- NZNOG - lists.nznog.org

Are there any blakjak.net mail admins on this list?
by Juha Saarinen 20 May '06

20 May '06

The subject of the message is: Re: [nznog] SORBS still causing serious problems... The address to which the message has not yet been delivered is: blakjak(a)blakjak.net Delay reason: SMTP error from remote mail server after RCPT TO:<blakjak(a)blakjak.net>: host mx.blakjak.net [202.50.176.75]: 451 Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?xxx.xxx.xxx.xxx "Does this not go back to people using the dnsBL the wrong way... (!) People who choose to use them to _drop_ mail need to instead be using them to _score_ mail... Surely people who are losing mission-critical services due to this should instead be petitioning relevant ISPs to change their dnsBL practises?" Yes yes! I agree! On a more serious note, even Outblaze bounces messages now based on the wrong SORBS listing. @#(*)^$@!!! -- Juha Saarinen www.geekzone.co.nz/juha www.computerworld.co.nz

2 2

E mails
by suzanne gerrard 20 May '06

20 May '06

3 2

Ihug Mail Admin?
by Erin Salmon - Unleash 20 May '06

20 May '06

Hi, If there are any Ihug Mail Admins floating around on the list would you be so good as to put your hand up? One of your customers is sending out thousands of promo newsletters with several images attached. It has been running since Friday and a number of our clients are already facing several hundred dollar excess usage charges from our good friends at Telecom from downloading it all. They have stupidly put the addresses in the CC field, and I believe the problem may be that some of the CC field recipients are running MS Exchange 2000. There is a bug if it is configured for open relaying which resends emails to the list of addresses if there are more than a certain number. I recall having this issue a year or two ago, but Im a bit hazy on the details, and Im not a mail guru myself. The KB seems to be taking this convenient moment to throw an error when I try to search it. If I recall correctly, SP3 for Exchange 2000 fixed the problem, so with any luck there would only be only server in the recipient list with the problem and we can stamp it out. If anyone recalls this Exchange issue, Id appreciate a steer too. Cheers, Erin Salmon Managing Director Unleash Technology Solutions <http://www.unleash.net.nz/> Phone: +64 3 365 1273 Mobile: +64 21 877 913 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.6.1/344 - Release Date: 19/05/2006

3 3

Static IP in a hurry ?
by Richard Naylor 20 May '06

20 May '06

Anyone from Xtra online tonight ? I have one of your customers who needs a static IP number in a hurry. A family member has died and they're webcasting the tangi. We've had 3 number changes in as many minutes. - They'll pay. Rich

1 1

SORBS still causing serious problems...
by Kris Angerano 19 May '06

19 May '06

Heya NZ guys. I work for an ISP out in Oregon US (EasyStreet). And we have recently been hit hard by the mistakes at SORBS. They have mistakenly added our 209.x static group as a dynamic IP range and blocked them all. This has been happening for 5 days now. We have submitted tickets to Matthew and his crew describing the problem and we even gave him our entire Dynamic and Static IP Blocks. To no avail, our RT ticket sits there untouched and the problem is unresolved. RT 77734, 76636 The worse part is we use SORBS, so initially we couldn't even receive some of our own customers email. Since then we have whitelisted our own IP block to solve that problem. But that isn't even a band aid. I called Matthew yesterday and he explained to me about his current 'troubles' so I didn't give him a hard time about our ticket. But this is getting ridiculous. A significant part of our 209.x block is business customers with their own mail servers. They are getting frustrated and we may start to lose business because of this. If anyone cares or has their eyes open out there, we need some help please! Thanks, Kris A

5 5

Re: [nznog] SORBS still listing Telecom static IPs as dynamic...
by Donald Neal 19 May '06

19 May '06

> > > > Please don't use American English. Won't someone please think of the > > children! > > > > American English, thats an oxymoron isnt it ? > I have no doubt of the relevance of most of this thread, but it seems to have now run its course. - Donald Neal List Asministrator Donald Neal |"Email is not to be used to pass on Support Engineer |information or data. It should be NGN Operations |used only for company business." Integration & Services Division +----------------------------------- Alcatel NZ Ltd - Telecom's network operations manager This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

1 0

Re: [nznog] SORBS still listing Telecom static IPs as dynamic...
by Scott Weeks 18 May '06

18 May '06

----- Original Message Follows ----- From: "Jamie Riden" <jamesr(a)europe.com> > > No other blacklist operates like - or generates the hate > > - that S(ORBS) does. > > Actually, I've seen people say that and worse about every > single blacklist including SBL, which is probably the most > conservative one, all the way back to the MAPS original. They all say that if you're not a spammer, you have to pay LOTS of money to people they tell you to pay to be delisted? http://www.au.sorbs.net/faq/spamdb.shtml "Third and finally, if you are really not a spammer, or you are truly reformed, de-listing is relatively easy. You donate US$50 to a charity or trust approved by, and not connected with, SORBS for each spam received related to the listing. This is referred to as the SORBS 'fine'." scott

5 4

Re: [nznog] SORBS still listing Telecom static IPs as dynamic...
by Jeremy Strachan 18 May '06

18 May '06

My view is SORBS is a crock of shit, as was ORBS. If the day ends in "y" they block it ... Its called all care - no responsibility... They will blacklist entire (static) IP ranges with no warning, and no realistic way of removing the block, and treat everyone like s..t. The process is inherently flawed, because of the way static ranges end up on their list without reasonable checks. If they blocked a single IP address - then fine, its their wholesale and cavalier attitude to blocking entire ranges that is the root cause of the problem I have with S(ORBS), and why they are hated so much by people like me. No other blacklist operates like - or generates the hate - that S(ORBS) does. If they vanished tommorrow, the world would be a better place. Jeremy -----Original Message----- From: Tony Wicks [mailto:tony(a)prophecy.net.nz] Sent: Thursday, 18 May 2006 7:06 p.m. Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] SORBS still listing Telecom static IPs as dynamic... >> > One would wonder why any sane mail admin wouldnt pull data from as > many sources as possible when deciding on how to score spam. > Sure, but surely there has to be some measure of accuracy involved ? I mean SORBS is about as accurate as choosing every even IP address on Monday and public holidays, every odd one on every other day. It's just not even close to being what it is supposed to be billed as. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

ANZ Phish
by Joseph Miller 16 May '06

16 May '06

Just a heads-up: I just got sent a phishing scam email for the ANZ... Subject is ANZ Account Security Measures, included link ends up at: http://www.sunrise.cc/bbs/anz.php Relevant parts of the header as follows: Received: from [210.205.6.77] (helo=web-77.blueweb.co.kr) by exorsus.net with esmtp (Exim 4.52) id 1FgAyH-0006MQ-Oq for joff(a)XXXXXXXX.com; Wed, 17 May 2006 13:37:15 +1200 Received: (from apache(a)localhost) by web-77.blueweb.co.kr (8.11.6/8.11.6) id k4H1avJ20690; Wed, 17 May 2006 10:36:57 +0900 Date: Wed, 17 May 2006 10:36:57 +0900 Message-Id: <200605170136.k4H1avJ20690(a)web-77.blueweb.co.kr> To: joff(a)XXXXXXXXXXX.com Subject: ANZ Account Security Measures From: <service(a)anz.com> Reply-To: service(a)anz.com -- Thanks, Joseph Miller Application Developer _________________________________________ http://www.digiweb.co.nz Webhosting, Dedicated Servers, E-commerce Phone: (64 3) 351 6713 PLEASE NOTE: The information contained in this email message and any attached files may be confidential and subject to privilege. The views expressed may not necessarily be the official view of Digiweb New Zealand Limited. All technical advice and opinions are offered on a 'no-liability' basis. If you are not the intended recipient, you are notified that any use, disclosure or copying of this email is unauthorised. If you have received this email in error, please notify us immediately by reply email and delete the original. Thank you.

1 0

Xtra Nationwide outage?
by Tristram Cheer 15 May '06

15 May '06

Anybody know anything about this? I got phones ringing off the hook from people saying xtra's got a nationwide outage right now. Rat got their cable again? -- ----------------------- Tristram Cheer UberNetworks Level 1 2a Vine St Whangarei 0101 M:021-715-823 W:09-438-5472 F:09-438-5473

6 6

Xtra on Spamcop now.
by Chris Hodgetts 15 May '06

15 May '06

May 15 11:12:35 caitlin postfix/smtpd[20038]: NOQUEUE: reject: RCPT from fep03.xtra.co.nz[210.54.141.243]: 554 Service unavailable; Client host [210.54.141.243] blocked using bl.spamcop.net; Blocked - see http://www.spamcop.net/bl.shtml?210.54.141.243; from=<someuser(a)xtra.co.nz> to=<user(a)domainname.com> proto=ESMTP helo=<fep03.xtra.co.nz> May 15 11:12:35 caitlin postfix/smtpd[20038]: disconnect from fep03.xtra.co.nz[210.54.141.243]

6 5

Re: [nznog] Xtra on Spamcop now.
by Ted Grenfell 14 May '06

14 May '06

So a particular customer of ours is having all email from you marked up as spam? Kind Regards, Ted Grenfell ISP Performance Manager T +64 9 359 5854 (extn 93254) F +64 9 377 0781 M +64 27 443 5455 E ted.grenfell(a)telecom.co.nz W www.telecom.co.nz Level 11, Telecom House, 8 Hereford Street, Private Bag 92028, Auckland CBD, New Zealand ________________________________ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." > -----Original Message----- > From: Joseph Miller [mailto:joseph(a)digiweb.net.nz] > Sent: Monday, 15 May 2006 11:47 a.m. > To: Ted Grenfell; nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] Xtra on Spamcop now. > > Ted Grenfell wrote on 15/05/06 11:35: > > What IP addresses are you sending to Joseph? > Sending to mta.xtra.co.nz (210.54.141.1) > > > Any logs you can flick through? > I'll get our mail admin to dig up some SMTP delivery logs when he gets a > spare second, and we've got > someone who's going to send us some mail headers from a junked mail > > > What exactly do you mean by "Junked"? > All the mail is being put in the xtra customer's Junk mail folder > > > > > -- > Thanks, > Joseph Miller > Application Developer > _________________________________________ > http://www.digiweb.co.nz > Webhosting, Dedicated Servers, E-commerce > Phone: (64 3) 351 6713 > > PLEASE NOTE: The information contained in this email message and any > attached files may be > confidential and subject to privilege. The views expressed may not > necessarily be the official view > of Digiweb New Zealand Limited. All technical advice and opinions are > offered on a 'no-liability' > basis. If you are not the intended recipient, you are notified that any > use, disclosure or copying > of this email is unauthorised. If you have received this email in error, > please notify us > immediately by reply email and delete the original. Thank you.

3 2

Re: [nznog] Xtra on Spamcop now.
by Joseph Miller 14 May '06

14 May '06

Ted Grenfell wrote on 15/05/06 11:35: > What IP addresses are you sending to Joseph? Sending to mta.xtra.co.nz (210.54.141.1) > Any logs you can flick through? I'll get our mail admin to dig up some SMTP delivery logs when he gets a spare second, and we've got someone who's going to send us some mail headers from a junked mail > What exactly do you mean by "Junked"? All the mail is being put in the xtra customer's Junk mail folder -- Thanks, Joseph Miller Application Developer _________________________________________ http://www.digiweb.co.nz Webhosting, Dedicated Servers, E-commerce Phone: (64 3) 351 6713 PLEASE NOTE: The information contained in this email message and any attached files may be confidential and subject to privilege. The views expressed may not necessarily be the official view of Digiweb New Zealand Limited. All technical advice and opinions are offered on a 'no-liability' basis. If you are not the intended recipient, you are notified that any use, disclosure or copying of this email is unauthorised. If you have received this email in error, please notify us immediately by reply email and delete the original. Thank you.

1 0

Hosting Providers w/ unlimited traffic plans
by Jonathan Brewer 14 May '06

14 May '06

Hi Folks, We would like to hear from any web hosting provider with unlimited international traffic plans (rate shaped) or arrangements for dual US/NZ servers. A menu of service like "3U box hosting = $n, international traffic @ $n per 64kbps would be appreciated. Cheers, Jon ------------------------- Araneo Limited 230B Left Bank Cuba Street Wellington 6001 Ph: 04 978 7350 Fx: 04 978 7355 Mb: 021 345 054 http://www.araneo.net.nz/ -------------------------

1 0

Re: [nznog] Community Attributes
by Philip D'Ath 12 May '06

12 May '06

Perhaps a good place to start would be to get APE and WIX to implement a common policy, and then those that peer at those locations are likely to follow suit. -----Original Message----- ... Another thing I've also been thinking about is community attributes. Using it to turn on remote blackholing with upstreams is useful, and we saw at NZNOG the approach to communicate enhancements or variations of that. But lowest common denominator suggests that using an agreed set of community attributes (which works for everyone) to convey stuff is something that should be worked on first. So, combining an agreed set of local_pref's and some community attributes might be the basis of building a broader, and faster exchange between participants. Community String Attributes 1000 Route is locally-originated, and should be exported 1000 Route is locally-originated, but should be suppressed towards peers 1002 Route is a blackhole route 1100 Route was learnt from a customer 1200 Route was learnt from a peer 1300 Route was learnt from a backbone 1400 Route was learnt from a transit provider (domestic/international) Local Preference Values 130 - locally-originated 120 - customers 110 - peers 90 - backbone 85 - domestic 80 - international ...

3 4

Latest Opera Version (8.52) and Secure Sites
by Craig Whitmore 11 May '06

11 May '06

Just a headsup to NZ ISP's who may have customers using the latest version of Opera and unable to connect correctly to some secure sites such as the ANZ Bank Website. http://my.opera.com/community/forums/topic.dml?id=138010 Thanks Craig Whitmore

1 0

Your Local 'Local Preference' Preferences
by jamie.baddeley＠vpc.co.nz 09 May '06

09 May '06

Hi, Snazzy subject line huh? ;-) Anyway, Was pondering the impact of path-stuffed networks being announced into the APE combined with operators not actually setting APE learnt routes with a higher local pref. In other words, how many operators out there are not preffing up APE learnt routes? Cheers jamie

5 5

APNIC 22 update #2
by Nurani Nimpuno 09 May '06

09 May '06

Hi NZNOG:ers, I'm forwarding on an update about the APNIC 22 meeting in September. If you have any questions about it, don't hesitate to shoot me a mail. Also, if you want an invitation letter (pdf, or printed and posted to you), contact me and I can arrange it. Cheers! Nurani ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Asia Pacific Network Information Centre Ph :+61-7-38583100 PO Box 2131 Milton, QLD 4064 Fax:+61-7-38583199 Australia http://www.apnic.net ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ [Apologies for duplicates] APNIC 22 update #2 Invitation to APNIC 22 ______________________________________ 22nd APNIC Open Policy Meeting 4-8 September, 2006, Kaohsiung, Taiwan ______________________________________ Dear APNIC members and friends, It is our pleasure to invite you to attend the 22nd APNIC Open Policy Meeting, being held in Kaohsiung, Taiwan. Hosted by TWNIC (Taiwan Network Information Center), APNIC 22 includes an innovative program that showcases presentations on operational Internet issues. Details of the program will be released closer to the meeting; however, a draft schedule is now available at: http://www.apnic.net/meetings/22/program Contents -------- 1. Meeting registraion is open 2. APNIC fellowships 3. Sponsorship opportunities 4. Visa information 1. Meeting registration ---------------------- Meeting registration site is now open. Please visit: http://www.apnic.net/cgi-bin/registration.pl?event_id=90 Early bird registration will end on 14 July, 2006. 2. APNIC fellowship ------------------- The APNIC fellowship program provides basic assistance to Internet professionals from developing economies around the region. If you are interested in applying for an APNIC 22 fellowship, please visit: http://www.apnic.net/meetings/22/fellows The deadline for applications is 26 May, 2006. 3. Sponsorship opportunities ---------------------------- Sponsoring an APNIC meeting will provide you with a range of opportunities to expose your organisation to the Asia Pacific Internet community. If your organisation is interested in sponsoring APNIC 22, please visit: http://www.apnic.net/meetings/22/sponsors 4. Visa information ------------------- Some meeting attendees may require a visa to visit Taiwan. Attendees who require a visa should apply promptly after completing the meeting registration to ensure that the visa is issued on time. All necessary information can be found at: http://www.apnic22.tw/apnic22_visas.htm Any questions? Please contact the APNIC Secretariat at <meetings(a)apnic.net>. We look forward to seeing you in Kaohsiung! Regards, ______________________________________________________________________ APNIC Secretariat secretariat(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61-7-3858-3100 PO Box 2131 Milton, QLD 4064 Australia Fax: +61-7-3858-3199 ---------------------------------------------------------------------- See you at APNIC 22! Kaohsiung, 4-8 September, 2006 www.apnic.net/meetings ______________________________________________________________________

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 09 May '06

09 May '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS9897 as-name: NZRR-AS9897 descr: jsr.com descr: APE peering at '192.203.154.102' descr: see Citylink RT job #5456 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9560 accept ANY AND NOT fltr-bogons export: to AS9560 announce AS9897 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jsr(a)jsr.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060510 source: NZRR --- OBJECT BELOW CREATED: route-set: AS9560:RS-ROUTES:AS9897 descr: Route set advertised to AS9560 by jsr.com - AS9897 members: 202.49.89.0/24^24-29, 205.233.243.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jsr(a)jsr.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060510 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 09 May '06

09 May '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9790 descr: advertised to AS9560 by Callplus Limited - AS9790 members: 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060509 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9790 descr: advertised to AS9560 by Callplus Limited - AS9790 members: 124.197.0.0/18^18-29, 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 202.49.34.0/23^23-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060510 source: NZRR --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9790 descr: advertised to AS9439 by Callplus Limited - AS9790 members: 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060509 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9790 descr: advertised to AS9439 by Callplus Limited - AS9790 members: 124.197.0.0/18^18-29, 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 202.49.34.0/23^23-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060510 source: NZRR

1 0

New IP ranges for Xtra's email platform
by Ted Grenfell 08 May '06

08 May '06

Very shortly (later this week or early next week) we will be modifying DNS entries for Xtra's SMTP servers to point to a new email platform and we would like to draw your attention to the new network IP address ranges that will then be in use as per below: 210.54.141.0/24 210.55.11.0/24 If you've configured any of the existing Xtra mail server IP's in to any of your systems then it might be worthwhile adding the above ranges as well taking note not to delete any existing entries as that may impact normal delivery at this time. If you rely solely on DNS for selecting IP's to deliver email through to Xtra's SMTP servers then you do not need to make any changes. -- Kind Regards, Ted Grenfell ISP Performance Manager T +64 9 359 5854 (extn 93254) F +64 9 377 0781 M +64 27 443 5455 E ted.grenfell(a)telecom.co.nz <mailto:ted.grenfell(a)telecom.co.nz> W www.telecom.co.nz <http://www.telecom.co.nz> Level 11, Telecom House, 8 Hereford Street, Private Bag 92028, Auckland CBD, New Zealand ________________________________ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002."

3 2

Notification of NZRR Database changes
by NZRR Database Notifications 08 May '06

08 May '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9790 descr: advertised to AS9439 by CallPlus Limited - AS9790 members: 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.37.129.0/24^24-29, 202.49.34.0/23^23-29, 202.50.109.0/24^24-29, 202.180.64.0/18^18-29, 203.97.152.0/24^24-29, 203.100.208.0/20^20-29, 203.184.0.0/18^18-29, 203.215.142.0/23^23-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)callplus.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050223 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9790 descr: advertised to AS9439 by Callplus Limited - AS9790 members: 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060509 source: NZRR --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9790 descr: advertised to AS9560 by CallPlus Limited - AS9790 members: 202.36.232.0/24^24-27, 202.37.22.0/24^24-27, 202.37.129.0/24^24-27, 202.49.34.0/23^23-27, 202.50.109.0/24^24-27, 202.180.64.0/18^18-27, 203.97.152.0/24^24-27, 203.100.208.0/20^20-27, 203.184.0.0/18^18-27, 203.215.142.0/23^23-27 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)callplus.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050223 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9790 descr: advertised to AS9560 by Callplus Limited - AS9790 members: 202.180.64.0/18^18-29, 203.184.0.0/18^18-29, 203.100.208.0/20^20-29, 203.160.112.0/20^20-29, 203.215.142.0/23^23-29, 202.36.232.0/24^24-29, 202.37.22.0/24^24-29, 202.50.109.0/24^24-29, 203.97.152.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: ops(a)noc.tranzpeer.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060509 source: NZRR

1 0

FYI: Trademe phish ...
by Jamie Riden 08 May '06

08 May '06

Haven't seen a trademe phish before. The actual link goes to http://www.furutech.co.kr/bbs/data/trademe.php . You might want to warn and filter. cheers, Jamie Subject: TradeMe Account Security Measures Dear foo(a)example.co.nz , We recently noticed one or more attempts to log in to your TradeMe account from a different IP addresses. If you recently accessed your account while traveling, the unusual log in attempts may have been initiated by you. However, if you did not initiate the log ins, please visit TradeMe as soon as possible to check-up your account information: http://www.trademe.co.nz/members/login.aspx Thanks for your patience. Sincerely, TradeMe ---------------------------------------------------------------- Please do not reply to this e-mail. Mail sent to this address cannot be answered. Email ID 376223

1 0

[Fwd: Skybox Security Solutions announcement]
by Justin Cook 07 May '06

07 May '06

Some interesting spam I received. Reading through it I noticed they claim to test your security with a botnet. Are these guys serious? I'm guessing that the only definition of' 'botnet' out there these days is an armada of compromised PCs. -------- Original Message -------- Subject: Skybox Security Solutions announcement Date: Mon, 08 May 2006 10:00:21 +0800 From: <114_reunited(a)jaydees.net> Reply-To: <114_reunited(a)jaydees.net> Skybox Security Solutions *Simulated DDoS Network Attacks and Network Intrusions* *Customer Challenge: * Large corporations often hire consultants to conduct quarterly penetration (DDoS) testing on specific segments of their corporate network. This testing can cost over hundreds of thousands of dollars, and also exposes the network to many potential disruptions. These disruptions are the result of the intense DDoS attacks testers can impose on live networks in order to isolate vulnerabilities and weaknesses. Since the network is constantly changing, and DDoS attacks are rarely dispersed from a centralized location, the penetration test results often become nullified and end up being limited to a small portion of the total network. *The Skybox Solution: *Skybox Security performs accurate and non-intrusive DDoS attacks across a larger portion of the corporate network. The tests are modeled and analyzed through an automated process via our large botnet network rather than manually performed on a live network. As a result, the tests are repeated rigorously on a scheduled basis without any fear of network disruption. Through DDoS attack and access simulation, vulnerability exposures as well as security control weaknesses are revealed instantly. DDoS attack simulation discovers all possible attack scenarios and reveals the step by step process that an attacker or worm may follow. It illustrates specific vulnerabilities to be exploited and network access traversed for each exploitable path. Access simulation calculates network access privileges determined by firewall and routing configuration. Our botnet helps characterize the interconnectivity between any two given points, reporting not just whether access is possible, but also the detailed path to reach a final destination. Based on these combined results, security personnel are able to determine what additional DDoS attacks are necessary and where to deploy our organizations penetration testers. *Awards:* Info Security - Info Security Hot Companies 2006 The Wall Street Journal - One of the most innovative companies in 2005 Information Security Magazine - Product of the year Network Magazine - Most Visionary Security Product Network Magazine - Best of the Best in all categories Secure Enterprise Magazine - Editor's Choice Gartner - " Cool Vendor " in the security & privacy space SC Magazine Awards 2006 Winner - The Best Security Solution for Financial Services IM2005 Award finalist - Information Security and Product of the Year *Company Profile:* Eran Reshef Founder, Chairman & CEO of Blue Security ( www.bluesecurity.com <http://www.bluesecurity.com>) A serial entrepreneur, Eran is currently the founder, chairman & CEO of Blue Security, the do-not-disturb registry pioneer. Prior to Blue, Eran co-founded Skybox Security and served as its Chairman. Prior to Skybox Eran founded and managed Sanctum (acquired by WatchFire), the leader in web application security. Eran holds a variety of security- related patents that are based on his inventions. Rina Shainski General Partner at Carmel Ventures ( www.carmelventures.com <http://www.carmelventures.com>) Following a successful career leading business development and R&D operations in high-growth software companies, Rina has been investing in software companies ever since. Before joining Carmel she served as the VP Business Development at Clal Industries and Investments where she was responsible for software investments. From 1989 to 1996, Rina held several managerial positions in Tecnomatix including VP Business Development and R&D Director. Rina serves on the boards of Followap Communications, Skybox Security, mFormation and Silicon Design Systems. Rina holds a B.Sc. degree in Physics from Tel Aviv University and a Master of Science degree in Computer Science from Weizmann Institute. *Contact Information:* 2077 Gateway Place, Suite 550 San Jose, California 95110 USA Phone: 866-6SKYBOX Phone: 408 441 8060 Fax: 408 441 8068 Regional Offices (Israel) 60 Medinat Hayehudim St. P.O.Box 4109 Herzliya Pituach 46140 Israel Phone: +972-9-9545922 Fax: +972-9-9545933

5 4

new netblocks for Callplus/Slingshot
by Kevin Stewart 07 May '06

07 May '06

We are about to start advertising our new address blocks at the APE and WIX 124.197.0.0 /18 and 203.160.112.0/20 here is our current prefix list ASN 9790 ip prefix-list callplus-networks seq 5 permit 124.197.0.0/18 ip prefix-list callplus-networks seq 10 permit 202.36.232.0 ip prefix-list callplus-networks seq 15 permit 202.37.22.0 ip prefix-list callplus-networks seq 20 permit 202.49.34.0/23 le 24 ip prefix-list callplus-networks seq 25 permit 202.50.109.0 ip prefix-list callplus-networks seq 30 permit 202.180.64.0/18 ip prefix-list callplus-networks seq 35 permit 203.97.152.0 ip prefix-list callplus-networks seq 40 permit 203.100.208.0/20 ip prefix-list callplus-networks seq 45 permit 203.160.112.0/20 ip prefix-list callplus-networks seq 50 permit 203.184.0.0/18 ip prefix-list callplus-networks seq 55 permit 203.215.142.0 ip prefix-list callplus-networks seq 60 permit 203.215.143.0 -- Kevin Stewart Network Engineer DDI ++ 64 9 919 6120 Mobile ++ 64 21 885 505 Email kevins(a)callplus.co.nz ----------------------------------------------------------------------------------------------- This message and any attachments contain privileged and confidential information. If you are not the intended recipient of this message, you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify the sender immediately via email and then destroy this message and any attachments.

2 1