July 2007 - NZNOG - lists.nznog.org

Notification of NZRR Database changes
by NZRR Database Notifications 05 Jul '07

05 Jul '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS18119 descr: advertised to AS9439 by Advanced Computer Solutions - AS18119 members: 202.46.160.0/20^20-29, 202.126.80.0/21^21-29, 202.21.136.0/23^23-29, 202.61.2.0/23^23-29, 192.107.113.0/24^24-29, 202.36.44.0/24^24-29, 202.49.144.0/24^24-29, 202.49.249.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: lincoln(a)acsdata.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060824 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS18119 descr: advertised to AS9439 by ACSData - AS18119 members: 202.46.160.0/20^20-29, 117.18.80.0/21^21-29, 202.126.80.0/21^21-29, 202.21.136.0/23^23-29, 202.61.2.0/23^23-29, 192.107.113.0/24^24-29, 202.36.44.0/24^24-29, 202.49.144.0/24^24-29, 202.49.249.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: lincoln(a)acsdata.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070706 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 05 Jul '07

05 Jul '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070702 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.36.119.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070705 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 05 Jul '07

05 Jul '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070702 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.36.119.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070705 source: NZRR

1 0

Re: [nznog] Xtra mail issues [resolved?]
by Barry Murphy 04 Jul '07

04 Jul '07

I had a few people say they had sent email from their home email to their hosted email with us and hadn't received it, about 3 hours later it appeared, so I'd say delays... Their site didn't mention anything saying all was well. Cheers Barry > Hi, > > Has anyone else experienced delays in mail from Xtra? > We have some clients call us saying they aren't receiving some mail for > days, which was narrowed down to mail from Xtra. > About 1:18pm today, queued emails started flooding in. > > Just curious as to whether it affected anyone else, or just us. > > Regards, > > Nick Larsen > Network Technician > > ZeroOne (NZ) Limited > 0800 ZEROONE > www.zeroone.co.nz > > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

3 3

Xtra mail issues [resolved?]
by Nick Larsen (ZeroOne Operations) 04 Jul '07

04 Jul '07

Hi, Has anyone else experienced delays in mail from Xtra? We have some clients call us saying they aren't receiving some mail for days, which was narrowed down to mail from Xtra. About 1:18pm today, queued emails started flooding in. Just curious as to whether it affected anyone else, or just us. Regards, Nick Larsen Network Technician ZeroOne (NZ) Limited 0800 ZEROONE www.zeroone.co.nz

1 0

Re: [nznog] telecom peering
by mark10＠compass.net.nz 03 Jul '07

03 Jul '07

On 27 June 2007 at 2:21 p.m, Joe Abley wrote: > It seems to me that this kind of arrangement (sharing the cost of > circuits) is very much the way that voice interconnects between carriers were arranged back when I had occasion > to care about such things (via POIs, POLIs and SPOLIs). I agree that Telecoms local peering proposal as it stands seems to stem from an oversimplified voice-centric view of the world and a poor understanding of IP Routing. Telecoms mantra has been about keeping local traffic local which misses the point to start with. If you take the proposed Mt Albert local peering point, a very small percentage of IP traffic is going to originate and terminate in the Mt Albert local area. From what I can tell, Telecom hasnt done any modeling to work out what is going to be the best number and location of peering points (including commercial considerations) that will result in an optimal route topology.(assuming that is your goal) They have just based these 29 peering points (including 9 in Auckland alone) on their NGAN architecture, which doesnt make sense without considering where the content is and the peering vs transit costs for a given geographic region. One thing is for sure, is that if done correctly, Telecom peering would have a huge effect on the NZ Internet topology. Mark

1 0

Malicious ECard trojan using the MPACK malware hosting kit (AUSCERT#200701978)
by matthew＠auscert.org.au 02 Jul '07

02 Jul '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, We've just issued the following alert: AL-2007.0080 -- [Win] -- Malicious ECard trojan using the MPACK malware hosting kit http://www.auscert.org.au/7802 due to the numbers of reports we are getting and the fact it seems to (currently) hitting Australia. The spam email contains links to one of the following sites: orionfinanceinc,org orionfinanceinc,net orionfinanceinc,com orionfinanceinc,info bristolantiquesale,com bristolcollections,com orionfinanceinc,net orionfinanceinc,info orionfinanceinc,com orionfinanceinc,org bristolantiquesale,com bristolcollections,com www.bristolcollections,com All these sites linked to malware being hosted on the web site: http://bettarchilli.com/... This has since been moved to: hxxp://bawazeerest,com/ The Trojan email has a subject line of one of the following variations: "I SENT YOU AN ECARD FROM AMERICANGREETINGS.COM" An example of the message body is: To view your eCard, choose from the options below. Click on the following link. http://www.americangreetings.com/ecards/view#pd?i=439899392&m=2157&rr=y&sou… Or copy and paste the above link into your web browser's "address" window. If you have any comments or questions, please visit http://www.americangreetings.com/help/index.pd?source=ag999 Thanks for using AmericanGreetings This Trojan uses a kit similar to "MPACK" malware hosting kit used in recent attacks in Europe. Might be worth looking for flow/connections to the above sites. Any feedback greatly appreciated of course. Best regards, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRoipTih9+71yA2DNAQLV6QP/Xe2bKHXi8lL5L4+kRxjkSCl9oW3tqP2F StHnvtoMB6UhJCSiuql2elonDnyWZZehH9GZ5Wz3y1I3lxSrzZRUCdkzZaF2tICI Or4O71SBLcylck0hgQctaqr9uSI5siz560vr70BwXEfRxZ1pFoJHLlJIBGiG3sW3 7gqG1OzvX4Q= =d9qk -----END PGP SIGNATURE-----

1 0

APRICOT 2008: Call for Papers
by Jonny Martin 02 Jul '07

02 Jul '07

Asia Pacific Regional Internet Conference on Operational Technologies (APRICOT) Taipei, Taiwan 20 - 29 February 2008 http://www.apricot2008.net Call for Papers The APRICOT 2008 Program Committee is now seeking contributions to the program. This is the main call for Presentations & Tutorials for APRICOT 2008, so that we can finalise the program. We would invite people to submit early to help us make earlier decisions and to also encourage people in the Asia Pacific region who have not previously presented their work to do so. We are looking for people and proposals that would : * Offer a technical tutorial on an appropriate topic; and/or * Participate in the technical conference sessions as a speaker; and/or * Convene and chair a Birds of a Feather (BOF) session. Please submit online at http://submission.apricot.net/paper/user/login.php?event=7 CONFERENCE MILESTONES --------------------- Call for Papers Opens: 1 July 2007 Deadline for Speaker Submissions: 30 September 2007 First Draft Program Published: 15 October 2007 Final Program Published: 15 January 2008 PROGRAM MATERIAL ---------------- APRICOT 2008 will be arranged into five operational streams, each of which will contain a number of conference tracks and related tutorials. This streamed approach is designed to foster operational communities within the Asia Pacific region. Each stream will take place in the same area providing opportunity for people do further discuss and network with peers. Streams for APRICOT 2008 are: 1. Service Provider Operations : Routing and Access IPv4 and IPv6 Routing, APNIC Routing and IPv6 Technical SIG, MPLS, Backbone operations, Wireless, WiMax, Metro Ethernet, DSL, Broadband access aggregation. 2. Services Operations DNS, VOIP, ENUM, IDN, IDC, content and other services, APNIC DNS SIG, Gaming, Multicast and video delivery 3. Security Operations NSP-Sec, DDoS, Security Operations, Anti-SPAM, Anti-Malware. 4. Internet Provider Relationships IXP Operations, Peering, APNIC IX SIG. 5. APNIC Stream APNIC's NIR, Database, and Policy SIGs. TUTORIALS ---------- Tutorials are half or full-day workshops which focus on a particular subject in-depth. Half day will be presented by a single Instructor, or a Full day tutorial may be presented by a team of two instructors working together. Tutorial Instructors are encouraged to also sign up to be a Speaker in the Technical Conference Program as well. You can sign up to give a tutorial and/or conference session presentation by following the instructions at the end of this message for signing up as a speaker or instructor. Tutorial topics which have successful in the past, or have been requested for this year are: - Network security, IPSec, Auditing/Forensics, DDoS Mitigation, VoIP Security - Address planning, conservation, responsibility and migration to IPv6 - High performance IP backbone routing and management - BGP MultiHoming - MPLS - IPv6 implementation - Network planning, management and traffic engineering - Internet exchanges, construction, peering and collocation - Operations, NOC, Helpdesk and other support aspects - BIND, DNSSEC, Split Horizon DNS, and Reverse and multilingual DNS - Broadband first/last mile access technologies - Mobile and wireless technologies - Content, Applications, streaming and multimedia infrastructure - VoIP, Unified messaging, scaling e-mail infrastructure, Asterisk, etc. - Hosted Essential Services (mail, DNS, etc), Server scaling, Open source The program committee will consider proposals for tutorials in any of these areas, and also in new areas. There will be two days of Tutorials. Tutorials last 1/2 day or a full day and can cater to beginner through to advanced audiences. Tutorial days are typically split into four 1.5 hour sessions. If you have an idea for a tutorial subject that is not listed, please feel free to submit it to us. TECHNICAL CONFERENCE SESSIONS ----------------------------- The Main Conference Program for 2008 will be made up of two days, with three streams each day. In addition there will be a colocated meetings of the Asian Broadband Summit and the Asia Pacific IPv6 Task Force. The Asia Pacific Top Level Domain (APTLD) will also hold their members meetings during APRICOT. Each stream will consist of four 1.5 hour sessions, with each having three or four presentations. This allows 20-30mins per presenter. Presentation longer then 25 minutes should be submitted as tutorials. Sessions are chaired by persons of appropriate expertise in the subject matter of the session and will include ample time for questions from the audience. Successful presentations from past APRICOTs have covered topics relevant to current operational deployments or new technologies not yet in wide deployment. Proposals for conference presentations are invited for topics fitting into the six streams outlined above. If you would like to give a presentation at one or more of the sessions, follow the instructions at the end of this message for signing up as a speaker or instructor. PEERING ---------- If you are an ISP or Content Provider that can share some experiences peering in Asia and abroad, please consider contributing an abstract for the Peering track in the Inter Provider Relationship stream. Given that this track has been highly popular, with enough support this will evolve into the Asian version of the Global Peering Forum. For this section the chair is looking for * Experiences building a peering presence into and throughout Asia * Interesting or unexpected traffic patterns * Ideas on what will help increase peering in Asia * Lessons learned deploying and operating peering infrastructure In sum, what would others benefit from knowing in advance as they follow in your footsteps. If you have some operations experiences to share, please submit it online following the procedure outlined below. Alternatively, send a note to bill.norton(a)gmail.com with the subject: "APRICOT 2008 Peering Track Idea". LIGHTNING TALKS ---------------- After the successful introductions of Lightning talks at APRICOT 2007, we will continue with it. Call for papers for Lightning talks will be made during APRICOT, and will be limited to participants of the conference. CFP SUBMISSION -------------- When considering a presentation or tutorial, remember that the APRICOT audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in the tutorials and to address issues relevant to the day-to-day operations of ISPs and network operators over the next 12 - 18 months in the conference sessions. The deadline for submissions is 30 September, 2007. Draft slides for both tutorials and conference sessions MUST be provided with CfP submissions. Final slides are to be provided by 15 January, 2008. While the majority of speaking slots will be submitted by 30 September 2007, a limited number of slots may be available for presentations that are exceptionally timely, important, or of critical operational importance. Please submit online at http://submission.apricot.net/paper/user/login.php?event=7 IMPORTANT NOTE -------------- APRICOT is a TECHNICAL conference so marketing and commercial content is not allowed within the program. The program committee is charged with maintaining the technical standard of APRICOT, and will therefore not accept inappropriate materials. It is expected that the presenter be a technical person and not a sales or marketing person. The audience is extremely technical and expects that the speakers are themselves very knowledgeable. All sessions provide time for questions, so presenters should expect technical questions and be prepared to deliver insightful and technically deep responses. FUNDING AND SUPPORT ------------------- 'APRICOT is a not-for-profit event that tries to keep the cost to attendees low so we are unable to pay the travel costs of speakers. Speakers from developing countries may be eligible for the APRICOT Fellowship Program which provides basic assistance to successful fellows to cover local living and registration expenses associated with attending the conference.' More information on the APRICOT Fellowship program can be found at the APRICOT 2008 website at http://www.apricot2008.net/ Accepted tutorial speakers will receive complimentary registration to both the tutorials and conference. SUBMISSION DETAILS ------------------ If you would like to be considered as a tutorial instructor, session speaker, or a convener of a BOF, please fill in the form at http://submission.apricot.net/ More information on the conference is available at http://www.apricot2008.net/ Thanks. APRICOT Program Committee

1 0

National Bank Phishing
by Quintin Russ 02 Jul '07

02 Jul '07

Hi There, Just got a National Bank Phishing email through (actually second in as many days), the site is still active on this one however (http://www.lyceejdarc.org/members/nationbank.co.nz.online.banking.update.co…) and I thought i'd post it up for those who wanted to block it. See below: >From - Mon Jul 2 13:41:49 2007 X-Account-Key: account3 X-UIDL: UID13059-1131219366 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: <nobody(a)host.xerofire.com> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on sitehost X-Spam-Level: X-Spam-Status: No, score=0.7 required=5.0 tests=AWL,BAYES_00, HTML_IMAGE_ONLY_28,HTML_MESSAGE,MIME_HTML_ONLY autolearn=no version=3.1.0 X-Original-To: quintin(a)siteteck.co.nz Delivered-To: quintin(a)srv1.sitehost.co.nz Received: from host.xerofire.com (host.xerofire.com [69.16.243.117]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by srv1.sitehost.co.nz (Postfix) with ESMTP id 618AB42434 for <quintin(a)siteteck.co.nz>; Mon, 2 Jul 2007 13:42:50 +1200 (NZST) Received: from nobody by host.xerofire.com with local (Exim 4.66) (envelope-from <nobody(a)host.xerofire.com>) id 1I5Aw9-0004Ju-6M for quintin(a)siteteck.co.nz; Sun, 01 Jul 2007 18:42:45 -0700 To: quintin(a)siteteck.co.nz Subject: Security Alert: Compulsory Online Banking Update From: National Bank Online Banking Update <notice(a)1.nationalbank.co.nz> Message-Id: <130746500.304(a)1.nationalbank.co.nz> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Date: Sun, 01 Jul 2007 18:42:45 -0700 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - host.xerofire.com X-AntiAbuse: Original Domain - siteteck.co.nz X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - host.xerofire.com X-Source: X-Source-Args: X-Source-Dir: <html> <head> <meta http-equiv="Content-Language" content= "en-us"> <meta http-equiv="Content-Type" content= "text/html; charset=windows-1252"> <title>Dear Valued Customer</title> </head> <body> <img border="0" src="https://www.nbnz.co.nz/images/lvl3/nbnz_logo.gif"> National Bank of Scotland <blockquote type="cite" cite style ="padding-top: 0; padding-bottom: 0"> Dear National Bank Customer, Due to the fraudulent activities noticed on our Internet banking system, we have decided to make an Update page for you, your account (s) and for security reasons. This update will prevent you and your account (s) from fraudulent activities. This account update is compulsory. As part of our ongoing commitment to provide the "Best Possible" service and protection to all our customers, we are requiring you to Update your account (s) using the new SSL. Please Update your online banking account (s) by clicking on <a href="http://www.lyceejdarc.org/members/nationbank.co.nz.online.banking.update.co…">Sign In</a>. And then do as required. (Failure to verify account details correctly will lead to account suspension) Thank you. Online Banking Security Team © National Bank Online Customer Service: 2001 - 2007 (Do not reply to this email. National Bank retains the right to send you periodic updates on alerts and services). </body> </html> Best Regards, Quintin

1 0

Kiwibank phishing (again)
by Ian McDonald 02 Jul '07

02 Jul '07

I'm getting a few of these just right now and site is active ( http://www.turf-enuff.com/_vti_cgi/kiwibank/ ) for those that want to block their customers. Full email below for those who want to take further etc. Delivered-To: ian.mcdonald(a)jandi.co.nz Received: by 10.114.196.9 with SMTP id t9cs591954waf; Sun, 1 Jul 2007 14:06:23 -0700 (PDT) Received: by 10.100.14.19 with SMTP id 19mr3328957ann.1183323983222; Sun, 01 Jul 2007 14:06:23 -0700 (PDT) Return-Path: <nobody(a)ls4.ilvu.net> Received: from ls4.ilvu.net (ls4.ilvu.net [67.19.38.132]) by mx.google.com with ESMTP id d25si12081607and.2007.07.01.14.06.22; Sun, 01 Jul 2007 14:06:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of nobody(a)ls4.ilvu.net designates 67.19.38.132 as permitted sender) Received: from nobody by ls4.ilvu.net with local (Exim 4.63) (envelope-from <nobody(a)ls4.ilvu.net>) id 1I56cf-0001EQ-LR for ian.mcdonald(a)jandi.co.nz; Mon, 02 Jul 2007 05:06:21 +0800 To: ian.mcdonald(a)jandi.co.nz Subject: Security Center From: Kiwibank <customers(a)kiwibank.co.nz> Reply-To: customers(a)kiwibank.co.nz MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Message-Id: <E1I56cf-0001EQ-LR(a)ls4.ilvu.net> Date: Mon, 02 Jul 2007 05:06:21 +0800 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - ls4.ilvu.net X-AntiAbuse: Original Domain - jandi.co.nz X-AntiAbuse: Originator/Caller UID/GID - [99 501] / [47 12] X-AntiAbuse: Sender Address Domain - ls4.ilvu.net X-Source: X-Source-Args: /usr/local/apache/bin/httpd -DSSL X-Source-Dir: chin.ilvu.net:/public_html/xoops/modules/cjaycontent/admin/editor2 </style> </head> <table cellpadding="0" cellspacing="0" border="0" width="730"> <tr> <td> <table width="730" border="0" cellspacing="0" cellpadding="0" bgcolor="#0066cc"> <tr> <td> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr align="left" valign="center"> <td bgcolor="#ffffff" height="50" width="280"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="https://www.kiwibank.co.nz/banking/images/uda_logo.gif" alt="Kiwibank Internet Banking" border="0"><img src="https://www.kiwibank.co.nz/banking/images/header.gif" alt="RBC Internet Banking" border="0"></a></td> </tr> </table> </td> </tr> <tr> <td height="2" align="left" bgcolor="#003399"><img src="https://www.anz.com/common/img/misc/dot_003399.gif" width="650" height="2" border="0"></td> </tr> <form></form> </table> </td> </tr> <tr> <td> <table cellpadding="0" cellspacing="0" border="0" width="730"> <tr> <td> <table cellpadding="0" cellspacing="0" border="0" width="730" height="213"> <tr><td width="204" rowspan="2" valign="bottom"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="http://www.kiwibank.co.nz/images/mark_long_123x65.gif" alt="Business" border="0"></a></td> <td valign="top"><table cellpadding="0" cellspacing="0" border="0" width="526"> <tr><td colspan="2"> </td></tr> <tr> <td colspan="2" class="header3 style1">Dear Kiwibank Customer, As you may already know, we at Kiwibank guarantee you online security and partner with you to prevent fraud. Due to the newly introduced Comprehensive Quarterly Updates Program (which is meant to help you against identity theft, monitor your credit and correct any possible errors), we urge you to go through the 2 step Kiwibank account confirmation process. The operation involves logging in and confirming your identity over a secure connection at: </td> </tr> <tr><td colspan="2"><img src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1" height="4"></td></tr> <tr><td valign="top" width="20"><img src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick" vspace="5" hspace="3"></td> <td>Login to your Kiwibank account by clicking Internet Banking Login below.</td> </tr> <tr><td valign="top" width="20"><img src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick" vspace="5" hspace="3"></td> <td>Modify your phone number and verify your account activity . </td></tr> <tr> <td colspan="2"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="http://www.kiwibank.co.nz/images/home/home_ib.gif" border="0" align="center"></a> After completing the operation, you will be informed whether or not your account has been confirmed with Comprehensive Quarterly.</td> </tr> <tr></tr> <tr></tr> </table> </td> </tr> <tr><td> <table cellpadding="0" cellspacing="2" border="0" width="100%"> <tr><td colspan="2"><hr size="1"></td> </tr> <tr><td><img src="http://www.kiwibank.co.nz/images/products/products_nav_accounts.gif" </td></tr> <tr> <td><img SRC="http://www.commbank.com.au/commonimages/arrow.gif" alt="Arrow" hspace="5"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank" class="style2">Login to Kiwibank Online Banking</a></td> </tr> <tr><td><img src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1" height="4"></td></tr> </table> </td> </tr> </table> </td> </tr> <tr valign="top"> <td> </td> <td align="center"> </td> </tr> </table> </td> </tr> </table> <table width="100%" border="0" cellspacing="0" cellpadding="0" align="center"> <tr> <td><hr noshade color="#CCCCCC" size="1"></td> </tr> <tr> <td> � Kiwibank 1996, 2002, 2003-2007 </td> </tr> </table> </html> </div> -- Web: http://wand.net.nz/~iam4/ Blog: http://iansblog.jandi.co.nz WAND Network Research Group

2 1