148.163.8.109 khun.determineindividualize.com 148.163.8.110 angorapoulos.determineindividualize.com 148.163.8.111 tove.determineindividualize.com 148.163.8.112 turpitude.determineindividualize.com 148.163.8.113 interviewer.determineindividualize.com 148.163.8.114 anaesthetist.determineindividualize.com 148.163.8.115 declarator.determineindividualize.com 148.163.8.116 veri.determineindividualize.com 148.163.8.117 wetting.determineindividualize.com 148.163.8.118 roxiu.determineindividualize.com 148.163.8.119 fleming.determineindividualize.com 148.163.8.120 shandel.determineindividualize.com 148.163.8.121 layden.determineindividualize.com 148.163.8.122 prowl.determineindividualize.com 148.163.8.123 hatchway.determineindividualize.com 148.163.8.124 jered.determineindividualize.com 148.163.8.125 greengrocer.determineindividualize.com 148.163.8.126 oya.determineindividualize.com 148.163.8.127 amboise.determineindividualize.com 148.163.8.128 lupavinova.determineindividualize.com 148.163.8.129 basibla.determineindividualize.com 148.163.8.130 jacobian.determineindividualize.com 148.163.8.131 apostis.determineindividualize.com 148.163.8.132 laurencic.determineindividualize.com 148.163.8.133 galore.determineindividualize.com 148.163.8.134 quiere.determineindividualize.com 148.163.8.135 nesta.determineindividualize.com 148.163.8.136 morriera.determineindividualize.com 148.163.8.137 corteguay.determineindividualize.com 148.163.8.138 okamoto.determineindividualize.com 148.163.8.139 abenteuer.determineindividualize.com 148.163.8.140 tehanni.determineindividualize.com 148.163.8.141 merrin.determineindividualize.com 148.163.8.142 inanimate.determineindividualize.com 148.163.8.143 lepage.determineindividualize.com 148.163.8.144 stalk.determineindividualize.com 148.163.8.145 braden.determineindividualize.com 148.163.8.146 foolscap.determineindividualize.com 148.163.8.147 ferrovius.determineindividualize.com 148.163.8.148 tildie.determineindividualize.com 148.163.8.149 non.determineindividualize.com 148.163.8.150 karil.determineindividualize.com 148.163.8.151 liniment.determineindividualize.com 148.163.8.152 krieg.determineindividualize.com 148.163.8.153 emmie.determineindividualize.com 148.163.8.154 rembrandt.determineindividualize.com 148.163.8.155 danko.determineindividualize.com 148.163.8.156 swaef.determineindividualize.com 148.163.8.157 ghetto.determineindividualize.com 148.163.8.158 ephemerides.determineindividualize.com 148.163.8.159 scotland.determineindividualize.com 148.163.8.160 jump.determineindividualize.com 148.163.8.161 rakubian.determineindividualize.com 148.163.8.162 tripp.determineindividualize.com 148.163.8.163 orvis.determineindividualize.com 148.163.8.164 pigeon.determineindividualize.com 148.163.8.165 combinatorial.determineindividualize.com 148.163.8.166 decent.determineindividualize.com 148.163.8.167 mossy.determineindividualize.com 148.163.8.168 dieter.determineindividualize.com 148.163.8.169 laurita.determineindividualize.com 148.163.8.170 injury.determineindividualize.com 148.163.8.171 sparky.determineindividualize.com 148.163.8.172 kazuhito.determineindividualize.com 148.163.8.173 starch.determineindividualize.com 148.163.8.174 shimmele.determineindividualize.com 148.163.8.175 infant.determineindividualize.com 148.163.8.176 considerate.determineindividualize.com 148.163.8.177 berpe.determineindividualize.com 148.163.8.178 jailer.determineindividualize.com 148.163.8.179 wavenumber.determineindividualize.com 148.163.8.180 yevgraf.determineindividualize.com 148.163.8.181 brumlik.determineindividualize.com 148.163.8.182 yamashita.determineindividualize.com 148.163.8.183 cormack.determineindividualize.com 148.163.8.184 loire.determineindividualize.com 148.163.8.185 adhesive.determineindividualize.com 148.163.8.186 volsky.determineindividualize.com 148.163.8.187 mordant.determineindividualize.com 148.163.8.188 vinnette.determineindividualize.com 148.163.8.189 georgetta.determineindividualize.com 148.163.8.190 nostril.determineindividualize.com 148.163.8.191 kerwinn.determineindividualize.com 148.163.8.192 lighting.determineindividualize.com 148.163.8.193 violence.determineindividualize.com 148.163.8.194 tita.determineindividualize.com 148.163.8.195 lexicographer.determineindividualize.com 148.163.8.196 imponderable.determineindividualize.com 148.163.8.197 wegner.determineindividualize.com 148.163.8.198 gaelle.determineindividualize.com 148.163.8.199 joya.determineindividualize.com 148.163.8.200 mayll.determineindividualize.com 148.163.8.201 pram.determineindividualize.com 148.163.8.202 haghios.determineindividualize.com 148.163.8.203 yell.determineindividualize.com 148.163.8.204 tuchmann.determineindividualize.com 148.163.8.205 francisquinha.determineindividualize.com 148.163.8.206 defence.determineindividualize.com 148.163.8.207 bolne.determineindividualize.com 148.163.8.208 zarrah.determineindividualize.com 148.163.8.209 waelsungenblut.determineindividualize.com 148.163.8.210 enrage.determineindividualize.com 148.163.8.211 typhus.determineindividualize.com 148.163.8.212 shone.determineindividualize.com 148.163.8.213 laraine.determineindividualize.com 148.163.8.214 arty.determineindividualize.com 148.163.8.215 alecia.determineindividualize.com 148.163.8.216 schroedinger.determineindividualize.com 148.163.8.217 telescope.determineindividualize.com 148.163.8.218 gavrielle.determineindividualize.com 148.163.8.219 yew.determineindividualize.com 148.163.8.220 sneer.determineindividualize.com 148.163.8.221 agay.determineindividualize.com 148.163.8.222 centaur.determineindividualize.com 148.163.8.223 dipole.determineindividualize.com 148.163.8.224 remar.determineindividualize.com 148.163.8.225 frisby.determineindividualize.com 148.163.8.226 keechie.determineindividualize.com 148.163.8.227 yulin.determineindividualize.com 148.163.8.228 teters.determineindividualize.com 148.163.8.229 asylum.determineindividualize.com 148.163.8.230 kalidor.determineindividualize.com 148.163.8.231 pastorek.determineindividualize.com 148.163.8.232 bruce.determineindividualize.com 148.163.8.233 peluce.determineindividualize.com 148.163.8.234 reardon.determineindividualize.com 148.163.8.235 dobe.determineindividualize.com 148.163.8.236 ernaline.determineindividualize.com 148.163.8.237 kossoff.determineindividualize.com 148.163.8.238 ekstram.determineindividualize.com 148.163.8.239 grant.determineindividualize.com 148.163.8.240 gatewood.determineindividualize.com 148.163.8.241 zeze.determineindividualize.com 148.163.8.242 polyhedron.determineindividualize.com 148.163.8.243 philippine.determineindividualize.com 148.163.8.244 kovrin.determineindividualize.com 148.163.8.245 dueringer.determineindividualize.com 148.163.8.246 spalinger.determineindividualize.com 148.163.8.247 sallet.determineindividualize.com 148.163.8.248 alchemy.determineindividualize.com 148.163.8.249 participle.determineindividualize.com 148.163.8.250 riviera.determineindividualize.com 148.163.8.251 macnabb.determineindividualize.com 148.163.8.252 transferral.determineindividualize.com 148.163.8.253 differentiable.determineindividualize.com 148.163.8.254 diehl.determineindividualize.com
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mar 30, 2011, at 1:58 PM, Ronald F. Guilmette wrote:
As I already mentioned, 159.223.0.0/16, which is actually registered to the Hoechst Celanese Corporation, has quite obviously been hijacked
And have you reported this to ARIN? https://www.arin.net/public/fraud/index.xhtml Obviously it's not fraud on Celanese's part, but it certainly seems to be evidence that they don't need the space anymore. If someone who needed it more had it, they might not put up with the hijacking. -Bill -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) iEYEARECAAYFAk2TmqwACgkQGvQy4xTRsBGkiwCgvHVFs1qz55H+FNCj+Apwrcev sFIAoMluDV11me+X8I9MoVie611H8e9P =p+yS -----END PGP SIGNATURE-----
I have a level 3 circuit with BGP. Level 3 set me up a maintainer. To communicate with this program I just send an email to the maintainer, based on my email address and the maintainer name it will allow the route I request advertisement. I don't believe any one monitors this system and I would imagine if no one complains about this company advertising hijacked routes to level 3 then it would be quite easy to advertise a network that has been abandon. -----Original Message----- From: Bill Woodcock [mailto:woody@pch.net] Sent: Wednesday, March 30, 2011 5:04 PM To: Ronald F. Guilmette Cc: nanog@nanog.org Subject: Re: HIJACKED: 148.163.0.0/16 -- WTF? Level3 is now doing IP hijacking?? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mar 30, 2011, at 1:58 PM, Ronald F. Guilmette wrote:
As I already mentioned, 159.223.0.0/16, which is actually registered to the Hoechst Celanese Corporation, has quite obviously been hijacked
And have you reported this to ARIN? https://www.arin.net/public/fraud/index.xhtml Obviously it's not fraud on Celanese's part, but it certainly seems to be evidence that they don't need the space anymore. If someone who needed it more had it, they might not put up with the hijacking. -Bill -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (Darwin) iEYEARECAAYFAk2TmqwACgkQGvQy4xTRsBGkiwCgvHVFs1qz55H+FNCj+Apwrcev sFIAoMluDV11me+X8I9MoVie611H8e9P =p+yS -----END PGP SIGNATURE-----
In message <002201cbef24$c1b61d70$45225850$@com>, you wrote:
I don't believe any one monitors this system and I would imagine if no one complains about this company advertising hijacked routes to level 3 then it would be quite easy to advertise a network that has been abandon(sic).
At this point, I do believe that you are stating the obvious. Whether it is wise, or otherwise, to leave one's company's route announcements entirely on autopilot is, I think, a remaining question. The evidence would seem to suggest not. But then again, as I think we all know, there is a non-zero costs associated with doing anything well, professionally, or (as the laywers like to say) in a "workman-like manner", and these costs are often seen as being at odds with the corporate bottom line. Personally, I just hope that Level3 accrues a sufficient quantity of bad PR from what they have done here so that they will lose a client or two, and that this in turn might have some salutary effect upon the corporate calculus. Regards, rfg
This is an old enough "technique" dating back to a few years - re-registering an expired domain that belonged to the ARIN contact, and filling out the ISP paperwork. There does seem to be something that needs to be done - its not something ARIN can easily look into, the SP is much better placed to take action. But its a gray area between the two. On Thu, Mar 31, 2011 at 3:22 AM, Jim Gonzalez <jim@impactbusiness.com> wrote:
I have a level 3 circuit with BGP. Level 3 set me up a maintainer. To communicate with this program I just send an email to the maintainer, based on my email address and the maintainer name it will allow the route I request advertisement. I don't believe any one monitors this system and I would imagine if no one complains about this company advertising hijacked routes to level 3 then it would be quite easy to advertise a network that has been abandon.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
In message <AANLkTikEmpr3QvVDOrvUgRNZn0CnkoA4vTBta5Q3mBuN@mail.gmail.com>, you wrote:
This is an old enough "technique" dating back to a few years - re-registering an expired domain that belonged to the ARIN contact, and filling out the ISP paperwork.
FYI - That does not seem to have been what occured in the two particular cases I reported on today. The e-mail contact domain for the two relevant ARIN allocation records seems to still be in use by the chemical company, Hoechst Celanese. So that _really_ begs the question... Why did Circle Internet and (apparently) Level3's customer, BANDCON, blindly accept _any_ sort of assertion that the crook who hijacked these two /16s had the right to use them? % traceroute to 148.163.5.2 (148.163.5.2), 64 hops max, 40 byte packets ... 8 ae-62-62.csw1.SanJose1.Level3.net (4.69.153.18) 42.796 ms ae-82-82.csw3.SanJose1.Level3.net (4.69.153.26) 44.268 ms ae-72-72.csw2.SanJose1.Level3.net (4.69.153.22) 43.296 ms 9 ae-4-90.edge8.SanJose1.Level3.net (4.69.152.212) 44.877 ms ae-3-80.edge8.SanJose1.Level3.net (4.69.152.148) 44.731 ms ae-1-60.edge8.SanJose1.Level3.net (4.69.152.20) 44.426 ms 10 BANDCON.edge8.SanJose1.Level3.net (4.53.30.42) 45.018 ms 45.779 ms 45.043 ms 11 148.163.5.2 (148.163.5.2) 44.820 ms 45.651 ms 44.571 ms In the case of Circle Internet, I feel sure that the check cleared, so they didn't see it as either necessary or useful to inquire further. But the question that I'd most like to get an answer to... and the one that nobody will likely ever get an answer to... is "Did BandCon likewise see that the check which was made out to them cleared, and that thus they didn't see fit to inquire any further?" Separately, Jim Gonzalez raised an interesting and related point... If I were to simply forge the sender address of an e-mail message, send it to Level3, and ask Level3 to route some arbitrary hunk of IP space for me, would Level3 just blindly do it? If so, I may perhaps see if I can have a bit of fun, at their expense, this weekend. I mean what the hay! It's pretty obvious that nobody from law enforcement has any interest in any of this crap, and that random bad actors can perpetrate whatever kinds of frauds they wish on the net with virtual impunity. So why should this hijacking crap only be a spectator's sport? Regards, rfg
On Wed, 30 Mar 2011, Ronald F. Guilmette wrote:
So that _really_ begs the question... Why did Circle Internet and (apparently) Level3's customer, BANDCON, blindly accept _any_ sort of assertion that the crook who hijacked these two /16s had the right to use them?
What makes you think it was blind? The standard industry practice is to ask someone requesting to announce a route for a letter on the owner's letter head authorizing the announcement. Is it really that hard to invent some letterhead and sign a letter? It's probably one of the easiest to circumvent "security" procedures ever. Frankly it's a giant waste of time and does nothing other than frustrate legitimate work. -- Brandon Ross AIM: BrandonNRoss ICQ: 2269442 Skype: brandonross Yahoo: BrandonNRoss
Its also a procedure that does need some due diligence done on it, to avoid attacks where a SP's netblock is stolen when its actively routed rather than abandoned. On Thu, Mar 31, 2011 at 9:30 AM, Brandon Ross <bross@pobox.com> wrote:
What makes you think it was blind? The standard industry practice is to ask someone requesting to announce a route for a letter on the owner's letter head authorizing the announcement. Is it really that hard to invent some letterhead and sign a letter?
It's probably one of the easiest to circumvent "security" procedures ever.
Frankly it's a giant waste of time and does nothing other than frustrate legitimate work.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
Wait a second, I'm pretty sure that in most contexts, a signature or letterhead means not so much "this is real because it's so obviously genuine", but rather: "This is real or I am willing to take a forgery rap". As it happens, that's good enough for many if not most non-cash transactions. Now, there are societies where that doesn't work, but they don't usually have a lot of networks. On Wed, Mar 30, 2011 at 9:00 PM, Brandon Ross <bross@pobox.com> wrote:
On Wed, 30 Mar 2011, Ronald F. Guilmette wrote:
So that _really_ begs the question... Why did Circle Internet and (apparently) Level3's customer, BANDCON, blindly accept _any_ sort of assertion that the crook who hijacked these two /16s had the right to use them?
What makes you think it was blind? The standard industry practice is to ask someone requesting to announce a route for a letter on the owner's letter head authorizing the announcement. Is it really that hard to invent some letterhead and sign a letter?
It's probably one of the easiest to circumvent "security" procedures ever.
Frankly it's a giant waste of time and does nothing other than frustrate legitimate work.
-- Brandon Ross AIM: BrandonNRoss ICQ: 2269442 Skype: brandonross Yahoo: BrandonNRoss
On Wed, 30 Mar 2011, Ross Harvey wrote:
Wait a second, I'm pretty sure that in most contexts, a signature or letterhead means not so much "this is real because it's so obviously genuine", but rather:
"This is real or I am willing to take a forgery rap".
Do you think most providers check the signer's ID to make sure they actually signed their own name? How do you prove that whomever you accuse of signing it actually forged it if not? Does anyone know of there ever being even a single case where someone was convicted of forgery for this? -- Brandon Ross AIM: BrandonNRoss ICQ: 2269442 Skype: brandonross Yahoo: BrandonNRoss
If they put it on letterhead and signed their own name in such a way that it purports to be an agent of the organization for which they were not an authorized agent, that is usually enough to become a criminal act, whether it is considered forgery, fraud, or something else, I'm not sure about the exact technicalities and they may vary by jurisdiction. Owen Sent from my iPad On Mar 30, 2011, at 11:53 PM, Brandon Ross <bross@pobox.com> wrote:
On Wed, 30 Mar 2011, Ross Harvey wrote:
Wait a second, I'm pretty sure that in most contexts, a signature or letterhead means not so much "this is real because it's so obviously genuine", but rather:
"This is real or I am willing to take a forgery rap".
Do you think most providers check the signer's ID to make sure they actually signed their own name? How do you prove that whomever you accuse of signing it actually forged it if not?
Does anyone know of there ever being even a single case where someone was convicted of forgery for this?
-- Brandon Ross AIM: BrandonNRoss ICQ: 2269442 Skype: brandonross Yahoo: BrandonNRoss
On Wed, Mar 30, 2011 at 10:15 PM, Owen DeLong <owen@delong.com> wrote:
If they put it on letterhead and signed their own name in such a way that it purports to be an agent of the organization for which they were not an authorized agent, that is usually enough to become a criminal act, whether it is considered forgery, fraud, or something else, I'm not sure about the exact technicalities and they may vary by jurisdiction.
So, are you saying this is okay? I guess I'm at a loss in understanding why everyone seems to be so apathetic on this issue. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/
It also needs 1. Someone to complain to law enforcement 2. Law enforcement to decide this is something worth following up on re prosecution - especially if the crook is not within their jurisdiction, it'd be FBI, and they have a minimum threshold for damage caused (higher than the few thousand dollars a /16's registration fees cost?) [not counting 7.5 million bucks paid in aftermarket deals like microsoft from nortel] --srs On Thu, Mar 31, 2011 at 10:45 AM, Owen DeLong <owen@delong.com> wrote:
If they put it on letterhead and signed their own name in such a way that it purports to be an agent of the organization for which they were not an authorized agent, that is usually enough to become a criminal act, whether it is considered forgery, fraud, or something else, I'm not sure about the exact technicalities and they may vary by jurisdiction.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
On Mar 30, 2011, at 10:26 PM, Suresh Ramasubramanian wrote:
It also needs
1. Someone to complain to law enforcement
True,
2. Law enforcement to decide this is something worth following up on re prosecution - especially if the crook is not within their jurisdiction, it'd be FBI, and they have a minimum threshold for damage caused (higher than the few thousand dollars a /16's registration fees cost?)
Not necessarily... If the crook is in another county, same state, it could be simple extradition. If the crook is across state lines, it could still be handled as an extradition, but, slightly more complicated. If the crook is on the other side of an international boundary, that's a whole new ball of wax and the number of permutations of regulatory combinations involved prevents any rational enumeration here. Owen
[not counting 7.5 million bucks paid in aftermarket deals like microsoft from nortel]
--srs
On Thu, Mar 31, 2011 at 10:45 AM, Owen DeLong <owen@delong.com> wrote:
If they put it on letterhead and signed their own name in such a way that it purports to be an agent of the organization for which they were not an authorized agent, that is usually enough to become a criminal act, whether it is considered forgery, fraud, or something else, I'm not sure about the exact technicalities and they may vary by jurisdiction.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
Local law isnt likely to touch this at all. On Thu, Mar 31, 2011 at 11:27 AM, Owen DeLong <owen@delong.com> wrote:
If the crook is in another county, same state, it could be simple extradition.
If the crook is across state lines, it could still be handled as an extradition, but, slightly more complicated.
If the crook is on the other side of an international boundary, that's a whole new ball of wax and the number of permutations of regulatory combinations involved prevents any rational enumeration here.
-- Suresh Ramasubramanian (ops.lists@gmail.com)
On Thu, Mar 31, 2011 at 7:57 AM, Owen DeLong <owen@delong.com> wrote:
On Mar 30, 2011, at 10:26 PM, Suresh Ramasubramanian wrote:
It also needs
1. Someone to complain to law enforcement
True,
as has been brought up in the past here... some folk rely heavily upon IRR data for route prefix filtering. if the object is in the IRR database (with the right linkages), it gets permitted in router filters automagically. -chris (being able to validate 'ownership', really authorization to route, automatically will sure be nice, eh?)
On Thu, Mar 31, 2011 at 11:48 AM, Christopher Morrow <morrowc.lists@gmail.com> wrote:
On Thu, Mar 31, 2011 at 7:57 AM, Owen DeLong <owen@delong.com> wrote:
On Mar 30, 2011, at 10:26 PM, Suresh Ramasubramanian wrote:
It also needs
1. Someone to complain to law enforcement
True,
as has been brought up in the past here... some folk rely heavily upon IRR data for route prefix filtering. if the object is in the IRR database (with the right linkages), it gets permitted in router filters automagically.
I forgot: $ whois -h whois.radb.net 148.163.0.0 route: 148.163.0.0/16 descr: /16 for Celanese origin: AS13767 mnt-by: DBANK-MNT changed: jpope@databank.com 20090818 source: LEVEL3 (this means l3 proxy'd in the record, I think... maybe an L3 person can speak to this bit?)
-chris (being able to validate 'ownership', really authorization to route, automatically will sure be nice, eh?)
I don't believe this record indicates that Level3 proxy registered the route object. It means that someone used the DBANK-MNT maintainer ID in the Level3 RR to enter a route object 18 months ago. It looks like Level3 is originating the route in AS3356, not accepting it from AS13767 (which is what the object would suggest to do.) Oops, looks like the route is now gone. Guess it got cleaned. Tony On Thu, Mar 31, 2011 at 5:49 AM, Christopher Morrow <morrowc.lists@gmail.com
wrote:
I forgot: $ whois -h whois.radb.net 148.163.0.0 route: 148.163.0.0/16 descr: /16 for Celanese origin: AS13767 mnt-by: DBANK-MNT changed: jpope@databank.com 20090818 source: LEVEL3
(this means l3 proxy'd in the record, I think... maybe an L3 person can speak to this bit?)
-chris (being able to validate 'ownership', really authorization to route, automatically will sure be nice, eh?)
On Thu, Mar 31, 2011 at 5:33 PM, Tony Tauber <ttauber@1-4-5.net> wrote:
I don't believe this record indicates that Level3 proxy registered the route object. It means that someone used the DBANK-MNT maintainer ID in the Level3 RR to enter a route object 18 months ago.
possibly...
It looks like Level3 is originating the route in AS3356, not accepting it from AS13767 (which is what the object would suggest to do.)
Oops, looks like the route is now gone. Guess it got cleaned.
l3 ams router says: Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>i148.163.0.0/20 4.69.181.3 0 100 0 i * i 4.69.181.3 0 100 0 i *>i148.163.64.0/20 4.69.181.3 0 100 0 i * i 4.69.181.3 0 100 0 i * 148.163.178.0/24 213.206.131.45 100000 86 0 1239 13767 i * i 4.69.185.185 100 0 13767 i *>i 4.69.185.185 100 0 13767 i * 148.163.179.0/24 213.206.131.45 100000 86 0 1239 13767 i * i 4.69.185.185 100 0 13767 i *>i 4.69.185.185 100 0 13767 i * i148.163.224.0/19 4.69.181.3 0 100 0 i *>i 4.69.181.3 0 100 0 i there's a possibility that, in this case, L3 is simply holding up the /16 for their customer, sinking junk traffic and permitting more specifics by the customer? (it's not clear here, though the above seems to show sprint propogating databank's prefixes while L3 is originating some parts of the /16 still. <http://www.robtex.com/as/as13767.html> indicates that the 2 upstreams for databank are apparently L3 and sprint. -Chris
Tony
On Thu, Mar 31, 2011 at 5:49 AM, Christopher Morrow <morrowc.lists@gmail.com> wrote:
I forgot: $ whois -h whois.radb.net 148.163.0.0 route: 148.163.0.0/16 descr: /16 for Celanese origin: AS13767 mnt-by: DBANK-MNT changed: jpope@databank.com 20090818 source: LEVEL3
(this means l3 proxy'd in the record, I think... maybe an L3 person can speak to this bit?)
-chris (being able to validate 'ownership', really authorization to route, automatically will sure be nice, eh?)
In message <Pine.OSX.4.64.1103310053260.312@cevin-2.local>, Brandon Ross <bross@pobox.com> wrote:
On Wed, 30 Mar 2011, Ross Harvey wrote:
Wait a second, I'm pretty sure that in most contexts, a signature or letterhead means not so much "this is real because it's so obviously genuine", but rather:
"This is real or I am willing to take a forgery rap".
Do you think most providers check the signer's ID to make sure they actually signed their own name? How do you prove that whomever you accuse of signing it actually forged it if not?
Does anyone know of there ever being even a single case where someone was convicted of forgery for this?
Excuse me, but I think that this discussion is starting to stray rather far from either the known or the reasonably plausible facts. In the first place, I do not accept the theory that either Circle Internet or Bandcon were hoodwinked by cleverly forged letterheads, and there is no evidence I am aware of which would support that theory. Until, if ever, additional facts are forthcoming, I believe that it is just as plausible that some spammer simply came to each of these companies and said to them "Hi! I really want to hijack these two unused /16 blocks. Will you help me?" and that one, or another, or perhaps both of these companies simply replied "Yea. Sure. We didn't quite make our quarterly numbers, and we are always on the lookout for new revenue streams. So how much money do you intend to give us if we help you with this, exactly?" In the second place, this amusing "letterhead fraud" theory only holds up if one also believes that, upon being presented with a mere forged letterhead, allegedly coming in "over the transom" as it were, i.e. from a previously unknown source, along with a request to announce some routes to a couple of sizable blocks of IPv4 space, neither Circle Internet nor BandCon even bothered to pick up the bleepin' phone to call the contact number that is/was plainly visible for all to see, right there in the relevant ARIN allocation WHOIS records for the IPv4 space in question. Then there is also the small matter of the name on the _checks_... you know... the checks that _somebody_ had to write, in the first instance, before either BandcCon or Circle Internet would have been likely to provide _any_ kind of service to some new and total stranger. Or was this "duped by clever forgeries" single bullet theory that you folks have been dis- cussing also intended to include the forging of CHECKS in the name of "Hoechst Celanese Corporation"? See, no matter how you slice it, both BandCon and Circle Internet have a lot of explaining to do. At the very least, and even if this implausible "forged letterhead" theory were true... which I gravely doubt... both BandCon and Circle Internet have been rather grotesquely negligent, i.e. in accepting, without any checking whatsoever, the representations made to them by some total stranger who simply para- chutted out of the clouds one day, clutching a forged letterhead in one hand and a bag of unmarked small denomination bills in the other. So that's the very least... the companies were both, at the very least, rather stupendously negligent. At the very worst on the other hand, one or another or both of them may have been entirely "in on" and part of these hijacking schemes/scams from the get-go. I myself would tend to go with the latter theory, simply because it is the only one that would seem to make any sense, you know, logically. Ask yourself which of these theories seems the most plausible? 1) The spammer forged two checks in the name "Hoechst Celanese Corporation" and gave one each to Circle Internet and BandCon, respectively, along with similarly forged letters of introduction and requests for routing of IP space. Unless I am misremembering, this means that the spammer would have engaged in not one but TWO very serious federal fraud offenses. Even sleezy low-life spammers do not customarily accept this level of risk, e.g. just to get their hands on some IPv4 space which, we must remember, is only likely to be of value to them for a relatively brief period of time, EVEN IF they can manage to keep it routed. 2) The spammers gave Circle Internet and BandCon forged letters of introduction (on forged letterheads) and requests for routing services, and gave the two companies -zero- actually money, and nonetheless, both companies started happily announcing routes for the purported "Hoechst Celanese Corporation", even though neither company received a dime for this service, and even though they both CONTINUED to provide this service, utterly for free, apparently for at least THREE FULL MONTHS. 3) The spammers gave Circle Internet and BandCon forged letters of introduction (on forged letterheads) and requests for routing services, and gave the two companies checks that were NOT "Hoechst Celanese Corporation" checks (either forged or otherwise), and then both Circle Internet and BandCon just cashed BOTH of those two checks (which were presumably written against the account of "Joe's Fly-By-Night Spammery and Pizza Parlor") and both companies cashed these two checks without ever even looking at them or even wondering aloud why "Joe's Fly-By-Night Spammery and Pizza Parlor" would be paying for Internet services which were ACTUALLY going to be delivered to the large and internationally-known Hoechst Celanese chemical company (which is, quite obviously, perfecly capable of paying its own ISP bills, thank you very much). 4) The spammers simply went to Circle Internet and BandCon and said "We want to hijack some IP space. If you help us, we'll pay you handsomly for your trouble." and both companies simply replied "Yea. Sure. We like money. And as far as we know, nobody's ever gone to jail for hijacking IP space, so, um, what the hell! When did you want to get started?" The first three theories are, in my opinion, utterly implausible. That doesn't really leave very much to wonder about. Let me put this all to you another way. I would like to respectfully suggest that anybody who is actually taking this "forged letterhead" fairy story seriously should write to both Circle Internet and BandCon, explain to them both that either their competence or their honesty, or both, have been the subject of questions here on the NANOG list, and that they would each do well to make some sort of a clarifying comment... or, if possible, a refu- tation... here on the NANOG list. If they were merly hoodwinked, well then they should come here, admit that, explain to us all exactly how it happened (so that nobody else will get taken in in the same way in future) and thus set the record straight. Yes, it will always be a bit embarrasing to admit that you were hoodwinked, but that is still a damn sight better than being publically reputed to be outright crooked. So please, if you really think that these companies were merely hoodwinked, and that they were NOT in on the (hijacking) deal from the get-go, please invite them to come here to the NANOG list and clear the air, along with their names. I got twenty bucks that says that no verifiable official representative of either company will be making an appearance here anytime soon, or that if they do, they won't be taking any questions. Any takers? Regards, rfg
In message <BE8C4985-F955-4868-8145-146E57BBF639@pch.net>, Bill Woodcock <woody@pch.net> wrote:
On Mar 30, 2011, at 1:58 PM, Ronald F. Guilmette wrote:
As I already mentioned, 159.223.0.0/16, which is actually registered = to the Hoechst Celanese Corporation, has quite obviously been hijacked
And have you reported this to ARIN?
No. Why would I? The ARIN folks have already made it abundantly clear... to me and to others... that this sort of thing is "Not our job, man." ARIN maintains a data base. If other people elect to ignore what's in that data base... well... as anybody from ARIN will be only too happy to tell you, they are not the routing police. Regards, rfg
Ronald... Cleaning up the routing, true. However, this sounds like there are two issues... 1. Routing -- Would be nice if the advertising provider(s) stopped doing so. Not something ARIN can really do much about. 2. Database -- Sounds like the existing resource holder may not still be using the resource or may no longer exist. In either case, it's worth having ARIN investigate the situation and take appropriate database action if that is the case. Owen Sent from my iPad On Mar 30, 2011, at 4:59 PM, "Ronald F. Guilmette" <rfg@tristatelogic.com> wrote:
In message <BE8C4985-F955-4868-8145-146E57BBF639@pch.net>, Bill Woodcock <woody@pch.net> wrote:
On Mar 30, 2011, at 1:58 PM, Ronald F. Guilmette wrote:
As I already mentioned, 159.223.0.0/16, which is actually registered = to the Hoechst Celanese Corporation, has quite obviously been hijacked
And have you reported this to ARIN?
No. Why would I?
The ARIN folks have already made it abundantly clear... to me and to others... that this sort of thing is "Not our job, man."
ARIN maintains a data base. If other people elect to ignore what's in that data base... well... as anybody from ARIN will be only too happy to tell you, they are not the routing police.
Regards, rfg
In message <B2506B41-AD1F-4FB0-9D8E-C0A54E44B890@delong.com>, Owen DeLong <owen@delong.com> wrote:
Cleaning up the routing {is not what ARIN does or thinks it should do}, true.
However, this sounds like there are two issues...
1. Routing -- Would be nice if the advertising provider(s) stopped doing so. Not something ARIN can really do much about.
2. Database -- Sounds like the existing resource holder may not still be using the resource or may no longer exist. In either case, it's worth having ARIN investigate the situation and take appropriate database action if that is the case.
Worth it to whom? I can tell you quite frankly that it sure as shineola isn't worth wasting even one more additional second of _my_ time to try to beg, plead, cajole, or browbeat ARIN/Curran into cleaning up the mess that is the IPv4 allocation data base. I've been down that road already, and all I have to show for it is a couple of prominent boot marks on my ass and a couple of new enemies- for-life... neither of which I really needed. And also, frankly, I am utterly dumbfounded that you, of all people, should be the one to suggest that this particular cock-up in the IPv4 allocation data base is something that should be fixed. I mean really, WTF? Didn't you, and I, and several other people already go through all of this at least a couple of dozen times already on the ARIN public policy mailing list? And wasn't it you, in particular, who was consistantly the most vocal and avid proponent of the view that ANY effort expended on cleaning up the IPv4 allocations DB would be an utter waste of time and valuable manpower, and that ultimately, any efforts along those lines would only serve to give those procrastinating on the inevitable shift to IPv6 more time to procrastinate? Seriously, I was left with the impression that if IPv6 were a person, it would be you, and that if it were a company, you would be the majority shareholder. (Not that there would be anything wrong with that.) Now all of a sudden you actually CARE about IPv4 allocations?? I say again, WTF? Color me flabberghasted. Anyway, none of this makes any difference. If somebody (you?) wants to report either or both of these hijacked IPv4 blocks to ARIN... well... be my guest. If your plan was to wait around for me to do it, you are in for a long wait. I have more productive uses for my time just now, like counting the pennies in my change jar and checking Craigslist for mint Rolls Royces priced under a dollar. Regards, rfg
On Thu, Mar 31, 2011 at 3:11 AM, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:
...
Seriously, I was left with the impression that if IPv6 were a person, it would be you, and that if it were a company, you would be the majority shareholder. (Not that there would be anything wrong with that.)
I for one would put money on the table towards the "rename Owen to Mr. IPv6" effort. I think it would be wonderful to be able to honestly say "IPv6 is in da house!" every time the person formerly known as Owen walked into the room at ARIN meetings. :D Matt
-----Original Message----- From: Matthew Petach [mailto:mpetach@netflight.com] Sent: Thursday, March 31, 2011 2:28 PM
I for one would put money on the table towards the "rename Owen to Mr. IPv6" effort. I think it would be wonderful to be able to honestly say "IPv6 is in da house!" every time the person formerly known as Owen walked into the room at ARIN meetings. :D
+1 | That, or "The evangelist formerly known as Owen..." :p Stefan Fouant
On Mar 31, 2011, at 12:01 PM, Stefan Fouant wrote:
-----Original Message----- From: Matthew Petach [mailto:mpetach@netflight.com] Sent: Thursday, March 31, 2011 2:28 PM
I for one would put money on the table towards the "rename Owen to Mr. IPv6" effort. I think it would be wonderful to be able to honestly say "IPv6 is in da house!" every time the person formerly known as Owen walked into the room at ARIN meetings. :D
+1 | That, or "The evangelist formerly known as Owen..." :p
Stefan Fouant
ROFLMAO Owen
I for one would put money on the table towards the "rename Owen to Mr. IPv6" effort. I think it would be wonderful to be able to honestly say "IPv6 is in da house!" every time the person formerly known as Owen walked into the room at ARIN meetings. :D
"Like a v6, like a v6" could be the soundtrack... :-) []s Rafael Cresci
On Fri, Apr 1, 2011 at 12:31 AM, Stefan Fouant <sfouant@shortestpathfirst.net> wrote:
+1 | That, or "The evangelist formerly known as Owen..." :p
No no ... TEFKAO. -- Suresh Ramasubramanian (ops.lists@gmail.com)
participants (13)
-
Bill Woodcock -
Brandon Ross -
Christopher Morrow -
Jim Gonzalez -
Matthew Petach -
Owen DeLong -
Paul Ferguson -
Rafael Cresci -
Ronald F. Guilmette -
Ross Harvey -
Stefan Fouant -
Suresh Ramasubramanian -
Tony Tauber