- NZNOG - lists.nznog.org

Contacting ISP re: CC fraud
by Barry ＠ CASHevolution Support 16 Oct '02

16 Oct '02

Hi there guys, Hope you can possibly help. I have a situation where a member using a yahoo email account has located a credit card list and is utilizing it on our website. The person has used over 200 credit card numbers and many have been successful. I have log's of IP addresses and traced it to the following IP block owner. Instituto Tecnologico y de Estudios Superiores de Monterrey REDMEX-BNETS (NET-148-203-0-0-1) 148.203.0.0 - 148.250.255.255 Universidad Autonoma De Ciudad Juarez UACJ (NET-148-210-0-0-1) 148.210.0.0 - 148.210.255.255 Some of the IP addresses are as follows: 148.210.126.238 148.210.126.228 146.210.116.193 Doing a traceroute only gave me their ISP's uplink reverse, AT&T. How can I get in touch with this ISP to ensure this person is caught. Kindest Regards Barry Murphy Systems Administrator http://www.cashevolution.com <http://www.cashevolution.com/>

4 3

Domestic Prefix list update again AS7657
by Leon Chang 10 Oct '02

10 Oct '02

Hi people, Sorry we have to update this again as yesterday's list missed out a network: ip prefix-list ihug-networks seq 37 permit 202.49.144.0/24 FYI, the complete list is attached below. ip prefix-list ihug-networks description ihug peering prefix-list contact: noc(a)ihug.co.nz ip prefix-list ihug-networks seq 5 permit 202.36.94.0/23 le 24 ip prefix-list ihug-networks seq 10 permit 202.37.136.0/24 ip prefix-list ihug-networks seq 15 permit 202.37.182.0/24 ip prefix-list ihug-networks seq 20 permit 202.37.187.0/24 ip prefix-list ihug-networks seq 25 permit 202.37.194.0/24 ip prefix-list ihug-networks seq 30 permit 202.49.59.0/24 ip prefix-list ihug-networks seq 35 permit 202.49.88.0/23 le 24 ip prefix-list ihug-networks seq 37 permit 202.49.144.0/24 ip prefix-list ihug-networks seq 40 permit 202.49.148.0/23 le 24 ip prefix-list ihug-networks seq 45 permit 202.49.176.0/23 le 24 ip prefix-list ihug-networks seq 50 permit 202.49.180.0/23 le 24 ip prefix-list ihug-networks seq 55 permit 202.49.186.0/24 ip prefix-list ihug-networks seq 60 permit 202.49.240.0/22 le 24 ip prefix-list ihug-networks seq 65 permit 202.49.249.0/24 ip prefix-list ihug-networks seq 70 permit 202.50.84.0/24 ip prefix-list ihug-networks seq 75 permit 202.50.103.0/24 ip prefix-list ihug-networks seq 80 permit 202.50.255.0/24 ip prefix-list ihug-networks seq 85 permit 203.109.128.0/17 le 24 ip prefix-list ihug-networks seq 90 permit 203.118.128.0/18 le 24 ip prefix-list ihug-networks seq 95 permit 203.173.128.0/17 le 24 ip prefix-list ihug-networks seq 100 permit 210.55.184.0/24 ip prefix-list ihug-networks seq 105 permit 210.55.202.0/23 le 24 ip prefix-list ihug-networks seq 110 permit 210.55.248.0/21 le 24 -- Leon Chang, CCNP, CCDP Senior Network Engineer The Internet Group Ltd. (IHUG), Auckland, New Zealand AS7657 PH: +64 9 359 2710 --------------------------------------------------------------------- - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Prefix list update for Ihug AS7657
by Leon Chang 09 Oct '02

09 Oct '02

We have tidied up our peering prefix list a bit and added a new network 203.118.128.0/18. Can our domestic peers please update their current prefix-list. Regards, Leon Chang ip prefix-list ihug-networks description ihug peering prefix-list contact: noc(a)ihug.co.nz ip prefix-list ihug-networks seq 5 permit 202.36.94.0/23 le 24 ip prefix-list ihug-networks seq 10 permit 202.37.136.0/24 ip prefix-list ihug-networks seq 15 permit 202.37.182.0/24 ip prefix-list ihug-networks seq 20 permit 202.37.187.0/24 ip prefix-list ihug-networks seq 25 permit 202.37.194.0/24 ip prefix-list ihug-networks seq 30 permit 202.49.59.0/24 ip prefix-list ihug-networks seq 35 permit 202.49.88.0/23 le 24 ip prefix-list ihug-networks seq 40 permit 202.49.148.0/23 le 24 ip prefix-list ihug-networks seq 45 permit 202.49.176.0/23 le 24 ip prefix-list ihug-networks seq 50 permit 202.49.180.0/23 le 24 ip prefix-list ihug-networks seq 55 permit 202.49.186.0/24 ip prefix-list ihug-networks seq 60 permit 202.49.240.0/22 le 24 ip prefix-list ihug-networks seq 65 permit 202.49.249.0/24 ip prefix-list ihug-networks seq 70 permit 202.50.84.0/24 ip prefix-list ihug-networks seq 75 permit 202.50.103.0/24 ip prefix-list ihug-networks seq 80 permit 202.50.255.0/24 ip prefix-list ihug-networks seq 85 permit 203.109.128.0/17 le 24 ip prefix-list ihug-networks seq 90 permit 203.118.128.0/18 le 24 ip prefix-list ihug-networks seq 95 permit 203.173.128.0/17 le 24 ip prefix-list ihug-networks seq 100 permit 210.55.184.0/24 ip prefix-list ihug-networks seq 105 permit 210.55.202.0/23 le 24 ip prefix-list ihug-networks seq 110 permit 210.55.248.0/21 le 24 -- Leon Chang, CCNP, CCDP Senior Network Engineer The Internet Group Ltd. (IHUG), Auckland, New Zealand AS7657 PH: +64 9 359 2710 --------------------------------------------------------------------- - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

nameserver redundancy (of debatable on-topicness)
by Joe Abley 09 Oct '02

09 Oct '02

Morning, I'm looking for an ISP with a presence in Wellington who would like to swap 5U of colo somewhere close to the WIX for something similar in Auckland, close to the APE. Gear to be colo'd is a rack-mount nameserver plus UPS plus router; traffic to the nameserver will be overwhelmingly domestic, mainly DNS, plus a tiny dribble of management traffic. Reason for looking is to increase nameserver diversity. If anybody is interested, please drop me some private mail. Thanks! Joe - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

KCBBS / APE routing loop
by James Spooner 08 Oct '02

08 Oct '02

On behalf of a KCBBS customer... traceroute to 202.27.195.82 (202.27.195.82), 30 hops max, 38 byte packets 1 mid-e1-int (210.55.255.62) 8.859 ms 0.394 ms 0.363 ms 2 a3-0-29.tkcr1.global-gateway.net.nz (202.37.247.153) 12.388 ms 48.227 ms 90.343 ms 3 A5-0-0-19.akcr5.global-gateway.net.nz (202.50.245.105) 58.507 ms 118.496 ms 100.527 ms 4 telstraclear1.ape.net.nz (192.203.154.32) 115.903 ms 82.286 ms 62.978 ms 5 netgate.ape.net.nz (192.203.154.48) 28.580 ms 17.625 ms 19.105 ms 6 telstraclear1.ape.net.nz (192.203.154.32) 23.076 ms 22.687 ms * BGP Path: 202.27.192.0/21 202.37.247.153 IGP 0 100 SEQ 4648 4768 9303 9303; No global-gateway traffic seems to be getting to KCBBS, other APE peers (ICONZ) seem fine. International also working (according to route-server.cerf.net) Is somebody leaking routes at APE ? Cheers James - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Intel HAM modem strings ?
by Simon Byrnand 07 Oct '02

07 Oct '02

Not sure if this is ontopic, but I'll give it a go anyway ;-) Does anyone know of an init string for Intel HAM based modems that will force them to connect using only V34 ? (That works ?) People on rural lines often can't get reliable connections using V90 or 56Flex, but forcing the modem to use V34 usually makes a huge improvement. For the common Rockwell and Lucent based modems its easy, for example -V90=0S38=0 for LT winmodems and +MS=V34 for most Rockwell based modems. So far I've been totally unable to find a string that actually works for the Intel HAM based modems, and they seem to be worse than other modems when it comes to not falling back automatically on poor lines. (Read: they wont even connect at all on typical rural lines where Lucent/Rockwell modems will at least get some kind of connection, albeit dodgy) Any pointers ? (Sorry if this is offtopic, but I thought it was an issue that most ISP's will have had to deal with at some time or another) Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

DRS Outage
by Tim John 07 Oct '02

07 Oct '02

Hi all, Many of you may already know that the Shared Registry System is to be implemented this weekend, 12th - 14th October 2002. As a result, the DRS will be taken down at 10:00 hrs on Saturday and will not be available until 01:00 hrs on the following Monday. A manual zone build will be pushed at 10:00 on Saturday and there will not be another zone push until 11:00 on Monday 14th. No domain registrations or modifications will be allowed during the outage period. There is currently a note from the Domain Name Commissioner (DNC) and this can be found at the Domainz website under 'Info/Media Center' or on the DNC's site - http://www.dnc.net.nz. We apologies for this inconvenience but look forward to using the new Registry system early next week. Regards, Tim Tim John IT Manager Managing New Zealand's National domain name Registry E-mail: tim.john(a)domainz.net.nz Web: www.domainz.net.nz Fax: (04) 473 - 4569 Phone: (04) 473 - 4567 DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Mailwasher (again)
by Simon Lyall 07 Oct '02

07 Oct '02

Sorry to divert people from the Microsoft bashing but I'd thought I'd bring this up again. I mentioned a few months ago about Mailwasher forging bounces, anyway I was hoping they would go away or their latest version would fix the problem but it doesn't appear that way. Checking our outgoing queues around 50% of emails waiting to go out appear to be mailwasher forgeries ( bounces from our mail servers are elsewhere) and I'm getting a little worried. I really try hard to get customer email delivered and I don't what "normal" email to get delayed when it gets stuck behind mailwasher junk. Just wondering what others are doing? Private email is okay. I'm trying to avoid blocking or deleting them if I can. One suggestion was to forward them all to feedback(a)mailwasher.net :) . The other problem is that it is fairly hard to actually pick these messages out from others in the queue safely. Maybe I can sic the fraud squad on Mr Bolton for forging my email address. FDrom their FAQ: Q. How does MailWasher bounce messages? A. MailWasher uses an algorithm to determine the best route to send the bounced message back (from, reply to, return path) and actually sends the bounce back via your isp's postmaster, so it looks exactly like it has come from your isp and not from you at your address. If the spammer has used a fake address, then your bounce message will itself be bounced back to the postmaster and you won't receive the bounced bounce email. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

11 22

Re: Mailwasher (again)
by Simon Byrnand 02 Oct '02

02 Oct '02

At 11:11 3/10/02 +1200, Simon Lyall wrote: >On Thu, 3 Oct 2002, Simon Byrnand wrote: >> I have to agree here. By definition email should have a return address if >> it is "genuine". If the domain name of the "from" address doesn't even >> exist, then its almost a sure bet that the email is bogus, and I see no >> reason it should be accepted. Most MTA's seem to default to this action as >> well. > >I guess you don't get email from people who post to newsgroups, most of >them use bogus addresses so if they reply via email to a post the address >will not be legit ( john(a)notihug.co.nz.nospam sort of thing ). Most newsreaders I've seen that have email integrated allow you to set a different email address for posting to the news group than for sending email. Even Outlook Express does this. People writing newsreaders know that fake address are almost mandatory to avoid being spammed....Newsreaders that don't have integrated email will be launching the normal email program with normal email address. You definately have a point, but I've honestly never come across this actually happening before. >Checking around I also came across: > >From: Promos(a)Glengarry Wines > >Which appears to be a legit little mailout sent last week from >e-wine(a)Glengarry.co.nz . I didn't see any others in the search. Are you talking about the envelope-sender address or the "From:" header ? It looks like you're talking about the From: header here. I'm (and presumably Chris was) talking about the envelope from address, as exchanged at the beginning of the SMTP transaction... >Our spam filtering also has a "No MX for From address" rules that helps >block those. Still if you feel comfortable blocking customer's email on >that basis I guess it's your choice. It's not part of a spam filter, its just a standard sendmail setting, which defaults to on. (I could turn it off if I wanted to) You made me curious though, so I did a quick survey of the ISP's listed in iMAG to see if they'd accept a message with a bogus domain as an envelope from address: (not a very scientific survey, but..) Actrix: Yes Baycity: No Clear Net: No Ezysurf: No E3: No HyperNet: Yes Iconz: No Igrin: No Ihug: Yes Inspire: No Iprolink: Yes Jafa Net: No Kc Computer: No Maxnet: Yes Net4U: Yes Orcon: Yes paradise.net: No Planet: No Quik: No Quicksilver: No Slingshot: Yes Valuenet: Yes Watchdog: Yes Wave: No Worldnet: Yes Xtra: Yes Zip Internet: Yes Thats 13 Yes's, and 14 No's. A couple of remarks - a few are actually virutal ISP's sharing the same mailserver so that would skew the results a bit, also I only checked the primary MX. I also suspect that it really comes down to the defaults of the mailserver in question rather than a thought-out policy, as most (but not all) the servers that rejected the bogus message were sendmail, or looked like sendmail, and that is the default of sendmail. (As an aside, I noticed more than one who were running ancient versions of sendmail that have, umm, known bugs.... ahem :) Regards, Simon Byrnand iGRIN Internet - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: [NZNET] RE: Virus alert
by Saby Singh 02 Oct '02

02 Oct '02

1 0