OK, who's the idiot using tcwireless.us?

Valdis.Kletnieks at vt.edu Valdis.Kletnieks at vt.edu
Tue Oct 7 20:14:17 UTC 2008

Somebody on the NANOG mailing list has their mail pointing to tcwireless.us,
which is throwing challenge/response mail like the following:

Your message

From: Valdis.Kletnieks at vt.edu
To: n3td3v <xploitable at gmail.com>
Subject: Re: Fwd: cnn.com - Homeland Security seeks cyber counterattack system (
Einstein 3.0)
Date: 10/6/2008

has been just received by gmail.com mailserver.

To prove that your message was sent by a human and not a computer, please
visit the URL below and type in the alphanumeric text you will see in the
image. You will be asked to do this only once for this recipient.


Your message will be automatically deleted in a few days if you do not
confirm this request.


Note it says 'gmail.com mailserver'.  Paul Ferguson reported to me that the one
he saw said 'received by vt.edu mailserver'.  Also note that the From/To
has lost nanog at nanog.org - for both my note and Paul's (in fact, looking at
Paul's actual posting and mine show nanog at nanog.org as being the only common
link, thus the "must be a nanog subscriber" conclusion).

Please, if you're going to use a C/R, at least learn how to whitelist the
mailing lists you're on.  And if you can't figure out how to do that, please
do us all a favor and not try to run an operational network...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20081007/56a3eb60/attachment.sig>

More information about the NANOG mailing list