HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?
I just stumbled onto this one the other day. Apparently, Spamhaus has known about this one for THREE MONTHS already: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308 It's being routed by AS11730, aka "Circle Internet LTD", a known spammer- friendly provider that I have come across many times in the past. They in turn are getting connectivity from: AS26769 BandCon AS7385 Integra Telecom These companies are also not known for being especially scruplous either. But I mean seriously, Jesus Christ! Does ANYBODY even give a crap about blatant naked IP space hijacking anymore? Or is the entire net now on its final slow descent into utter chaos? Regards, rfg P.S. The 159.223.0.0/16 block is actually registered to the chemical company Hoechst Celanese Corporation. I'll have more to say about that in just a moment. Meanwhile listed below is some of the snowshoe spammer crud that is alive and active inside of 159.223.0.0/16, even as we speak. (I am not posting all of it because there's just too much, and posting all of it would exceed the NANOG list's 100kb limit.) 159.223.7.2 advocateagents.com 159.223.7.3 tsoppi.advocateagents.com 159.223.7.4 trudi.advocateagents.com 159.223.7.5 typist.advocateagents.com 159.223.7.6 jasmine.advocateagents.com 159.223.7.7 jimenez.advocateagents.com 159.223.7.8 korene.advocateagents.com 159.223.7.9 jece.advocateagents.com 159.223.7.10 movie.advocateagents.com 159.223.7.11 ophiucus.advocateagents.com 159.223.7.12 vljublennych.advocateagents.com 159.223.7.13 jiriki.advocateagents.com 159.223.7.14 jedediah.advocateagents.com 159.223.7.15 streetwalker.advocateagents.com 159.223.7.16 augustus.advocateagents.com 159.223.7.17 jada.advocateagents.com 159.223.7.18 earth.advocateagents.com 159.223.7.19 sugawara.advocateagents.com 159.223.7.20 herculean.advocateagents.com 159.223.7.21 takala.advocateagents.com 159.223.7.22 gradient.advocateagents.com 159.223.7.23 feddersen.advocateagents.com 159.223.7.24 messiter.advocateagents.com 159.223.7.25 polar.advocateagents.com 159.223.7.26 doughboy.advocateagents.com 159.223.7.27 chalgrin.advocateagents.com 159.223.7.28 meatball.advocateagents.com 159.223.7.29 conseil.advocateagents.com 159.223.7.30 sprotte.advocateagents.com 159.223.7.31 lackaye.advocateagents.com 159.223.7.32 maquis.advocateagents.com 159.223.7.33 freethink.advocateagents.com 159.223.7.34 morven.advocateagents.com 159.223.7.35 infimum.advocateagents.com 159.223.7.36 vasile.advocateagents.com 159.223.7.37 violey.advocateagents.com 159.223.7.38 deoxyribonucleic.advocateagents.com 159.223.7.39 buyett.advocateagents.com 159.223.7.40 gon.advocateagents.com 159.223.7.41 edra.advocateagents.com 159.223.7.42 pickwick.advocateagents.com 159.223.7.43 jimpson.advocateagents.com 159.223.7.44 trintignant.advocateagents.com 159.223.7.45 holzschuh.advocateagents.com 159.223.7.46 danish.advocateagents.com 159.223.7.47 jail.advocateagents.com 159.223.7.48 krischan.advocateagents.com 159.223.7.49 lauritz.advocateagents.com 159.223.7.50 confluent.advocateagents.com 159.223.7.51 cunegonde.advocateagents.com 159.223.7.52 comb.advocateagents.com 159.223.7.53 ndurinnor.advocateagents.com 159.223.7.54 cordoba.advocateagents.com 159.223.7.55 lenora.advocateagents.com 159.223.7.56 boatright.advocateagents.com 159.223.7.57 syenite.advocateagents.com 159.223.7.58 echo.advocateagents.com 159.223.7.59 jesli.advocateagents.com 159.223.7.60 harriette.advocateagents.com 159.223.7.61 dotting.advocateagents.com 159.223.7.62 brogan.advocateagents.com 159.223.7.63 steeplebush.advocateagents.com 159.223.7.64 basis.advocateagents.com 159.223.7.65 cardenio.advocateagents.com 159.223.7.66 lumen.advocateagents.com 159.223.7.67 pitiable.advocateagents.com 159.223.7.68 blasphemous.advocateagents.com 159.223.7.69 polopony.advocateagents.com 159.223.7.70 cesium.advocateagents.com 159.223.7.71 calvo.advocateagents.com 159.223.7.72 linkers.advocateagents.com 159.223.7.73 mette.advocateagents.com 159.223.7.74 eris.advocateagents.com 159.223.7.75 oppressive.advocateagents.com 159.223.7.76 wlodek.advocateagents.com 159.223.7.77 islamic.advocateagents.com 159.223.7.78 lucan.advocateagents.com 159.223.7.79 henpeck.advocateagents.com 159.223.7.80 savannah.advocateagents.com 159.223.7.81 lemuels.advocateagents.com 159.223.7.82 monoceros.advocateagents.com 159.223.7.83 aames.advocateagents.com 159.223.7.84 froth.advocateagents.com 159.223.7.85 shipbuild.advocateagents.com 159.223.7.86 rule.advocateagents.com 159.223.7.87 khun.advocateagents.com 159.223.7.88 crandal.advocateagents.com 159.223.7.89 mclaughlin.advocateagents.com 159.223.7.90 trumaine.advocateagents.com 159.223.7.91 albertazzi.advocateagents.com 159.223.7.92 daidoji.advocateagents.com 159.223.7.93 candlestick.advocateagents.com 159.223.7.94 southampton.advocateagents.com 159.223.7.95 paulot.advocateagents.com 159.223.7.96 rivkah.advocateagents.com 159.223.7.97 tollgate.advocateagents.com 159.223.7.98 caius.advocateagents.com 159.223.7.99 savalas.advocateagents.com 159.223.7.100 pimlico.advocateagents.com 159.223.7.101 noce.advocateagents.com 159.223.7.102 bandana.advocateagents.com 159.223.7.103 tibbett.advocateagents.com 159.223.7.104 retour.advocateagents.com 159.223.7.105 gladwin.advocateagents.com 159.223.7.106 felippa.advocateagents.com 159.223.7.107 rosie.advocateagents.com 159.223.7.108 burchnall.advocateagents.com 159.223.7.109 indispose.advocateagents.com 159.223.7.110 yeardley.advocateagents.com 159.223.7.111 soji.advocateagents.com 159.223.7.112 baseband.advocateagents.com 159.223.7.113 aguistin.advocateagents.com 159.223.7.114 akemi.advocateagents.com 159.223.7.115 morales.advocateagents.com 159.223.7.116 kirwin.advocateagents.com 159.223.7.117 longwinded.advocateagents.com 159.223.7.118 grimaldi.advocateagents.com 159.223.7.119 sheik.advocateagents.com 159.223.7.120 karageorge.advocateagents.com 159.223.7.121 gennaro.advocateagents.com 159.223.7.122 yui.advocateagents.com 159.223.7.123 posteriori.advocateagents.com 159.223.7.124 rheba.advocateagents.com 159.223.7.125 kial.advocateagents.com 159.223.7.126 flo.advocateagents.com 159.223.7.127 inhibit.advocateagents.com 159.223.7.128 province.advocateagents.com 159.223.7.129 kazumi.advocateagents.com 159.223.7.130 baptiste.advocateagents.com 159.223.7.131 borner.advocateagents.com 159.223.7.132 shamadin.advocateagents.com 159.223.7.133 pelvic.advocateagents.com 159.223.7.134 rikke.advocateagents.com 159.223.7.135 fend.advocateagents.com 159.223.7.136 does.advocateagents.com 159.223.7.137 vinyl.advocateagents.com 159.223.7.138 mutuel.advocateagents.com 159.223.7.139 mong.advocateagents.com 159.223.7.140 sting.advocateagents.com 159.223.7.141 inkilinoff.advocateagents.com 159.223.7.142 calgagni.advocateagents.com 159.223.7.143 annulled.advocateagents.com 159.223.7.144 bolen.advocateagents.com 159.223.7.145 mazurowna.advocateagents.com 159.223.7.146 daw.advocateagents.com 159.223.7.147 marusia.advocateagents.com 159.223.7.148 hydrocyanic.advocateagents.com 159.223.7.149 admonition.advocateagents.com 159.223.7.150 clearboy.advocateagents.com 159.223.7.151 borisenko.advocateagents.com 159.223.7.152 nutrice.advocateagents.com 159.223.7.153 deshe.advocateagents.com 159.223.7.154 pellow.advocateagents.com 159.223.7.155 wrote.advocateagents.com 159.223.7.156 iranian.advocateagents.com 159.223.7.157 quere.advocateagents.com 159.223.7.158 acrimonious.advocateagents.com 159.223.7.159 bundgaard.advocateagents.com 159.223.7.160 footsie.advocateagents.com 159.223.7.161 engracia.advocateagents.com 159.223.7.162 burnecker.advocateagents.com 159.223.7.163 hodiak.advocateagents.com 159.223.7.164 pinner.advocateagents.com 159.223.7.165 animator.advocateagents.com 159.223.7.166 malo.advocateagents.com 159.223.7.167 specimans.advocateagents.com 159.223.7.168 thiamin.advocateagents.com 159.223.7.169 sadayoo.advocateagents.com 159.223.7.170 fadern.advocateagents.com 159.223.7.171 druid.advocateagents.com 159.223.7.172 szilard.advocateagents.com 159.223.7.173 arlee.advocateagents.com 159.223.7.174 levasseur.advocateagents.com 159.223.7.175 barwick.advocateagents.com 159.223.7.176 quayle.advocateagents.com 159.223.7.177 rubens.advocateagents.com 159.223.7.178 vinci.advocateagents.com 159.223.7.179 yoshiki.advocateagents.com 159.223.7.180 litvinoff.advocateagents.com 159.223.7.181 sanoilov.advocateagents.com 159.223.7.182 kilojoule.advocateagents.com 159.223.7.183 kopestonsky.advocateagents.com 159.223.7.184 retainer.advocateagents.com 159.223.7.185 bernt.advocateagents.com 159.223.7.186 mirjana.advocateagents.com 159.223.7.187 jamesy.advocateagents.com 159.223.7.188 chinn.advocateagents.com 159.223.7.189 sturgeon.advocateagents.com 159.223.7.190 hay.advocateagents.com 159.223.7.191 zarimba.advocateagents.com 159.223.7.192 centrex.advocateagents.com 159.223.7.193 lifelike.advocateagents.com 159.223.7.194 finn.advocateagents.com 159.223.7.195 colorate.advocateagents.com 159.223.7.196 mclain.advocateagents.com 159.223.7.197 aba.advocateagents.com 159.223.7.198 fountainhead.advocateagents.com 159.223.7.199 sadist.advocateagents.com 159.223.7.200 gardens.advocateagents.com 159.223.7.201 sedlak.advocateagents.com 159.223.7.202 grunberg.advocateagents.com 159.223.7.203 ania.advocateagents.com 159.223.7.204 zinderneuf.advocateagents.com 159.223.7.205 sadoc.advocateagents.com 159.223.7.206 stirjanov.advocateagents.com 159.223.7.207 letizia.advocateagents.com 159.223.7.208 siluck.advocateagents.com 159.223.7.209 minutes.advocateagents.com 159.223.7.210 alysia.advocateagents.com 159.223.7.211 raizul.advocateagents.com 159.223.7.212 backes.advocateagents.com 159.223.7.213 kyoko.advocateagents.com 159.223.7.214 mudie.advocateagents.com 159.223.7.215 coltrane.advocateagents.com 159.223.7.216 soil.advocateagents.com 159.223.7.217 haig.advocateagents.com 159.223.7.218 prophetic.advocateagents.com 159.223.7.219 proofread.advocateagents.com 159.223.7.220 equate.advocateagents.com 159.223.7.221 gene.advocateagents.com 159.223.7.222 fruitful.advocateagents.com 159.223.7.223 shale.advocateagents.com 159.223.7.224 canny.advocateagents.com 159.223.7.225 scholastic.advocateagents.com 159.223.7.226 hentzau.advocateagents.com 159.223.7.227 cindie.advocateagents.com 159.223.7.228 navrat.advocateagents.com 159.223.7.229 treaty.advocateagents.com 159.223.7.230 handymen.advocateagents.com 159.223.7.231 kithnou.advocateagents.com 159.223.7.232 clubroom.advocateagents.com 159.223.7.233 incendiary.advocateagents.com 159.223.7.234 industrious.advocateagents.com 159.223.7.235 uk.advocateagents.com 159.223.7.236 czordas.advocateagents.com 159.223.7.237 raef.advocateagents.com 159.223.7.238 tre.advocateagents.com 159.223.7.239 elitsa.advocateagents.com 159.223.7.240 bombed.advocateagents.com 159.223.7.241 chutney.advocateagents.com 159.223.7.242 nurk.advocateagents.com 159.223.7.243 adipic.advocateagents.com 159.223.7.244 lesleh.advocateagents.com 159.223.7.245 allason.advocateagents.com 159.223.7.246 cia.advocateagents.com 159.223.7.247 ott.advocateagents.com 159.223.7.248 quickstep.advocateagents.com 159.223.7.249 goss.advocateagents.com 159.223.7.250 triplex.advocateagents.com 159.223.7.251 fargher.advocateagents.com 159.223.7.252 sim.advocateagents.com 159.223.7.253 florendo.advocateagents.com 159.223.7.254 knitting.advocateagents.com 159.223.11.2 smtpdri2.rolofter.info 159.223.11.3 smtpdri3.rolofter.info 159.223.11.4 smtpdri4.rolofter.info 159.223.11.5 smtpdri5.rolofter.info 159.223.11.6 smtpdri6.rolofter.info 159.223.11.7 smtpdri7.rolofter.info 159.223.11.8 smtpdri8.rolofter.info 159.223.11.9 smtpdri9.rolofter.info 159.223.11.10 smtpdri10.rolofter.info 159.223.11.11 smtpdri11.rolofter.info 159.223.11.12 smtpdri12.rolofter.info 159.223.11.13 smtpdri13.rolofter.info 159.223.11.14 smtpdri14.rolofter.info 159.223.11.15 smtpdri15.rolofter.info 159.223.11.16 smtpdri16.rolofter.info 159.223.11.17 smtpdri17.rolofter.info 159.223.11.18 smtpdri18.rolofter.info 159.223.11.19 smtpdri19.rolofter.info 159.223.11.20 smtpdri20.rolofter.info 159.223.11.21 smtpdri21.rolofter.info 159.223.11.22 smtpdri22.rolofter.info 159.223.11.23 smtpdri23.rolofter.info 159.223.11.24 smtpdri24.rolofter.info 159.223.11.25 smtpdri25.rolofter.info 159.223.11.26 smtpdri26.rolofter.info 159.223.11.27 smtpdri27.rolofter.info 159.223.11.28 smtpdri28.rolofter.info 159.223.11.29 smtpdri29.rolofter.info 159.223.11.30 smtpdri30.rolofter.info 159.223.11.31 smtpdri31.rolofter.info 159.223.11.32 smtpdri32.rolofter.info 159.223.11.33 smtpdri33.rolofter.info 159.223.11.34 smtpdri34.rolofter.info 159.223.11.35 smtpdri35.rolofter.info 159.223.11.36 smtpdri36.rolofter.info 159.223.11.37 smtpdri37.rolofter.info 159.223.11.38 smtpdri38.rolofter.info 159.223.11.39 smtpdri39.rolofter.info 159.223.11.40 smtpdri40.rolofter.info 159.223.11.41 smtpdri41.rolofter.info 159.223.11.42 smtpdri42.rolofter.info 159.223.11.43 smtpdri43.rolofter.info 159.223.11.44 smtpdri44.rolofter.info 159.223.11.45 smtpdri45.rolofter.info 159.223.11.46 smtpdri46.rolofter.info 159.223.11.47 smtpdri47.rolofter.info 159.223.11.48 smtpdri48.rolofter.info 159.223.11.49 smtpdri49.rolofter.info 159.223.11.50 smtpdri50.rolofter.info 159.223.11.51 smtpdri51.rolofter.info 159.223.11.52 smtpdri52.rolofter.info 159.223.11.53 smtpdri53.rolofter.info 159.223.11.54 smtpdri54.rolofter.info 159.223.11.55 smtpdri55.rolofter.info 159.223.11.56 smtpdri56.rolofter.info 159.223.11.57 smtpdri57.rolofter.info 159.223.11.58 smtpdri58.rolofter.info 159.223.11.59 smtpdri59.rolofter.info 159.223.11.60 smtpdri60.rolofter.info 159.223.11.61 smtpdri61.rolofter.info 159.223.11.62 smtpdri62.rolofter.info 159.223.11.63 smtpdri63.rolofter.info 159.223.11.64 smtpdri64.rolofter.info 159.223.11.65 smtpdri65.rolofter.info 159.223.11.66 smtpdri66.rolofter.info 159.223.11.67 smtpdri67.rolofter.info 159.223.11.68 smtpdri68.rolofter.info 159.223.11.69 smtpdri69.rolofter.info 159.223.11.70 smtpdri70.rolofter.info 159.223.11.71 smtpdri71.rolofter.info 159.223.11.72 smtpdri72.rolofter.info 159.223.11.73 smtpdri73.rolofter.info 159.223.11.74 smtpdri74.rolofter.info 159.223.11.75 smtpdri75.rolofter.info 159.223.11.76 smtpdri76.rolofter.info 159.223.11.77 smtpdri77.rolofter.info 159.223.11.78 smtpdri78.rolofter.info 159.223.11.79 smtpdri79.rolofter.info 159.223.11.80 smtpdri80.rolofter.info 159.223.11.81 smtpdri81.rolofter.info 159.223.11.82 smtpdri82.rolofter.info 159.223.11.83 smtpdri83.rolofter.info 159.223.11.84 smtpdri84.rolofter.info 159.223.11.85 smtpdri85.rolofter.info 159.223.11.86 smtpdri86.rolofter.info 159.223.11.87 smtpdri87.rolofter.info 159.223.11.88 smtpdri88.rolofter.info 159.223.11.89 smtpdri89.rolofter.info 159.223.11.90 smtpdri90.rolofter.info 159.223.11.91 smtpdri91.rolofter.info 159.223.11.92 smtpdri92.rolofter.info 159.223.11.93 smtpdri93.rolofter.info 159.223.11.94 smtpdri94.rolofter.info 159.223.11.95 smtpdri95.rolofter.info 159.223.11.96 smtpdri96.rolofter.info 159.223.11.97 smtpdri97.rolofter.info 159.223.11.98 smtpdri98.rolofter.info 159.223.11.99 smtpdri99.rolofter.info 159.223.11.100 smtpdri100.rolofter.info 159.223.11.101 smtpdri101.rolofter.info 159.223.11.102 smtpdri102.rolofter.info 159.223.11.103 smtpdri103.rolofter.info 159.223.11.104 smtpdri104.rolofter.info 159.223.11.105 smtpdri105.rolofter.info 159.223.11.106 smtpdri106.rolofter.info 159.223.11.107 smtpdri107.rolofter.info 159.223.11.108 smtpdri108.rolofter.info 159.223.11.109 smtpdri109.rolofter.info 159.223.11.110 smtpdri110.rolofter.info 159.223.11.111 smtpdri111.rolofter.info 159.223.11.112 smtpdri112.rolofter.info 159.223.11.113 smtpdri113.rolofter.info 159.223.11.114 smtpdri114.rolofter.info 159.223.11.115 smtpdri115.rolofter.info 159.223.11.116 smtpdri116.rolofter.info 159.223.11.117 smtpdri117.rolofter.info 159.223.11.118 smtpdri118.rolofter.info 159.223.11.119 smtpdri119.rolofter.info 159.223.11.120 smtpdri120.rolofter.info 159.223.11.121 smtpdri121.rolofter.info 159.223.11.122 smtpdri122.rolofter.info 159.223.11.123 smtpdri123.rolofter.info 159.223.11.124 smtpdri124.rolofter.info 159.223.11.125 smtpdri125.rolofter.info 159.223.11.126 smtpdri126.rolofter.info 159.223.11.127 smtpdri127.rolofter.info 159.223.11.128 smtpdri128.rolofter.info 159.223.11.129 smtpdri129.rolofter.info 159.223.11.130 smtpdri130.rolofter.info 159.223.11.131 smtpdri131.rolofter.info 159.223.11.132 smtpdri132.rolofter.info 159.223.11.133 smtpdri133.rolofter.info 159.223.11.134 smtpdri134.rolofter.info 159.223.11.135 smtpdri135.rolofter.info 159.223.11.136 smtpdri136.rolofter.info 159.223.11.137 smtpdri137.rolofter.info 159.223.11.138 smtpdri138.rolofter.info 159.223.11.139 smtpdri139.rolofter.info 159.223.11.140 smtpdri140.rolofter.info 159.223.11.141 smtpdri141.rolofter.info 159.223.11.142 smtpdri142.rolofter.info 159.223.11.143 smtpdri143.rolofter.info 159.223.11.144 smtpdri144.rolofter.info 159.223.11.145 smtpdri145.rolofter.info 159.223.11.146 smtpdri146.rolofter.info 159.223.11.147 smtpdri147.rolofter.info 159.223.11.148 smtpdri148.rolofter.info 159.223.11.149 smtpdri149.rolofter.info 159.223.11.150 smtpdri150.rolofter.info 159.223.11.151 smtpdri151.rolofter.info 159.223.11.152 smtpdri152.rolofter.info 159.223.11.153 smtpdri153.rolofter.info 159.223.11.154 smtpdri154.rolofter.info 159.223.11.155 smtpdri155.rolofter.info 159.223.11.156 smtpdri156.rolofter.info 159.223.11.157 smtpdri157.rolofter.info 159.223.11.158 smtpdri158.rolofter.info 159.223.11.159 smtpdri159.rolofter.info 159.223.11.160 smtpdri160.rolofter.info 159.223.11.161 smtpdri161.rolofter.info 159.223.11.162 smtpdri162.rolofter.info 159.223.11.163 smtpdri163.rolofter.info 159.223.11.164 smtpdri164.rolofter.info 159.223.11.165 smtpdri165.rolofter.info 159.223.11.166 smtpdri166.rolofter.info 159.223.11.167 smtpdri167.rolofter.info 159.223.11.168 smtpdri168.rolofter.info 159.223.11.169 smtpdri169.rolofter.info 159.223.11.170 smtpdri170.rolofter.info 159.223.11.171 smtpdri171.rolofter.info 159.223.11.172 smtpdri172.rolofter.info 159.223.11.173 smtpdri173.rolofter.info 159.223.11.174 smtpdri174.rolofter.info 159.223.11.175 smtpdri175.rolofter.info 159.223.11.176 smtpdri176.rolofter.info 159.223.11.177 smtpdri177.rolofter.info 159.223.11.178 smtpdri178.rolofter.info 159.223.11.179 smtpdri179.rolofter.info 159.223.11.180 smtpdri180.rolofter.info 159.223.11.181 smtpdri181.rolofter.info 159.223.11.182 smtpdri182.rolofter.info 159.223.11.183 smtpdri183.rolofter.info 159.223.11.184 smtpdri184.rolofter.info 159.223.11.185 smtpdri185.rolofter.info 159.223.11.186 smtpdri186.rolofter.info 159.223.11.187 smtpdri187.rolofter.info 159.223.11.188 smtpdri188.rolofter.info 159.223.11.189 smtpdri189.rolofter.info 159.223.11.190 smtpdri190.rolofter.info 159.223.11.191 smtpdri191.rolofter.info 159.223.11.192 smtpdri192.rolofter.info 159.223.11.193 smtpdri193.rolofter.info 159.223.11.194 smtpdri194.rolofter.info 159.223.11.195 smtpdri195.rolofter.info 159.223.11.196 smtpdri196.rolofter.info 159.223.11.197 smtpdri197.rolofter.info 159.223.11.198 smtpdri198.rolofter.info 159.223.11.199 smtpdri199.rolofter.info 159.223.11.200 smtpdri200.rolofter.info 159.223.11.201 smtpdri201.rolofter.info 159.223.11.202 smtpdri202.rolofter.info 159.223.11.203 smtpdri203.rolofter.info 159.223.11.204 smtpdri204.rolofter.info 159.223.11.205 smtpdri205.rolofter.info 159.223.11.206 smtpdri206.rolofter.info 159.223.11.207 smtpdri207.rolofter.info 159.223.11.208 smtpdri208.rolofter.info 159.223.11.209 smtpdri209.rolofter.info 159.223.11.210 smtpdri210.rolofter.info 159.223.11.211 smtpdri211.rolofter.info 159.223.11.212 smtpdri212.rolofter.info 159.223.11.213 smtpdri213.rolofter.info 159.223.11.214 smtpdri214.rolofter.info 159.223.11.215 smtpdri215.rolofter.info 159.223.11.216 smtpdri216.rolofter.info 159.223.11.217 smtpdri217.rolofter.info 159.223.11.218 smtpdri218.rolofter.info 159.223.11.219 smtpdri219.rolofter.info 159.223.11.220 smtpdri220.rolofter.info 159.223.11.221 smtpdri221.rolofter.info 159.223.11.222 smtpdri222.rolofter.info 159.223.11.223 smtpdri223.rolofter.info 159.223.11.224 smtpdri224.rolofter.info 159.223.11.225 smtpdri225.rolofter.info 159.223.11.226 smtpdri226.rolofter.info 159.223.11.227 smtpdri227.rolofter.info 159.223.11.228 smtpdri228.rolofter.info 159.223.11.229 smtpdri229.rolofter.info 159.223.11.230 smtpdri230.rolofter.info 159.223.11.231 smtpdri231.rolofter.info 159.223.11.232 smtpdri232.rolofter.info 159.223.11.233 smtpdri233.rolofter.info 159.223.11.234 smtpdri234.rolofter.info 159.223.11.235 smtpdri235.rolofter.info 159.223.11.236 smtpdri236.rolofter.info 159.223.11.237 smtpdri237.rolofter.info 159.223.11.238 smtpdri238.rolofter.info 159.223.11.239 smtpdri239.rolofter.info 159.223.11.240 smtpdri240.rolofter.info 159.223.11.241 smtpdri241.rolofter.info 159.223.11.242 smtpdri242.rolofter.info 159.223.11.243 smtpdri243.rolofter.info 159.223.11.244 smtpdri244.rolofter.info 159.223.11.245 smtpdri245.rolofter.info 159.223.11.246 smtpdri246.rolofter.info 159.223.11.247 smtpdri247.rolofter.info 159.223.11.248 smtpdri248.rolofter.info 159.223.11.249 smtpdri249.rolofter.info 159.223.11.250 smtpdri250.rolofter.info 159.223.11.251 smtpdri251.rolofter.info 159.223.11.252 smtpdri252.rolofter.info 159.223.11.253 smtpdri253.rolofter.info 159.223.12.2 abcd2.warbister.info 159.223.12.3 abcd3.warbister.info 159.223.12.4 abcd4.warbister.info 159.223.12.5 abcd5.warbister.info 159.223.12.6 abcd6.warbister.info 159.223.12.7 abcd7.warbister.info 159.223.12.8 abcd8.warbister.info 159.223.12.9 abcd9.warbister.info 159.223.12.10 abcd10.warbister.info 159.223.12.11 abcd11.warbister.info 159.223.12.12 abcd12.warbister.info 159.223.12.13 abcd13.warbister.info 159.223.12.14 abcd14.warbister.info 159.223.12.15 abcd15.warbister.info 159.223.12.16 abcd16.warbister.info 159.223.12.17 abcd17.warbister.info 159.223.12.18 abcd18.warbister.info 159.223.12.19 abcd19.warbister.info 159.223.12.20 abcd20.warbister.info 159.223.12.21 abcd21.warbister.info 159.223.12.22 abcd22.warbister.info 159.223.12.23 abcd23.warbister.info 159.223.12.24 abcd24.warbister.info 159.223.12.25 abcd25.warbister.info 159.223.12.26 abcd26.warbister.info 159.223.12.27 abcd27.warbister.info 159.223.12.28 abcd28.warbister.info 159.223.12.29 abcd29.warbister.info 159.223.12.30 abcd30.warbister.info 159.223.12.31 abcd31.warbister.info 159.223.12.32 abcd32.warbister.info 159.223.12.33 abcd33.warbister.info 159.223.12.34 abcd34.warbister.info 159.223.12.35 abcd35.warbister.info 159.223.12.36 abcd36.warbister.info 159.223.12.37 abcd37.warbister.info 159.223.12.38 abcd38.warbister.info 159.223.12.39 abcd39.warbister.info 159.223.12.40 abcd40.warbister.info 159.223.12.41 abcd41.warbister.info 159.223.12.42 abcd42.warbister.info 159.223.12.43 abcd43.warbister.info 159.223.12.44 abcd44.warbister.info 159.223.12.45 abcd45.warbister.info 159.223.12.46 abcd46.warbister.info 159.223.12.47 abcd47.warbister.info 159.223.12.48 abcd48.warbister.info 159.223.12.49 abcd49.warbister.info 159.223.12.50 abcd50.warbister.info 159.223.12.51 abcd51.warbister.info 159.223.12.52 abcd52.warbister.info 159.223.12.53 abcd53.warbister.info 159.223.12.54 abcd54.warbister.info 159.223.12.55 abcd55.warbister.info 159.223.12.56 abcd56.warbister.info 159.223.12.57 abcd57.warbister.info 159.223.12.58 abcd58.warbister.info 159.223.12.59 abcd59.warbister.info 159.223.12.60 abcd60.warbister.info 159.223.12.61 abcd61.warbister.info 159.223.12.62 abcd62.warbister.info 159.223.12.63 abcd63.warbister.info 159.223.12.64 abcd64.warbister.info 159.223.12.65 abcd65.warbister.info 159.223.12.66 abcd66.warbister.info 159.223.12.67 abcd67.warbister.info 159.223.12.68 abcd68.warbister.info 159.223.12.69 abcd69.warbister.info 159.223.12.70 abcd70.warbister.info 159.223.12.71 abcd71.warbister.info 159.223.12.72 abcd72.warbister.info 159.223.12.73 abcd73.warbister.info 159.223.12.74 abcd74.warbister.info 159.223.12.75 abcd75.warbister.info 159.223.12.76 abcd76.warbister.info 159.223.12.77 abcd77.warbister.info 159.223.12.78 abcd78.warbister.info 159.223.12.79 abcd79.warbister.info 159.223.12.80 abcd80.warbister.info 159.223.12.81 abcd81.warbister.info 159.223.12.82 abcd82.warbister.info 159.223.12.83 abcd83.warbister.info 159.223.12.84 abcd84.warbister.info 159.223.12.85 abcd85.warbister.info 159.223.12.86 abcd86.warbister.info 159.223.12.87 abcd87.warbister.info 159.223.12.88 abcd88.warbister.info 159.223.12.89 abcd89.warbister.info 159.223.12.90 abcd90.warbister.info 159.223.12.91 abcd91.warbister.info 159.223.12.92 abcd92.warbister.info 159.223.12.93 abcd93.warbister.info 159.223.12.94 abcd94.warbister.info 159.223.12.95 abcd95.warbister.info 159.223.12.96 abcd96.warbister.info 159.223.12.97 abcd97.warbister.info 159.223.12.98 abcd98.warbister.info 159.223.12.99 abcd99.warbister.info 159.223.12.100 abcd100.warbister.info 159.223.12.101 abcd101.warbister.info 159.223.12.102 abcd102.warbister.info 159.223.12.103 abcd103.warbister.info 159.223.12.104 abcd104.warbister.info 159.223.12.105 abcd105.warbister.info 159.223.12.106 abcd106.warbister.info 159.223.12.107 abcd107.warbister.info 159.223.12.108 abcd108.warbister.info 159.223.12.109 abcd109.warbister.info 159.223.12.110 abcd110.warbister.info 159.223.12.111 abcd111.warbister.info 159.223.12.112 abcd112.warbister.info 159.223.12.113 abcd113.warbister.info 159.223.12.114 abcd114.warbister.info 159.223.12.115 abcd115.warbister.info 159.223.12.116 abcd116.warbister.info 159.223.12.117 abcd117.warbister.info 159.223.12.118 abcd118.warbister.info 159.223.12.119 abcd119.warbister.info 159.223.12.120 abcd120.warbister.info 159.223.12.121 abcd121.warbister.info 159.223.12.122 abcd122.warbister.info 159.223.12.123 abcd123.warbister.info 159.223.12.124 abcd124.warbister.info 159.223.12.125 abcd125.warbister.info 159.223.12.126 abcd126.warbister.info 159.223.12.127 abcd127.warbister.info 159.223.12.128 abcd128.warbister.info 159.223.12.129 abcd129.warbister.info 159.223.12.130 abcd130.warbister.info 159.223.12.131 abcd131.warbister.info 159.223.12.132 abcd132.warbister.info 159.223.12.133 abcd133.warbister.info 159.223.12.134 abcd134.warbister.info 159.223.12.135 abcd135.warbister.info 159.223.12.136 abcd136.warbister.info 159.223.12.137 abcd137.warbister.info 159.223.12.138 abcd138.warbister.info 159.223.12.139 abcd139.warbister.info 159.223.12.140 abcd140.warbister.info 159.223.12.141 abcd141.warbister.info 159.223.12.142 abcd142.warbister.info 159.223.12.143 abcd143.warbister.info 159.223.12.144 abcd144.warbister.info 159.223.12.145 abcd145.warbister.info 159.223.12.146 abcd146.warbister.info 159.223.12.147 abcd147.warbister.info 159.223.12.148 abcd148.warbister.info 159.223.12.149 abcd149.warbister.info 159.223.12.150 abcd150.warbister.info 159.223.12.151 abcd151.warbister.info 159.223.12.152 abcd152.warbister.info 159.223.12.153 abcd153.warbister.info 159.223.12.154 abcd154.warbister.info 159.223.12.155 abcd155.warbister.info 159.223.12.156 abcd156.warbister.info 159.223.12.157 abcd157.warbister.info 159.223.12.158 abcd158.warbister.info 159.223.12.159 abcd159.warbister.info 159.223.12.160 abcd160.warbister.info 159.223.12.161 abcd161.warbister.info 159.223.12.162 abcd162.warbister.info 159.223.12.163 abcd163.warbister.info 159.223.12.164 abcd164.warbister.info 159.223.12.165 abcd165.warbister.info 159.223.12.166 abcd166.warbister.info 159.223.12.167 abcd167.warbister.info 159.223.12.168 abcd168.warbister.info 159.223.12.169 abcd169.warbister.info 159.223.12.170 abcd170.warbister.info 159.223.12.171 abcd171.warbister.info 159.223.12.172 abcd172.warbister.info 159.223.12.173 abcd173.warbister.info 159.223.12.174 abcd174.warbister.info 159.223.12.175 abcd175.warbister.info 159.223.12.176 abcd176.warbister.info 159.223.12.177 abcd177.warbister.info 159.223.12.178 abcd178.warbister.info 159.223.12.179 abcd179.warbister.info 159.223.12.180 abcd180.warbister.info 159.223.12.181 abcd181.warbister.info 159.223.12.182 abcd182.warbister.info 159.223.12.183 abcd183.warbister.info 159.223.12.184 abcd184.warbister.info 159.223.12.185 abcd185.warbister.info 159.223.12.186 abcd186.warbister.info 159.223.12.187 abcd187.warbister.info 159.223.12.188 abcd188.warbister.info 159.223.12.189 abcd189.warbister.info 159.223.12.190 abcd190.warbister.info 159.223.12.191 abcd191.warbister.info 159.223.12.192 abcd192.warbister.info 159.223.12.193 abcd193.warbister.info 159.223.12.194 abcd194.warbister.info 159.223.12.195 abcd195.warbister.info 159.223.12.196 abcd196.warbister.info 159.223.12.197 abcd197.warbister.info 159.223.12.198 abcd198.warbister.info 159.223.12.199 abcd199.warbister.info 159.223.12.200 abcd200.warbister.info 159.223.12.201 abcd201.warbister.info 159.223.12.202 abcd202.warbister.info 159.223.12.203 abcd203.warbister.info 159.223.12.204 abcd204.warbister.info 159.223.12.205 abcd205.warbister.info 159.223.12.206 abcd206.warbister.info 159.223.12.207 abcd207.warbister.info 159.223.12.208 abcd208.warbister.info 159.223.12.209 abcd209.warbister.info 159.223.12.210 abcd210.warbister.info 159.223.12.211 abcd211.warbister.info 159.223.12.212 abcd212.warbister.info 159.223.12.213 abcd213.warbister.info 159.223.12.214 abcd214.warbister.info 159.223.12.215 abcd215.warbister.info 159.223.12.216 abcd216.warbister.info 159.223.12.217 abcd217.warbister.info 159.223.12.218 abcd218.warbister.info 159.223.12.219 abcd219.warbister.info 159.223.12.220 abcd220.warbister.info 159.223.12.221 abcd221.warbister.info 159.223.12.222 abcd222.warbister.info 159.223.12.223 abcd223.warbister.info 159.223.12.224 abcd224.warbister.info 159.223.12.225 abcd225.warbister.info 159.223.12.226 abcd226.warbister.info 159.223.12.227 abcd227.warbister.info 159.223.12.228 abcd228.warbister.info 159.223.12.229 abcd229.warbister.info 159.223.12.230 abcd230.warbister.info 159.223.12.231 abcd231.warbister.info 159.223.12.232 abcd232.warbister.info 159.223.12.233 abcd233.warbister.info 159.223.12.234 abcd234.warbister.info 159.223.12.235 abcd235.warbister.info 159.223.12.236 abcd236.warbister.info 159.223.12.237 abcd237.warbister.info 159.223.12.238 abcd238.warbister.info 159.223.12.239 abcd239.warbister.info 159.223.12.240 abcd240.warbister.info 159.223.12.241 abcd241.warbister.info 159.223.12.242 abcd242.warbister.info 159.223.12.243 abcd243.warbister.info 159.223.12.244 abcd244.warbister.info 159.223.12.245 abcd245.warbister.info 159.223.12.246 abcd246.warbister.info 159.223.12.247 abcd247.warbister.info 159.223.12.248 abcd248.warbister.info 159.223.12.249 abcd249.warbister.info 159.223.12.250 abcd250.warbister.info 159.223.12.251 abcd251.warbister.info 159.223.12.252 abcd252.warbister.info 159.223.12.253 abcd253.warbister.info 159.223.13.2 advocatefulltime.com 159.223.13.3 kiele.advocatefulltime.com 159.223.13.4 volpe.advocatefulltime.com 159.223.13.5 polygonal.advocatefulltime.com 159.223.13.6 electrocardiogram.advocatefulltime.com 159.223.13.7 cabeza.advocatefulltime.com 159.223.13.8 waco.advocatefulltime.com 159.223.13.9 hammersohn.advocatefulltime.com 159.223.13.10 barbarrigo.advocatefulltime.com 159.223.13.11 sammi.advocatefulltime.com 159.223.13.12 diversion.advocatefulltime.com 159.223.13.13 clerissa.advocatefulltime.com ...
On 03/30/2011 03:53 PM, Ronald F. Guilmette wrote:
I just stumbled onto this one the other day.
Apparently, Spamhaus has known about this one for THREE MONTHS already:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308
It's being routed by AS11730, aka "Circle Internet LTD", a known spammer- friendly provider that I have come across many times in the past.
They in turn are getting connectivity from:
AS26769 BandCon AS7385 Integra Telecom
These companies are also not known for being especially scruplous either. But I mean seriously, Jesus Christ! Does ANYBODY even give a crap about blatant naked IP space hijacking anymore? Or is the entire net now on its final slow descent into utter chaos?
This address space seems to be offline now. I for one forwarded info to a contact at Integra, but I can't attest to whether that had anything to do with it. I guess we can call this a victory for the community? I dunno. Jima
For the record, Integra Telecom did have LOA for said netblock. Needless to say LOA was forged on company letterhead with appropriate signatures. Once brought to our attention we attempted to contact customer to no avail, netblock has been removed until they prove otherwise. Randy Rooney On Thu, Mar 31, 2011 at 10:04 AM, Jima <nanog@jima.tk> wrote:
On 03/30/2011 03:53 PM, Ronald F. Guilmette wrote:
I just stumbled onto this one the other day.
Apparently, Spamhaus has known about this one for THREE MONTHS already:
http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308
It's being routed by AS11730, aka "Circle Internet LTD", a known spammer- friendly provider that I have come across many times in the past.
They in turn are getting connectivity from:
AS26769 BandCon AS7385 Integra Telecom
These companies are also not known for being especially scruplous either. But I mean seriously, Jesus Christ! Does ANYBODY even give a crap about blatant naked IP space hijacking anymore? Or is the entire net now on its final slow descent into utter chaos?
This address space seems to be offline now. I for one forwarded info to a contact at Integra, but I can't attest to whether that had anything to do with it.
I guess we can call this a victory for the community? I dunno.
Jima
On 03/31/2011 12:12 PM, rr wrote:
For the record, Integra Telecom did have LOA for said netblock. Needless to say LOA was forged on company letterhead with appropriate signatures. Once brought to our attention we attempted to contact customer to no avail, netblock has been removed until they prove otherwise.
Thank you for your forthright answer. I can't speak for others, but I appreciate the clarification. Jima
In message <AANLkTikMqBx=CU5AuTr7addyn7U7wbeOWw2qA9wDZNhC@mail.gmail.com>, rr <rooknee@gmail.com> wrote:
For the record, Integra Telecom did have LOA for said netblock. Needless to say LOA was forged on company letterhead with appropriate signatures. Once brought to our attention we attempted to contact customer to no avail, netblock has been removed until they prove otherwise.
Randy Rooney
Mr. Rooney, Since you have been kind enough to drop by, you know, to help clarify what went on here, I wonder if you would mind very much just providing a couple of small additional clarifications. First, could you tell me what job title you hold at Integra Telecom please? (I wouldn't even ask, but you are apparently posting from a gmail account, and that always makes me a bit... well... leary.) Second, because I am actually an ignorant son-of-a-bitch (despite any possible appearances to the contrary), I wonder if, just for my personal edification, you could tell me exactly what "LOA" stands for in this context. (Yes, I really don't know, but would like to.) Thirdly, I'd very much like to know if your company is in the habit of providing services (e.g. transit, routing) to other parties at no charge, and for extended periods of time Lastly, assuming that your company is NOT in the habit of providing services (e.g. routing, transit) to other parties at no charge, then I think that I can speak for many here when I say that I would really appreciate it if you could tell me/us whose name was on the check that was used to pay for the services that your company apparently did provide to the 159.223.0.0/16 IP block, apparently for a period in excess of three months. If in fact the other party involved in this incident deceived and defrauded you in some way, then I hardly think that this information, i.e. the name on the check that paid for all this, is something that Integra has any special obligation to keep secret. Even if there ever had been any such obligation, leagl, ethical, or otherwise, I do believe that the other party involved has now nullified any such obligation by their very act of comitting a rather outrageous and damaging fraud upon your company. I look forward to your response. Regards, rfg
Hmm, thought it was a NANOG prerequisite to be able to do a google search. Should be pretty easy to find this info with that tool in your handbag. With the above tool I've got your phone # and would be happy to call you if you'd like clarification on our process. Please just reply to me off-list. Randy On Thu, Mar 31, 2011 at 12:32 PM, Ronald F. Guilmette <rfg@tristatelogic.com> wrote:
In message <AANLkTikMqBx=CU5AuTr7addyn7U7wbeOWw2qA9wDZNhC@mail.gmail.com>, rr <rooknee@gmail.com> wrote:
For the record, Integra Telecom did have LOA for said netblock. Needless to say LOA was forged on company letterhead with appropriate signatures. Once brought to our attention we attempted to contact customer to no avail, netblock has been removed until they prove otherwise.
Randy Rooney
Mr. Rooney,
Since you have been kind enough to drop by, you know, to help clarify what went on here, I wonder if you would mind very much just providing a couple of small additional clarifications.
First, could you tell me what job title you hold at Integra Telecom please? (I wouldn't even ask, but you are apparently posting from a gmail account, and that always makes me a bit... well... leary.)
Second, because I am actually an ignorant son-of-a-bitch (despite any possible appearances to the contrary), I wonder if, just for my personal edification, you could tell me exactly what "LOA" stands for in this context. (Yes, I really don't know, but would like to.)
Thirdly, I'd very much like to know if your company is in the habit of providing services (e.g. transit, routing) to other parties at no charge, and for extended periods of time
Lastly, assuming that your company is NOT in the habit of providing services (e.g. routing, transit) to other parties at no charge, then I think that I can speak for many here when I say that I would really appreciate it if you could tell me/us whose name was on the check that was used to pay for the services that your company apparently did provide to the 159.223.0.0/16 IP block, apparently for a period in excess of three months.
If in fact the other party involved in this incident deceived and defrauded you in some way, then I hardly think that this information, i.e. the name on the check that paid for all this, is something that Integra has any special obligation to keep secret. Even if there ever had been any such obligation, leagl, ethical, or otherwise, I do believe that the other party involved has now nullified any such obligation by their very act of comitting a rather outrageous and damaging fraud upon your company.
I look forward to your response.
Regards, rfg
In message <AANLkTinVLqeFVYkc91d8P-N9zvDGR5PrXREypTuiM0jg@mail.gmail.com>, rr <rooknee@gmail.com> wrote:
Hmm, thought it was a NANOG prerequisite to be able to do a google search. Should be pretty easy to find this info with that tool in your handbag.
Which info is that, exactly? Your title at Integra Telecom? Umm... well... yes.... I guess this is you, right? http://www.linkedin.com/pub/randy-rooney/6/9ab/22a So, are you THE Engineering Manager, or merely AN Engineering Manager at Integra Telecom? I'm guessing that it is a big enough outfit that you probably have more than one. (Sorry, but I can't help snickering a bit at your _prior_ employment. As I feel sure you are already painfully aware, having that on your resume does not exactly inspire a whole lotta confidence in the notion that you are a straight shooter. The words ``cover up'' are the ones that come most immediately to mind.)
With the above tool I've got your phone # and would be happy to call you if you'd like clarification on our process.
No thanks. I didn't ask for "clarification" of your "process" (whatever the hell THAT might mean), and frankly it doesn't interest me. Your process is... well... your process. Whatever it may be, it belongs to you and you should probably keep it to yourself. (Who knows? Since business processes are now patentable, maybe someday you can get a patent on it!) I did however ask for the name of the crook whose name was on the check that paid for the hijacked space routing. Is that something you can respond to, or no? If not, why not? Was Integra Telecom _actually_ defrauded? If so, who defrauded you? Did your customer, Circle Internet defraud you? If you are claining that THEY are also an innocent party in this, then who defrauded them? Whose name was on the check that THEY cashed? It really is a rather simple question, and doesn't require an elaborate, convoluted, or lengthy digression into the details of your "process". Ya know, maybe it's just me, but it would seem to me that that if either you or your customer, Circle Internet, were in fact defrauded in this case, that both of you would be altogether ready, willing, and indeed eager to ``out'' the actual crooked perpetrator... you know... instead of, like, hiding the perp's identity and thus helping him to cover his tracks. But I guess that's just me. (When somebody cheats _me_, I am not myself in the habit of then going out of my way to protect him.) Don't misunderstand me. If your company was in fact dedrauded, then allow me to express my sincere condolences for your loss. Or would it be more accurate to say your gain? You DID cash the check right? I mean your company does NOT have a policy of granting everybody three months of free service, right?
Please just reply to me off-list.
No thanks. As Jodie Foster said in the movie Contact, ``This isn't a person to person call.'' Crooks, hijacking, and mass spamming affect everybody on the whole Internet. I didn't ask for the name of the crook who signed the check just for my private or personal edification. Other ISPs should know who they need to be on the lookout for. I can assure you that just because YOU have now stopped routing space for this crook, that doesn't mean that he's going to just fold up his tent and slink quietly away into oblivion. In fact I already have evidence in hand that he's still got both IP space and snowshoe spamming domains located elsewhere (including elsewhere on Circle Internet, see below) that he is continuing to use, even as we speak. On the other hand, of course, if Integra and/or Circle Internet were in fact ``in on the game'' from the get-go, then in that case I could well and truly understand why both of your companies might now be reluctant to give up your cohort. Regards, rfg P.S. I gather that nobody at your place even so much as raised an eyebrow when tiny little Circle Internet, a company whose biggest _legitimate_ IP block prior to this incident was a mere /21, suddenly showed up on your doorstep asking to have an entire fresh new /16, belonging to an major, internationally known chemical company routed for them, correct? P.P.S. OK, so you are reluctant to give up the actual hijacker. So let's just skip that for now. Instead how about if you just tell us who owns the followng domain names which are all getting DNS from Circle Internet IP space, even as we speak. And no, I _do not_ want you to just regurgitate the fradulent bull puckey that's present within the relevant WHOIS records. (To paraphrase Red Riding Hood "My my grandma! What a lot of domains you have!" Odd that all of them were created so recently, and that none of them seem even have associated web sites. But again, I'm sure that I'm the only one in the Universe who finds any of that odd. Yea.) 208.85.32.114 dns2.virtualcheck.info pinkcreditscore.info pinkcreditreport.info pinkcreditdeals.info orangereports.info orangeoffers.info orangegifts.info orangecreditsco.info orangecreditreport.info orangecreditdeals.info onlinecredit-check.info myfreecredtiscore.info knowyourself.info healthsample.info happinessonline.info freecreditscore360.info doctors-orders.info creditscorealerts.info 208.85.32.246 ns2.rockboys1a.com yesimprove.info withoutinvestigate.info withoutcritique.info withinfocus.info withenable.info visionconsolidate.info versuscoordinate.info validateinstruct.info untilreview.info untilfocus.info unforgettableidea.info underneathunlikemeasure.info underneathunlike.info uncommonsuggestion.info uncommonguidance.info unbelievableguidance.info trumpenforce.info totutor.info topconvert.info tipsproduce.info timesenable.info throughreview.info throughoutcompare.info thansurvey.info terrificexplain.info surveydelegate.info supremeteach.info supplyindividualize.info submitteach.info submitinstruct.info strikingtrust.info strikingproposal.info staggeringlearn.info sincesurvey.info searchrecommend.info searchproduce.info searchprioritize.info retrievelive.info retrievechic.info reserveenable.info researchgrow.info remarkablesubject.info registersimulate.info registeradvise.info reducequick.info recordteach.info recordinstruct.info recordenable.info reconcilelearn.info reconcilefresh.info raresubject.info quickhandle.info projectmaxi.info projectabc.info phenomenalmentor.info pastexperiment.info outstandingprove.info orderinstil.info orderevaluate.info operateinstil.info operateevaluate.info ontostimulate.info ontoexperiment.info ontoadvise.info offconduct.info noteworthyeducation.info nearbyinvestigate.info nearbyindividualize.info moremanage.info measurenavigate.info measurecontract.info marvellousteach.info marvellousintroduce.info magnificienttell.info locatemerge.info locateimprove.info locatehire.info locatedelegate.info likesurvey.info keyinspect.info investigatereview.info investigateinspect.info inexamine.info hotappoint.info groovyrecommend.info forsimulate.info followingteach.info flexlead.info flexconsider.info filecoordinate.info fantasticlearn.info failingevaluate.info extraordinarysuggestion.info extraordinaryproposal.info extraordinarylearn.info extractterminate.info extractapprove.info experimentsecure.info executeenable.info excludingdetect.info exceptionalwisdom.info exceptionaltutor.info exceptionalinfo.info examinelead.info estimateok.info estimatedouble.info dreamsupervise.info downmeasure.info distributefocus.info determineup.info detectlead.info despiteinstruct.info dealsstrengthen.info dayinspect.info critiqueattain.info cooloversee.info conservemax.info conductimprove.info conducthandle.info conducteliminate.info concerningfocus.info concerning.info computefind.info completehire.info compiletutor.info compileevaluate.info codesimulate.info coachstimulate.info classifytrain.info classifycoordinate.info circainform.info butindividualize.info budgetover.info budgetgrow.info besthandle.info besideevaluate.info beneathsimulate.info belowexamine.info behindsimulate.info barringcoordinate.info atopsurvey.info atopextract.info atenable.info atcompare.info assistindividualize.info answersimulate.info amongextract.info againstsimulate.info advocateevaluate.info abovemotivate.info finelovewithme.com whosthefarest.com rockboys1b.com rockboys1a.com leanbackfront.com ns1.rockboys1a.com 155 yesimprove.info withoutinvestigate.info withoutcritique.info withinfocus.info withenable.info visionconsolidate.info versuscoordinate.info validateinstruct.info untilreview.info untilfocus.info unforgettableidea.info underneathunlikemeasure.info underneathunlike.info uncommonsuggestion.info uncommonguidance.info unbelievableguidance.info trumpenforce.info totutor.info topconvert.info tipsproduce.info timesenable.info throughreview.info throughoutcompare.info thansurvey.info terrificexplain.info surveydelegate.info supremeteach.info supplyindividualize.info submitteach.info submitinstruct.info strikingtrust.info strikingproposal.info staggeringlearn.info sincesurvey.info searchrecommend.info searchproduce.info searchprioritize.info retrievelive.info retrievechic.info reserveenable.info researchgrow.info remarkablesubject.info registersimulate.info registeradvise.info reducequick.info recordteach.info recordinstruct.info recordenable.info reconcilelearn.info reconcilefresh.info raresubject.info quickhandle.info projectmaxi.info projectabc.info phenomenalmentor.info pastexperiment.info outstandingprove.info orderinstil.info orderevaluate.info operateinstil.info operateevaluate.info ontostimulate.info ontoexperiment.info ontoadvise.info offconduct.info noteworthyeducation.info nearbyinvestigate.info nearbyindividualize.info moremanage.info measurenavigate.info measurecontract.info marvellousteach.info marvellousintroduce.info magnificienttell.info locatemerge.info locateimprove.info locatehire.info locatedelegate.info likesurvey.info keyinspect.info investigatereview.info investigateinspect.info inexamine.info hotappoint.info groovyrecommend.info forsimulate.info followingteach.info flexlead.info flexconsider.info filecoordinate.info fantasticlearn.info failingevaluate.info extraordinarysuggestion.info extraordinaryproposal.info extraordinarylearn.info extractterminate.info extractapprove.info experimentsecure.info executeenable.info excludingdetect.info exceptionalwisdom.info exceptionaltutor.info exceptionalinfo.info examinelead.info estimateok.info estimatedouble.info dreamsupervise.info downmeasure.info distributefocus.info determineup.info detectlead.info despiteinstruct.info dealsstrengthen.info dayinspect.info critiqueattain.info cooloversee.info conservemax.info conductimprove.info conducthandle.info conducteliminate.info concerningfocus.info concerning.info computefind.info completehire.info compiletutor.info compileevaluate.info codesimulate.info coachstimulate.info classifytrain.info classifycoordinate.info circainform.info butindividualize.info budgetover.info budgetgrow.info besthandle.info besideevaluate.info beneathsimulate.info belowexamine.info behindsimulate.info barringcoordinate.info atopsurvey.info atopextract.info atenable.info atcompare.info assistindividualize.info answersimulate.info amongextract.info againstsimulate.info advocateevaluate.info abovemotivate.info finelovewithme.com whosthefarest.com rockboys1b.com rockboys1a.com leanbackfront.com
On Mar 31, 2011, at 5:46 PM, Ronald F. Guilmette wrote:
(Sorry, but I can't help snickering a bit at your _prior_ employment. As I feel sure you are already painfully aware, having that on your resume does not exactly inspire a whole lotta confidence in the notion that you are a straight shooter. The words ``cover up'' are the ones that come most immediately to mind.)
Awww, that makes me "not a straight shooter"? I was at EBS, I just happened to join a company who's management weren't straight shooters. And what all these accusations and attacks have to do with the thread, I have no idea.
On Thu, Mar 31, 2011 at 6:04 PM, Brett Watson <brett@the-watsons.org> wrote:
On Mar 31, 2011, at 5:46 PM, Ronald F. Guilmette wrote:
(Sorry, but I can't help snickering a bit at your _prior_ employment. As I feel sure you are already painfully aware, having that on your resume does not exactly inspire a whole lotta confidence in the notion that you are a straight shooter. The words ``cover up'' are the ones that come most immediately to mind.)
Awww, that makes me "not a straight shooter"? I was at EBS, I just happened to join a company who's management weren't straight shooters.
And what all these accusations and attacks have to do with the thread, I have no idea.
Apparently it has to do with the fact that you can only pay for IP service via check; credit card billing has been abolished. If you don't pay by check, you're a criminal--that's all there is to it. Matt
Why does it matter what his position is? Sounds like they had a forged LOA from the customer and that they fixed the issue when they found out about it. I am not sure you can ask too much more from a network operator, the best thing we can hope for are companies that will cancel customers if they are abuse sources, that is exactly what happened here. Lots of people are posting on nanog with outside email addresses because they don't want to be tied too closely to the corporation for which they work, it seems totally reasonable to me especially given the mix of personal and professional ties a lot of us have in this community. The main issue here is getting results and it sounds like that happened here pretty quickly. Most technical types are good people and for the most part will work though their corporate BS to get abuse issues solved as quickly as they can. I know we do try to resolve abuse quickly and people who are nice and provide data up front just help expedite the process further, acting like a jerk is by far the least productive way to engage people in the nanog community. John -----Original Message----- From: Ronald F. Guilmette [mailto:rfg@tristatelogic.com] Sent: Thursday, March 31, 2011 5:46 PM To: nanog@nanog.org Subject: Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care? In message <AANLkTinVLqeFVYkc91d8P-N9zvDGR5PrXREypTuiM0jg@mail.gmail.com>, rr <rooknee@gmail.com> wrote:
Hmm, thought it was a NANOG prerequisite to be able to do a google search. Should be pretty easy to find this info with that tool in your handbag.
Which info is that, exactly? Your title at Integra Telecom? Umm... well... yes.... I guess this is you, right? http://www.linkedin.com/pub/randy-rooney/6/9ab/22a So, are you THE Engineering Manager, or merely AN Engineering Manager at Integra Telecom? I'm guessing that it is a big enough outfit that you probably have more than one. (Sorry, but I can't help snickering a bit at your _prior_ employment. As I feel sure you are already painfully aware, having that on your resume does not exactly inspire a whole lotta confidence in the notion that you are a straight shooter. The words ``cover up'' are the ones that come most immediately to mind.)
With the above tool I've got your phone # and would be happy to call you if you'd like clarification on our process.
No thanks. I didn't ask for "clarification" of your "process" (whatever the hell THAT might mean), and frankly it doesn't interest me. Your process is... well... your process. Whatever it may be, it belongs to you and you should probably keep it to yourself. (Who knows? Since business processes are now patentable, maybe someday you can get a patent on it!) I did however ask for the name of the crook whose name was on the check that paid for the hijacked space routing. Is that something you can respond to, or no? If not, why not? Was Integra Telecom _actually_ defrauded? If so, who defrauded you? Did your customer, Circle Internet defraud you? If you are claining that THEY are also an innocent party in this, then who defrauded them? Whose name was on the check that THEY cashed? It really is a rather simple question, and doesn't require an elaborate, convoluted, or lengthy digression into the details of your "process". Ya know, maybe it's just me, but it would seem to me that that if either you or your customer, Circle Internet, were in fact defrauded in this case, that both of you would be altogether ready, willing, and indeed eager to ``out'' the actual crooked perpetrator... you know... instead of, like, hiding the perp's identity and thus helping him to cover his tracks. But I guess that's just me. (When somebody cheats _me_, I am not myself in the habit of then going out of my way to protect him.) Don't misunderstand me. If your company was in fact dedrauded, then allow me to express my sincere condolences for your loss. Or would it be more accurate to say your gain? You DID cash the check right? I mean your company does NOT have a policy of granting everybody three months of free service, right?
Please just reply to me off-list.
No thanks. As Jodie Foster said in the movie Contact, ``This isn't a person to person call.'' Crooks, hijacking, and mass spamming affect everybody on the whole Internet. I didn't ask for the name of the crook who signed the check just for my private or personal edification. Other ISPs should know who they need to be on the lookout for. I can assure you that just because YOU have now stopped routing space for this crook, that doesn't mean that he's going to just fold up his tent and slink quietly away into oblivion. In fact I already have evidence in hand that he's still got both IP space and snowshoe spamming domains located elsewhere (including elsewhere on Circle Internet, see below) that he is continuing to use, even as we speak. On the other hand, of course, if Integra and/or Circle Internet were in fact ``in on the game'' from the get-go, then in that case I could well and truly understand why both of your companies might now be reluctant to give up your cohort. Regards, rfg P.S. I gather that nobody at your place even so much as raised an eyebrow when tiny little Circle Internet, a company whose biggest _legitimate_ IP block prior to this incident was a mere /21, suddenly showed up on your doorstep asking to have an entire fresh new /16, belonging to an major, internationally known chemical company routed for them, correct? P.P.S. OK, so you are reluctant to give up the actual hijacker. So let's just skip that for now. Instead how about if you just tell us who owns the followng domain names which are all getting DNS from Circle Internet IP space, even as we speak. And no, I _do not_ want you to just regurgitate the fradulent bull puckey that's present within the relevant WHOIS records. (To paraphrase Red Riding Hood "My my grandma! What a lot of domains you have!" Odd that all of them were created so recently, and that none of them seem even have associated web sites. But again, I'm sure that I'm the only one in the Universe who finds any of that odd. Yea.) 208.85.32.114 dns2.virtualcheck.info pinkcreditscore.info pinkcreditreport.info pinkcreditdeals.info orangereports.info orangeoffers.info orangegifts.info orangecreditsco.info orangecreditreport.info orangecreditdeals.info onlinecredit-check.info myfreecredtiscore.info knowyourself.info healthsample.info happinessonline.info freecreditscore360.info doctors-orders.info creditscorealerts.info 208.85.32.246 ns2.rockboys1a.com yesimprove.info withoutinvestigate.info withoutcritique.info withinfocus.info withenable.info visionconsolidate.info versuscoordinate.info validateinstruct.info untilreview.info untilfocus.info unforgettableidea.info underneathunlikemeasure.info underneathunlike.info uncommonsuggestion.info uncommonguidance.info unbelievableguidance.info trumpenforce.info totutor.info topconvert.info tipsproduce.info timesenable.info throughreview.info throughoutcompare.info thansurvey.info terrificexplain.info surveydelegate.info supremeteach.info supplyindividualize.info submitteach.info submitinstruct.info strikingtrust.info strikingproposal.info staggeringlearn.info sincesurvey.info searchrecommend.info searchproduce.info searchprioritize.info retrievelive.info retrievechic.info reserveenable.info researchgrow.info remarkablesubject.info registersimulate.info registeradvise.info reducequick.info recordteach.info recordinstruct.info recordenable.info reconcilelearn.info reconcilefresh.info raresubject.info quickhandle.info projectmaxi.info projectabc.info phenomenalmentor.info pastexperiment.info outstandingprove.info orderinstil.info orderevaluate.info operateinstil.info operateevaluate.info ontostimulate.info ontoexperiment.info ontoadvise.info offconduct.info noteworthyeducation.info nearbyinvestigate.info nearbyindividualize.info moremanage.info measurenavigate.info measurecontract.info marvellousteach.info marvellousintroduce.info magnificienttell.info locatemerge.info locateimprove.info locatehire.info locatedelegate.info likesurvey.info keyinspect.info investigatereview.info investigateinspect.info inexamine.info hotappoint.info groovyrecommend.info forsimulate.info followingteach.info flexlead.info flexconsider.info filecoordinate.info fantasticlearn.info failingevaluate.info extraordinarysuggestion.info extraordinaryproposal.info extraordinarylearn.info extractterminate.info extractapprove.info experimentsecure.info executeenable.info excludingdetect.info exceptionalwisdom.info exceptionaltutor.info exceptionalinfo.info examinelead.info estimateok.info estimatedouble.info dreamsupervise.info downmeasure.info distributefocus.info determineup.info detectlead.info despiteinstruct.info dealsstrengthen.info dayinspect.info critiqueattain.info cooloversee.info conservemax.info conductimprove.info conducthandle.info conducteliminate.info concerningfocus.info concerning.info computefind.info completehire.info compiletutor.info compileevaluate.info codesimulate.info coachstimulate.info classifytrain.info classifycoordinate.info circainform.info butindividualize.info budgetover.info budgetgrow.info besthandle.info besideevaluate.info beneathsimulate.info belowexamine.info behindsimulate.info barringcoordinate.info atopsurvey.info atopextract.info atenable.info atcompare.info assistindividualize.info answersimulate.info amongextract.info againstsimulate.info advocateevaluate.info abovemotivate.info finelovewithme.com whosthefarest.com rockboys1b.com rockboys1a.com leanbackfront.com ns1.rockboys1a.com 155 yesimprove.info withoutinvestigate.info withoutcritique.info withinfocus.info withenable.info visionconsolidate.info versuscoordinate.info validateinstruct.info untilreview.info untilfocus.info unforgettableidea.info underneathunlikemeasure.info underneathunlike.info uncommonsuggestion.info uncommonguidance.info unbelievableguidance.info trumpenforce.info totutor.info topconvert.info tipsproduce.info timesenable.info throughreview.info throughoutcompare.info thansurvey.info terrificexplain.info surveydelegate.info supremeteach.info supplyindividualize.info submitteach.info submitinstruct.info strikingtrust.info strikingproposal.info staggeringlearn.info sincesurvey.info searchrecommend.info searchproduce.info searchprioritize.info retrievelive.info retrievechic.info reserveenable.info researchgrow.info remarkablesubject.info registersimulate.info registeradvise.info reducequick.info recordteach.info recordinstruct.info recordenable.info reconcilelearn.info reconcilefresh.info raresubject.info quickhandle.info projectmaxi.info projectabc.info phenomenalmentor.info pastexperiment.info outstandingprove.info orderinstil.info orderevaluate.info operateinstil.info operateevaluate.info ontostimulate.info ontoexperiment.info ontoadvise.info offconduct.info noteworthyeducation.info nearbyinvestigate.info nearbyindividualize.info moremanage.info measurenavigate.info measurecontract.info marvellousteach.info marvellousintroduce.info magnificienttell.info locatemerge.info locateimprove.info locatehire.info locatedelegate.info likesurvey.info keyinspect.info investigatereview.info investigateinspect.info inexamine.info hotappoint.info groovyrecommend.info forsimulate.info followingteach.info flexlead.info flexconsider.info filecoordinate.info fantasticlearn.info failingevaluate.info extraordinarysuggestion.info extraordinaryproposal.info extraordinarylearn.info extractterminate.info extractapprove.info experimentsecure.info executeenable.info excludingdetect.info exceptionalwisdom.info exceptionaltutor.info exceptionalinfo.info examinelead.info estimateok.info estimatedouble.info dreamsupervise.info downmeasure.info distributefocus.info determineup.info detectlead.info despiteinstruct.info dealsstrengthen.info dayinspect.info critiqueattain.info cooloversee.info conservemax.info conductimprove.info conducthandle.info conducteliminate.info concerningfocus.info concerning.info computefind.info completehire.info compiletutor.info compileevaluate.info codesimulate.info coachstimulate.info classifytrain.info classifycoordinate.info circainform.info butindividualize.info budgetover.info budgetgrow.info besthandle.info besideevaluate.info beneathsimulate.info belowexamine.info behindsimulate.info barringcoordinate.info atopsurvey.info atopextract.info atenable.info atcompare.info assistindividualize.info answersimulate.info amongextract.info againstsimulate.info advocateevaluate.info abovemotivate.info finelovewithme.com whosthefarest.com rockboys1b.com rockboys1a.com leanbackfront.com
In message <AF24AE2D4A4D334FB9B667985E2AE763997FE7@mail1-sea.office.spectrumnet .us>, John van Oppen <jvanoppen@spectrumnet.us> wrote:
Why does it matter what his position is?
Well, if he was, you know, just the janitor or something, then I think that we could all safely assume that his opinions are...well.. his opinions, and that they should not be improperly or unfairly construed as official statements on behalf of the company. Wouldn't you agree? I, for one, certainly don't want to unfairly interpret some personal comment on the part of some worker bee as being the equivalent of an official company pronouncement. Do you?
Sounds like they had a forged LOA from the customer...
And they provided service for free?? For three months?? All just on the basis of a sheet of paper that any fool could trivially manufacture in 15 minutes or less at the local Kinkos? Sorry. No. I think not. Money was paid. Money changed hands. Which hands did it come from? From the hijacker crook, obviously. But which one? (There are so many different crooks on the Internet these days.) What was this one's name? Not the phony blaoney name that was on the LOA. That really doesn't matter. The name on the check.
...and that they fixed the issue...
I'm sorry to disagree, but no, actually, it didn't. As I pointed out in the very message that you are responding to, nothing here is ``fixed'', nothing here is ``resolved'', and the evidence seems to indi- cate that the exact same snowshoe spammer who was spamming out of the hijacked block that was getting connectivity from Circle Internet and also, indirectly, from Integra Telecom is still very much alive and well and still operating within the UN-hijacked portion of Circle Internet's IP space. I understand that now that the _hijacking_ part of this tiny drama has been terminated, some folks, here and elsewhere, would prefer now to just roll over and go back to sleep. That's your choice and you're welcome to it. I, however, would sort-of still like to see the perp being escorted to the exit of the entire Internet, along with a swift kick in the ass and an admonition never to come back again. That clearly hasn't happened yet, and what with all the corporate CYA going on it doesn't even look probable any time soon.
I am not sure you can ask too much more from a network operator
Yea. Gee, I guess you're right. Expecting honesty, courtesy, forthrightness, and enough information to make sure that other networks will not be similarly tainted in the future is just completely out of the question. That's apparently far too much care and compassion for one's community and one's fellow man to expect from any CORPORTATION, after all. Please excuse me for harboring patently ridiculous hopes and/or expectations.
the best thing we can hope for are companies that will cancel customers if they are abuse sources...
That may be the best that _you_ are capable of hoping for. Me personally? I set my sights a little higher. Maybe someday... perhaps not in my lifetime, but someday... when there is a lot less corporate CYA and just a little bit more civic responsibility, then maybe we really could get these kinds of crooks off the Internet in a way so that they don't just reappear someplace else a month or two down the road, when things have quieted down. Look, here's two scenarios. See if you can fit them both together in a way that makes sense. I can't. If I go into Macy's, charge a pair of shoes on my Macy's credit card, and then, when I get my monthy charge account bill, I simply don't pay it, then within 30 days, Equifax, Experian and TransUnion will all know about that, and they will go around blabbing to every other merchant in the world, and pretty soon I won't be able to buy even a stick of bubble gum on credit. (Note that _Macy's_ apparently has no trouble ratting out _it's_ less than savory customers.) If however I collude with some friendly and/or greedy ISP/NSP or two on the Internet, hijack a /16 or two, get caught, and get publically outted, then I can be reasonably assured that all of the greedy companies, all the way up and down the entire networking food chain will instantly clam up, you know, just to avoid having to admit that they profited from my scheme too. So I can also be reasonably sure, going in, that even if I'm caught, not only will I not be punished in any way, but better still, I'll be able to just wait a few weeks and then just go down the street to the next greedy ISP/NSP and pull the exact same scam all over again. And nobody except the companies that I've paid off will ever even know my name. If this all makes sense to anybody, then please do explain it to me, because I'm not seeing it. All I see is a sure-fire recipie for an endless cavalcade of IP hijacking incidents. For the perp, there is simply no downside whatso- ever, even if he gets caught, so he's just gonna do it over and over and over again. Which part of this is either non-clear or non-obvious? Regards, rfg
participants (6)
-
Brett Watson -
Jima -
John van Oppen -
Matthew Petach -
Ronald F. Guilmette -
rr