October 2003 - NZNOG - lists.nznog.org

could maxnet contact me plz
by Simon Blake 15 Oct '03

15 Oct '03

Could whomever is responsible for APE peering for Maxnet please contact me off list. Cheers Si

1 0

domainz
by Dan Clark 14 Oct '03

14 Oct '03

Would someone at Domainz please contact me as soon as possible offlist. Kind Regards Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

1 0

Re: [nznog] Paradise.net is on MX.RBl" spam blacklist
by Steve Phillips 13 Oct '03

13 Oct '03

Was bound to happen sooner or later with their "just press delete" policy toward abuse complaints about their customers spamming. -- Steve. At 09:15 p.m. 14/10/2003, Steve Withers wrote: >Anyone on paradise.net.nz trying to send mail to attglobal.net will have >no success due to paradise.net.nz being on the "MX.RBL" blacklist.....if >there is such a beast. The entry is dated october 2nd...... > >If MX.RBL is a widely used list, paradise users may have some trouble. > >I have reported this to paradise. > >-- >Steve Withers <swithers(a)mmp.org.nz> > >_______________________________________________ >NZNOG mailing list >NZNOG(a)list.waikato.ac.nz >http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Paradise.net is on MX.RBl" spam blacklist
by Steve Withers 13 Oct '03

13 Oct '03

Anyone on paradise.net.nz trying to send mail to attglobal.net will have no success due to paradise.net.nz being on the "MX.RBL" blacklist.....if there is such a beast. The entry is dated october 2nd...... If MX.RBL is a widely used list, paradise users may have some trouble. I have reported this to paradise. -- Steve Withers <swithers(a)mmp.org.nz>

1 0

Cunning Vicodin SPAM Practice
by tltoh＠attglobal.net 13 Oct '03

13 Oct '03

Hi, Lately I would say majority of people have been bombarded with Vicodin SPAM as I've been getting about 30 a day for the last month. My delete key have been whinging at me asking for a holiday. And they are sending their SPAM email out through other networks which does not happen to be housing their websites. In my case the Vicodin websites which they are referring me to are as follows: www.medscheap.biz www.rxpalace.biz I manage to track down that both domain's happen to be registered to this person, Pio Lage (peterwolf1239(a)yahoo.com). Both sites are hosted in China which I have inform his network providers which houses both of his websites on his activity but I'm not sure what is the success rate and outcome of it. However so far for the last 6 days I haven't receive any Vicodin SPAM for www.medscheap.biz site at this stage, could be a good start. I could send an email if that is still a valid email account to the Domain owner but I don't want to be ended up in any other of their mailing scam. I thought of forwarding all his SPAM email back to him but I don't believe that is an appropriate practice at all. Any suggestion as to what else can be done to stop this kind of practice ? Thanks. Cheers, Leon

2 1

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 13 Oct '03

13 Oct '03

In message <20031013102226.GQ14751(a)citylink.co.nz>, Simon Blake writes: >On Mon, Oct 13, 2003 at 04:51:08PM +1300, Ewen McNeill said: >> And snooping on Citylink (which is implemented as a big LAN) shows >> much-higher-than-I'd-normally-expect volumes of ICMP echo requests > >Just a small point of protest here, there isn't higher volumes of >anything floating around Citylink And to be fair, it's ages since I've had reason to look, so "higher than I'd expect" is probably a pretty low standard. And a chunk of the volume was definitely NAT'd traffic outgoing; but not all of it. So these various worms are clearly still drifting about. You may well be right however that it was (mostly|just) stuff that was routed to/from that 'net; the volumes were such that it was difficult to get an accurate picture of exactly which addresses were involved it at the time. Sorry for implying otherwise. >Increased worm probing tends to manifest as increased ARP requests, >rather than ICMP packets. That, FWIW, is why 95% of all the >noise-to-every-port on Citylink is ARP requests to unused IP numbers. Likewise on the TelstraClear cable network -- there's a steady background level of ARP requests all the time, good for keeping the incoming data light flickering away to itself. Ewen

1 0

High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

Hi, Is anyone else seeing very high volumes of ICMP echo requests today (ie, in the order of hundreds/thousands per second)? At one client I've been seeing in the order of 2000+ ICMP echo requests per minute from each of four different desktops (desktop support is tracking down the relevant desktops now) to IP addresses all over the net. And snooping on Citylink (which is implemented as a big LAN) shows much-higher-than-I'd-normally-expect volumes of ICMP echo requests flying around from all sorts of random addresses to all sorts of other random addresses. I'm aware that some worms use this as part of their probing/spreading (eg, MS Blaster) but not of any newly released worm (or worm due to make a comeback at present), so I'm a bit puzzled at it's "sudden" appearance. Ewen

5 4

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

In message <20031013045849.5E4DE3C486EB(a)basilica.la.naos.co.nz>, Ewen McNeill wr ites: >In message <874qyd4v8f.fsf(a)it029205.massey.ac.nz>, James Riden writes: >>Ewen McNeill <ewen(a)naos.co.nz> writes: >>> Is anyone else seeing very high volumes of ICMP echo requests today (ie, >>> in the order of hundreds/thousands per second)? [....] >> >>What do the ping packets look like? > >block in on ste7: [internal ip] > [victim ip]: icmp: echo request > 4500 005c 58fa 0000 7f01 4929 0a04 0102 > 3df3 5085 0800 c9c8 0200 d6e1 aaaa aaaa > aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa > aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa > aaaa aaaa As James pointed out, that's a truncated packet (to tcpdump's default snaplen). The real packet is 92 octets, with 64 octets of payload (0xaa octets). Which is what the Welchia/Nachi worm sends out. Desktop support at the client has found several of the machines generating these ICMP streams to be infected with the Welchia/Nachi worm, and are busy checking the rest. They also believe they've identified the source (a laptop that arrived back today IIRC). It has, however, highlighted which machines didn't get put into the default policy for lock downs, updates, etc .... So nothing new, it seems. Just another infection with another windows worm. Sorry to trouble you all. Ewen

1 0

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

In message <874qyd4v8f.fsf(a)it029205.massey.ac.nz>, James Riden writes: >Ewen McNeill <ewen(a)naos.co.nz> writes: >> Is anyone else seeing very high volumes of ICMP echo requests today (ie, >> in the order of hundreds/thousands per second)? [....] > >Welchia used pings, not Blaster.A IIRC. I've seen Welchia at around >180 packets/second on a LAN and it seems to do a strictly linear scan, >so it doesn't sound like that either. > >What do the ping packets look like? block in on ste7: [internal ip] > [victim ip]: icmp: echo request 4500 005c 58fa 0000 7f01 4929 0a04 0102 3df3 5085 0800 c9c8 0200 d6e1 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa Not very exciting. All the ones I've looked contain the same thing (ie IP and ICMP headers, and then filled to minimum packet size with 0xaa bytes). And the addresses aren't always as random as I first thought. When I narrow my scope down to one of the "infected" machines as a source, I sometimes see it walking netblocks sequentially (eg, one internal ip just walked all (most?) of 61.243/16). But when it got to the end of that, the pattern got less predictable again, hitting IPs in at about a dozen different /24s in an overlappped fashion (from the same internal IP). (Perhaps it's getting upset at getting no replies; I've been dropping it at the firewall since I noticed it happening.) I'm seeing around 6000 per second from a single IP address (ie, around 100/second) outgoing hitting the firewall. (It's easy to track a single IP address as these are internal ips; obviously tracking it from the "other end" would be considerably harder.) So I'm pretty much convinced those desktops have "caught" something, I'm just not sure what it is. (And since this client does mail filtering for spam/viruses/etc it's less likely to be a known email virus/worm.) Ewen

1 0

Brightmail Spam Performance
by Mark Frater 12 Oct '03

12 Oct '03

With a sample size of 1015 spam messages over 4 weeks and using a pop mailbox from a provider that recently announced free spam protection (but have been a bit quieter about it only being free 'till xmas), 709 spam messages were detected as spam and 308 spam messages were let through. ie Brightmail (as per the default settings used by this provider) lets through about 30% of spam. How does thing compare to other providers? I guess one woman's spam is another man's v1agra! Mark

3 2