OT: Interesting email I received
Geez... Can they paint a bigger target on themselves? Has anyone else gotten this? -dan -----Original Message----- From: National ISP [mailto:admin@national-isp.org] Sent: Friday, February 01, 2002 3:13 PM To: dlark@elmresources.com Subject: Bulk email ISP National ISP Co. is a business class bulk email friendly ISP. We are dedicated to supporting your company with your email advertising program. Have the "Peace of Mind", knowing that you will not be shut down by your present ISP. our website address is >> WWW.NATIONAL-ISP.ORG please call our office for more information and prices. Phone: 336.841.5156 and ask for Paul or Len. ask about our referral program if you wish to be removed from our mailing list please write "remove" on the subject line and return to us.
On Fri, 1 Feb 2002 13:35:32 -0700 Daniel Lark <dlark@elmresources.com> wrote:
Geez... Can they paint a bigger target on themselves?
don't jump to conclusions; it might be a joe-job. wait-and-see is indicated. richard -- Richard Welty Averill Park Networking Unix, Linux, IP Network Engineering, Security rwelty@averillpark.net 518-573-7592
On Fri, 1 Feb 2002, Richard Welty wrote:
On Fri, 1 Feb 2002 13:35:32 -0700 Daniel Lark <dlark@elmresources.com> wrote:
Geez... Can they paint a bigger target on themselves? don't jump to conclusions; it might be a joe-job. wait-and-see is indicated.
Did you, uh.. *cough*... look at their web page? -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]
On Fri, 1 Feb 2002 13:29:17 -0800 (PST) Dan Hollis <goemon@anime.net> wrote:
On Fri, 1 Feb 2002, Richard Welty wrote:
On Fri, 1 Feb 2002 13:35:32 -0700 Daniel Lark <dlark@elmresources.com> wrote:
Geez... Can they paint a bigger target on themselves? don't jump to conclusions; it might be a joe-job. wait-and-see is indicated.
Did you, uh.. *cough*... look at their web page?
no, but i'll take your word for it and withdraw my comment. time to add some IP addresses to the list. richard -- Richard Welty Averill Park Networking Unix, Linux, IP Network Engineering, Security rwelty@averillpark.net 518-573-7592
At 04:29 PM 2/1/2002 -0500, Richard Welty wrote:
time to add some IP addresses to the list.
Qwest Communications (NETBLK-NET-QWEST-BLKS-4) NET-QWEST-BLKS-4 65.112.0.0 - 65.121.255.255 CNS SYSTEMS INC (NETBLK-Q1130-65-114-61-32) Q1130-65-114-61-32 65.114.61.32 - 65.114.61.47 They're obviously a high profile Qwest customer, with their very own huge /28. Bye bye 65.114.61.32/28. We'll all miss talking to you. I feel sorry the soul that inherits the block, after this company has put it in access lists across our fine globe.
richard -- Richard Welty Averill Park Networking Unix, Linux, IP Network Engineering, Security rwelty@averillpark.net 518-573-7592
-- Christopher Schulte http://www.schulte.org/ Do not un-munge my @nospam.schulte.org email address. This address is valid.
Looks like SPAMHAUS has 'em. RBL and MAPS have 'em too. I just love it when all come together as a community ;-). -dan -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Christopher Schulte Sent: Friday, February 01, 2002 2:44 PM To: Richard Welty; nanog@merit.edu Subject: Re[2]: OT: Interesting email I received At 04:29 PM 2/1/2002 -0500, Richard Welty wrote:
time to add some IP addresses to the list.
Qwest Communications (NETBLK-NET-QWEST-BLKS-4) NET-QWEST-BLKS-4 65.112.0.0 - 65.121.255.255 CNS SYSTEMS INC (NETBLK-Q1130-65-114-61-32) Q1130-65-114-61-32 65.114.61.32 - 65.114.61.47 They're obviously a high profile Qwest customer, with their very own huge /28. Bye bye 65.114.61.32/28. We'll all miss talking to you. I feel sorry the soul that inherits the block, after this company has put it in access lists across our fine globe.
richard -- Richard Welty Averill Park Networking Unix, Linux, IP Network Engineering, Security rwelty@averillpark.net 518-573-7592
-- Christopher Schulte http://www.schulte.org/ Do not un-munge my @nospam.schulte.org email address. This address is valid.
On Fri, Feb 01, 2002 at 03:44:03PM -0600, Christopher Schulte wrote:
Bye bye 65.114.61.32/28. We'll all miss talking to you. I feel sorry the soul that inherits the block, after this company has put it in access lists across our fine globe.
This isn't too evil, is it? add deny tcp from any to 65.114.61.32/28 out xmit xl0 tcpflags !syn -- Bob <melange@yip.org> | Please don't feed the sock puppet.
* goemon@anime.net (Dan Hollis) [Fri 01 Feb 2002, 22:29 CET]:
On Fri, 1 Feb 2002, Richard Welty wrote:
On Fri, 1 Feb 2002 13:35:32 -0700 Daniel Lark <dlark@elmresources.com> wrote:
Geez... Can they paint a bigger target on themselves? don't jump to conclusions; it might be a joe-job. wait-and-see is indicated. Did you, uh.. *cough*... look at their web page?
Just tried to; HTTP connections time out, traceroute ends in * * *. Luckily it's been archived for posterity and still available here: http://web.archive.org/web/20020123192839/http://www.national-isp.org/ Quoting some text from there: | National ISP Company is a business class BULK EMAIL INTERNET SERVICE | PROVIDER, (ISP). Your high volume email ads are sent directly from | our servers to your recipients. [..] | Our ONLY business is providing Internet Access for your email sending. If it's a joe job, it's a particularly well-executed one, also defacing the website and eradicating all traces of another company that legitly used that IP space... Regards, -- Niels. -- "The Internet is totally out of control, impossible to map accurately, and being used far beyond its original intentions. So far, so good." -- Dr. Dobb's Journal, May 1993
On Fri, 1 Feb 2002, Daniel Lark wrote:
-----Original Message----- From: National ISP [mailto:admin@national-isp.org] Sent: Friday, February 01, 2002 3:13 PM To: dlark@elmresources.com Subject: Bulk email ISP National ISP Co. is a business class bulk email friendly ISP. We are dedicated to supporting your company with your email advertising program. Have the "Peace of Mind", knowing that you will not be shut down by your present ISP. our website address is >> WWW.NATIONAL-ISP.ORG
Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 msec 144 msec 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec Well, qwest *is* bulk-friendly... -Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]
On Fri, 1 Feb 2002 12:43:10 -0800 (PST) Dan Hollis <goemon@anime.net> wrote:
Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 msec 144 msec 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec
Well, qwest *is* bulk-friendly...
now, now, qwest is improving. their abuse staff is making a serious effort, and cleaning up spam messes always takes time. richard -- Richard Welty Averill Park Networking Unix, Linux, IP Network Engineering, Security rwelty@averillpark.net 518-573-7592
National ISP Co. is a business class bulk email friendly ISP. Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 msec 144 msec 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec
Well, qwest *is* bulk-friendly...
We've been tracking spam closely as the geeks in the back room are homebrewing 'SpamShredder'.. and Andrew (the head anti-spam programmer) told me today that just over 50% of what we are seeing is coming from Qwest controlled IP's, mostly low end resell dial-ups.
Oh they're definitely off of qwest: Registrant: CnS Systems, Inc. (NATIONALISP11-DOM) 4304 Hunter Oaks Dr. High Point, NC 27265 US Domain Name: NATIONAL-ISP.ORG Administrative Contact, Billing Contact: CnS Systems, Inc. (UOLABCFHYO) ecotton@cnssystems.com CnS Systems, Inc. 4304 Hunter Oaks Dr. High Point, NC 27265 US 3368698508 Technical Contact: VeriSign, Inc. (HOST-ORG) namehost@WORLDNIC.NET VeriSign, Inc. 21355 Ridgetop Circle Dulles, VA 20166 US 1-888-642-9675 fax: Record last updated on 03-Jan-2002. Record expires on 20-Dec-2003. Record created on 20-Dec-2001. Database last updated on 1-Feb-2002 01:31:00 EST. Domain servers in listed order: DCA-ANS-01.INET.QWEST.NET 205.171.9.242 SVL-ANS-01.INET.QWEST.NET 205.171.14.195 Now will qwest "do the right thing" seeing as how blatant this is? -dan -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of mike harrison Sent: Friday, February 01, 2002 1:47 PM To: Dan Hollis Cc: Daniel Lark; nanog@merit.edu Subject: Re: OT: Interesting email I received
National ISP Co. is a business class bulk email friendly ISP. Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 msec 144 msec 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec
Well, qwest *is* bulk-friendly...
We've been tracking spam closely as the geeks in the back room are homebrewing 'SpamShredder'.. and Andrew (the head anti-spam programmer) told me today that just over 50% of what we are seeing is coming from Qwest controlled IP's, mostly low end resell dial-ups.
Given the latency on the last two hops, I'll bet this is a DSL line, or someone's taken it upon themselves to render whatever circuit they have useless... -C On Fri, Feb 01, 2002 at 12:43:10PM -0800, Dan Hollis wrote:
On Fri, 1 Feb 2002, Daniel Lark wrote:
-----Original Message----- From: National ISP [mailto:admin@national-isp.org] Sent: Friday, February 01, 2002 3:13 PM To: dlark@elmresources.com Subject: Bulk email ISP National ISP Co. is a business class bulk email friendly ISP. We are dedicated to supporting your company with your email advertising program. Have the "Peace of Mind", knowing that you will not be shut down by your present ISP. our website address is >> WWW.NATIONAL-ISP.ORG
Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100 msec 144 msec 16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec
Well, qwest *is* bulk-friendly...
-Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]
-- --------------------------- Christopher A. Woodfield rekoil@semihuman.com PGP Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B
Guess Qwest already yanked 'em. Yay!!! -dan traceroute to 65.114.61.35 (65.114.61.35), 30 hops max, 38 byte packets 1 host1.elmresources.com (208.253.213.1) 0.588 ms 0.558 ms 0.474 ms 2 958.Serial1-1.GW6.SCL1.ALTER.NET (157.130.213.173) 10.282 ms 9.652 ms 13.142 ms 3 168.at-5-0-0.XR4.SCL1.ALTER.NET (152.63.52.54) 9.691 ms 10.168 ms 9.997 ms 4 0.so-1-0-0.XL2.SCL1.ALTER.NET (152.63.55.97) 9.978 ms 10.341 ms 9.870 ms 5 0.so-6-0-0.XL2.SAC1.ALTER.NET (152.63.54.142) 15.447 ms 16.494 ms 15.253 ms 6 0.so-3-0-0.XR2.SAC1.ALTER.NET (152.63.54.2) 14.642 ms 15.195 ms 14.934 ms 7 184.ATM7-0.BR3.SAC1.ALTER.NET (152.63.50.197) 15.544 ms 14.990 ms 15.905 ms 8 sjo-brdr-04.inet.qwest.net (205.171.4.97) 28.136 ms 27.808 ms 27.985 ms 9 sjo-core-01.inet.qwest.net (205.171.22.118) 29.459 ms 28.163 ms 27.818 ms 10 sjo-core-02.inet.qwest.net (205.171.22.2) 28.376 ms 27.821 ms 28.014 ms 11 iah-core-01.inet.qwest.net (205.171.5.145) 68.262 ms 68.128 ms 68.277 ms 12 iah-core-02.inet.qwest.net (205.171.31.2) 68.851 ms 69.238 ms 69.663 ms 13 atl-core-02.inet.qwest.net (205.171.5.194) 101.938 ms 103.496 ms 101.837 ms 14 atl-edge-14.inet.qwest.net (205.171.21.182) 94.106 ms 93.772 ms 93.874 ms 15 * * * -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Christopher A. Woodfield Sent: Friday, February 01, 2002 2:56 PM To: Dan Hollis Cc: Daniel Lark; nanog@merit.edu Subject: Re: OT: Interesting email I received Given the latency on the last two hops, I'll bet this is a DSL line, or someone's taken it upon themselves to render whatever circuit they have useless... -C On Fri, Feb 01, 2002 at 12:43:10PM -0800, Dan Hollis wrote:
On Fri, 1 Feb 2002, Daniel Lark wrote:
-----Original Message----- From: National ISP [mailto:admin@national-isp.org] Sent: Friday, February 01, 2002 3:13 PM To: dlark@elmresources.com Subject: Bulk email ISP National ISP Co. is a business class bulk email friendly ISP. We are dedicated to supporting your company with your email advertising program. Have the "Peace of Mind", knowing that you will not be shut down by your present ISP. our website address is >> WWW.NATIONAL-ISP.ORG
Tracing the route to NATIONAL-ISP.ORG (65.114.61.35) [...] 15 atl-edge-14.inet.qwest.net (205.171.21.182) [AS 209] 132 msec 100
msec 144 msec
16 208.47.124.58 [AS 209] 388 msec 852 msec 608 msec 17 NATIONAL-ISP.ORG (65.114.61.35) [AS 209] 524 msec 584 msec 268 msec
Well, qwest *is* bulk-friendly...
-Dan -- [-] Omae no subete no kichi wa ore no mono da. [-]
-- --------------------------- Christopher A. Woodfield rekoil@semihuman.com PGP Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B
On Fri, Feb 01, 2002 at 03:04:45PM -0700, dlark@elmresources.com said:
Guess Qwest already yanked 'em. Yay!!!
Wishful thinking, I'm afraid. =\ ==== [sfrancis@www:~]$ traceroute national-isp.org traceroute to national-isp.org (65.114.61.35), 30 hops max, 40 byte packets 1 vs-lax1-fe-1-0-0.la.hosting.com (216.55.0.17) 0.741 ms 0.648 ms 16.081 ms 2 lax-edge-08.inet.qwest.net (205.171.57.105) 16.378 ms 16.390 ms 16.197 ms 3 lax-core-01.inet.qwest.net (205.171.19.141) 16.700 ms 16.435 ms 16.377 ms 4 iah-core-01.inet.qwest.net (205.171.5.161) 48.602 ms 48.487 ms 33.277 ms 5 iah-core-02.inet.qwest.net (205.171.31.2) 33.175 ms 33.094 ms 33.309 ms 6 atl-core-02.inet.qwest.net (205.171.5.194) 64.509 ms 64.685 ms 65.890 ms 7 atl-edge-14.inet.qwest.net (205.171.21.182) 64.733 ms 64.584 ms 64.858 ms 8 208.47.124.58 (208.47.124.58) 81.921 ms 81.005 ms 81.103 ms 9 national-isp.org (65.114.61.35) 80.727 ms 80.878 ms 81.825 ms ==== -- Scott Francis darkuncle@ [home:] d a r k u n c l e . n e t Systems/Network Manager sfrancis@ [work:] t o n o s . c o m GPG public key 0xCB33CCA7 illum oportet crescere me autem minui
participants (9)
-
Bob K -
Christopher A. Woodfield -
Christopher Schulte -
Dan Hollis -
Daniel Lark -
mike harrison -
Niels Bakker -
Richard Welty -
Scott Francis