March 2002 - NZNOG - lists.nznog.org

Re: Spam on the increase again
by Simon Byrnand 12 Mar '02

12 Mar '02

At 12:50 12/03/02 +1300, Simon Lyall wrote: >On Tue, 12 Mar 2002, Simon Byrnand wrote: >> I've been trialing orbz and ordb in the last couple of months (not related >> to orbs) and they've been very good. Naturally I've kept a very close eye >> on it, but I've only had 2 instance where genuine mail wasn't getting >> through that I know of - and in both cases they WERE actually open relays. >> I was easily able to add an exclusion for those two servers until they got >> off their ass and fixed their open relay. (Both did after a couple of >> weeks) Both also have good and fast removal policies so they're not the >> sort of list that once you get on you can never get off...(ala the original >> orbs :) > >I find orbz a bit of a pain, they are very fast to add us when a customer >is open relay and using us as a smart-host. I've now got them notifying >me/noc directly so that as soon as then add us (provisionally I think) we >get notified and can (a) block the customer from our mail servers (b) >notify orbz to retest (c) contact the customer. If you're only a smart host for your customer who is actually the open relay, then at worst you should find yourself on their "outputs" list, but not on the "inputs" list. I only use the inputs list, which is what they recommend for exactly that reason...if others use the outputs list they do so at their own peril. Yeah, it might be a bit of a pain for you, but it has served its purpose - it's alerted you to an open relay within your netblock which more than likely has already passed some spam. (Otherwise nobody would have bothered to submit it to orbz in the first place) Actually I think they should notify the netblock owners by default rather than being "opt in", as it would get a lot more open relays fixed, but they say that would constitute spam ;) >With respect to NZ spammers we had a problem with one going around all the >Cyber Cafes and using computers there to send email, we have put in a >block for those however. I understand the spammer in question (various >e-gold (or something) related scams) was causing problems with other >people as well. Heh. I don't think I've come across that one. Yet... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Spam on the increase again
by Simon Byrnand 11 Mar '02

11 Mar '02

At 14:00 11/03/02 +1300, David Robb wrote: >On Mon, 11 Mar 2002, Simon Byrnand wrote: > >> I don't know if anyone else has noticed the same thing, but spam seems to >> be on a major increase again, that makes last time (a few months ago when I >> started a thread about it then) seem like nothing by comparison. I've also >> read a couple of articles in the online press bemoaning the latest resurgence. > >I've seen a fairly large amount all with a similar pattern - all claiming >to be from [random characters](a)yahoo.com. Yep, I was seeing a lot of that too... Regards, Simon - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spam on the increase again
by Simon Byrnand 11 Mar '02

11 Mar '02

I don't know if anyone else has noticed the same thing, but spam seems to be on a major increase again, that makes last time (a few months ago when I started a thread about it then) seem like nothing by comparison. I've also read a couple of articles in the online press bemoaning the latest resurgence. I'm curious to know what (if anything) other ISP's are doing to try and counter the flood of spam that seems to be happening lately. Last time around I was mainly finding out about specific spam from customers forwarding it to me, this time around I'm receiving it myself as well, and in fairly large quantities. :-( So much so that I decided to go through and identify the source of my last weeks spam, including all the stuff in my postmaster bounce box for the last week. (Yeah, ok, I probably had too much time on my hands, but it was really frustrating me :) Double bounces are extremely common with spam, because all it takes is a spammer sending to a local address that doesn't exist anymore, (which happens frequently, because they like to target multiple envelope addressees with the same message and never remove anyone off their lists) using a reply to address which is fake. (Which is the case 95% of the time, including the infamous "Reply with the word REMOVE to be removed" messages) Because of that nearly every double bounce is spam, all nicely sorted for me including headers :) I ended up adding over 100 entries to my manual blocklist just in the one session...in a way its just a futile outlet for frustration, but I did find some interesting statistics: * The bulk of the spam for the last week (by message count) was sent by just a few (<20) sources, with one particular case where the same source was spamming the same 30 addresses nearly every hour. (Eeek) Most of the other sources were only one message a piece. (In other words they were probably randomly used relays, rather than the original source, since a number of the messages were identical although the last hop relay was different) * Almost every message has the return address forged, (surprise ;-) usually to a well known domain, like yahoo.com. * A large percentage have ip's that don't resolve. Together with setting the HELO response to the name of the domain they're impersontating, it can be easy to overlook their forgery in the Recieved by lines, eg: Received: from bigpond.com.au ([211.251.218.2]) It's not until you remember that the hostname should be within the parenthesis that you realise its fake.. :) * Some spammers seem to group email addresses together by domain name and send them as one message (presumably to save bandwidth, by letting the destination MTA handle the multiple delivery) but in doing so they often also list all the email addresses in the CC: field which looks VERY bad to any customer receiving that mail. (They think a group of email addresses have been "sold" to spammers, when its really just "normally" harvested addresses being sorted by domain) * Most ip addresses seemed to be either schools or businesses in Korea, or ADSL addresses in the US, Australia or the Netherlands. Very few (maybe 5%) of the spam actually came legitimately through the mailserver of the domain it purported to be from. Anyone else have any similar experiences ? Anyone else keeping track on spam or trying to fight it in any way ? While I'm on the subject, what is the accepted contact address these days for reporting spam to (NZ) ISP's ? postmaster@ or abuse@ or ? I forwarded a copy of spam that originated at an NZ ISP to postmaster@ their domain but havn't heard back yet. I realise that the postmaster address can be a bit over-used since thats where most MTA's like to send their delivery notifications etc to.... Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Phew looks like we were lucky
by Dean Pemberton 10 Mar '02

10 Mar '02

Wow, I just read this really interesting article in Infotech this morning. It was written by this internet expert, and he was saying that a bunch of 'techies' came really close to breaking the New Zealand internet. That it might have impacted my ability to dial up. He also suggests that the government might like to step in and take over. http://www.stuff.co.nz/inl/index/0,1008,1112116a1983,FF.html It must be true if it got printed. Dean (I thought sarcastic irony was better than a venomous attack on this occasion) - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

23 66

Re: Phew looks like we were lucky
by Ewen McNeill 09 Mar '02

09 Mar '02

Apologies for the mostly-off-topic post. In message <20020225230605.GA17795(a)tapu.f00f.org>, Chris Wedgwood writes: >On Tue, Feb 26, 2002 at 11:57:39AM +1300, Juha Saarinen wrote: > JCM was devised as a method of limiting broadband service uptake > >Until I see proof of this, I'm going to call BULLSHIT. FWIW, I'm inclined to agree (that it's bullshit). The JCM (and similar systems which have been in use in New Zealand for a long time) are attempts to limit demand to a level where the supply can be made at a similar cost to what is being paid. So that increases in bandwidth required to supply the demand can be met out of revenue. >I wish people in New Zealand would stop pretending bandwidth is cheap >and/or cost almost zero and expecting vast amounts of resource for >little cost. It doesn't work that way. Anywhere. >From my point of view bandwidth is very cheap now. Of course this is coming from first connecting to the Internet when we were being charged around $600/MB ($0.60 per kilobyte) for (international) traffic. Now I'm paying, what, about $0.20 per megabyte (less in some instances) for international traffic. That's about 1/3000th of the cost a bit of 10 years ago (about 13 years ago now IIRC). Sure there's lots of things one could do if someone were handing out bandwidth for free. There's lots of things one could do if someone were handing out money for free too. That doesn't meant it's a good idea to get fixated on them, and blame the people not giving things away for free for "holding you back" or whatever. The Paradise.Net charging model (for want of a better term) where plans include some amount of traffic "for free" (ie, in the base cost) may have some of the effects that people are hoping for in their "fixed price, all you can eat" plans, but without the horrendous downside effects of "all you can eat" plans (on everyone else, the provider, etc). This is particularly true where the plan includes more traffic than most people can sensibly use in the period (eg, the Paradise.Net plans that have 10GB of traffic included in them). (A friend of mine with a 10GB traffic plan has been trying _very_ hard to use it all up in a month, without succeeding.) My plan at home (a mere 1GB of traffic included) is plenty fine for me; I've never ever hit the limit (in the 18 months I've had the connection), and only rarely think about not doing something "because of the traffic charges". (About the only thing I actively avoid doing is downloading ISO images of (free) software releases.) If somehow I could get more than 128kbps upstream I'd be really happy. (2Mbps downstream is very nice; but 512kbps downstream was fine. 512kbps upstream would be really nice. Anyone lurking from TSNZ take note: I'll pay real money (up to about 50% more for the connection) for a better upstream on my cable connection. I don't even care if it's not backed by international bandwidth; I want this extra upstream bandwidth for local (NZ-wide) use.) Ewen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 17

RE: ihug problems this morning.
by Simon Lyall 08 Mar '02

08 Mar '02

On Fri, 8 Mar 2002, Grant Zanetti wrote: > On Fri, 8 Mar 2002, J S Russell wrote: > > They have multiple Leons now. :) > It's our version of redundancy. Actually ihug's version of redundancy is when people lose their jobs and get a few week's pay as compensation. Seriously though the Herald article this morning is "a pack of lies" , it's a usual Foreman beatup which appears to use our MOTD page as the sole source of information. Once again people are advised to stear clear of this guy, he appears to be only interested in writting "National Enquirer" type headlines. -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

RE: ihug problems this morning.
by Stephen Andrew 07 Mar '02

07 Mar '02

> -----Original Message----- > From: Michael Bordignon [mailto:michael.b(a)infometrics.co.nz] > Sent: Thursday, 7 March 2002 13:19 > To: 'Juha Saarinen' > Cc: NZNog > Subject: RE: ihug problems this morning. > > > maybe someone tripped over the phone cord to the paradise dialup.. What? Leon?? You there leon??? -- Andrew. > > -----Original Message----- > > From: Juha Saarinen [mailto:juha(a)saarinen.org] > > Sent: Thursday, 7 March 2002 1:14 PM > > To: Simon Lyall > > Cc: NZNog > > Subject: Re: ihug problems this morning. > > > > > > On Thu, 7 Mar 2002, Simon Lyall wrote: > > > > > People might have noticed that we have been having > > problems this morning. > > > > Someone standing in front of the transponder again? ;-) This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Annoying spammers...
by Mark Derricutt 07 Mar '02

07 Mar '02

'lo, dont usually post here (not being a net.admin and all), but recently I'd been getting alot of spam from a "Gordon Hooper" advertising "DHS Clubshop", I've also been receiving spam directly from mail.clubshop.com. Gordon seems to be a kiwi, posting from a kiwi ISP. I mailed abuse@ and got no response, then spoke to someone on the support desk who seemed very keen to put a stop to his spamming, forwarded the messages to him but no response, so am posting here to see if anyone here knows anything about his spamming history, or if someone from his ISP is watching and can "deal" to it. Headers from one of the spam items: Return-path: <gordonnz1(a)hotmail.com> Envelope-to: mark(a)talios.com Delivery-date: Thu, 28 Feb 2002 17:01:44 +1300 Received: from localhost ([127.0.0.1] ident=root) by se7en.org with esmtp (Exim 3.12 #1 (Debian)) id 16gHlI-0002zv-00 for <mark(a)talios.com>; Thu, 28 Feb 2002 17:01:44 +1300 Received: from wibble.net by localhost with POP3 (fetchmail-5.3.3) for mark(a)talios.com (multi-drop); Thu, 28 Feb 2002 17:01:44 +1300 (NZDT) Received: from tyler.snap.net.nz ([202.37.101.20]) by wibble.net (8.9.3/8.9.3/Debian 8.9.3-21) with ESMTP id PAA12878 for <mark(a)talios.com>; Thu, 28 Feb 2002 15:11:48 +1300 X-Authentication-Warning: wibble.net: Host [202.37.101.20] claimed to be tyler.snap.net.nz Received: from p75-tnt1.snap.net.nz ([203.97.29.75] helo=hotmail.com) by tyler.snap.net.nz with esmtp (Exim 3.22 #1 (Red Hat Linux)) id 16gG2t-000555-00 for <mark(a)talios.com>; Thu, 28 Feb 2002 15:11:47 +1300 Message-ID: <2862710-22002242821256860(a)hotmail.com> X-EM-Version: 6, 0, 0, 4 X-EM-Registration: #00F06206106618006920 X-Priority: 3 Reply-To: gordonnz1(a)hotmail.com From: "Gordon Hooper" <gordonnz1(a)hotmail.com> To: "Mark Derricutt" <mark(a)talios.com> Subject: Hi Mark another month is ending!!! Date: Thu, 28 Feb 2002 15:12:56 +1300 MIME-Version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by wibble.net id PAA12878 X-UIDL: 85b20affc9efbb0214c79d7ba39a7e8f -- \m/ -- "...if I seem super human I have been misunderstood." (c) Dream Theater mark(a)talios.com - ICQ: 1934853 JID: talios(a)myjabber.net - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

RE: ihug problems this morning.
by Michael Bordignon 07 Mar '02

07 Mar '02

maybe someone tripped over the phone cord to the paradise dialup.. > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Thursday, 7 March 2002 1:14 PM > To: Simon Lyall > Cc: NZNog > Subject: Re: ihug problems this morning. > > > On Thu, 7 Mar 2002, Simon Lyall wrote: > > > People might have noticed that we have been having > problems this morning. > > Someone standing in front of the transponder again? ;-) > > -- > Juha - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ihug problems this morning.
by Simon Lyall 07 Mar '02

07 Mar '02

People might have noticed that we have been having problems this morning. Mostly fixed now except for our APE link. :( -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1