Edge 1 Networks/Williams Communications Group
Jeff Kell
jeff-kell at utc.edu
Tue Aug 5 02:26:02 UTC 2003
After several run-ins with Edge 1 Networks [69.44.28.0/22] having their
machines "hijack" victim machines on our networks infected with Jeem,
and then making their spam runs, I've had it. I have reported both to
Edge 1 and their parent Williams Communications Group [AS7911] with no
result and I will be blocking Edge 1 [in theory, AS29986, but no doubt
private spewage from WCG.NET).
They hijacked a Jeem proxy on July 17th, it was shut down. The help
desk thought they had cleaned it up, but within 30 mins of placing it
back online again, Edge 1 grabbed it again. I brought it into the lab
with a sniffer, rebooted (new IP), and Edge 1 picked it up within 10
minutes and began spam/proxying.
This past Sunday, a similarly Jeem'ed machine was hijacked by the same
Edge 1 block (numerous machines in the Edge 1 block, mind you) and due
to me being out of the office it wasn't noticed and shutdown until
Tuesday, after a little over a half million proxied spams.
Are these people just totally off-the-wall? Google searches seem to concur.
I am awaiting confirmation that ALL the proxies originated from Edge 1
(takes a while to churn through those gigs of pix logs).
Jeff Kell
University of Tennessee, Chattanooga
More information about the NANOG
mailing list