HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

John van Oppen jvanoppen at spectrumnet.us
Fri Apr 1 01:00:54 CDT 2011


Why does it matter what his position is?   Sounds like they had a forged LOA from the customer and that they fixed the issue when they found out about it.    I am not sure you can ask too much more from a network operator, the best thing we can hope for are companies that will cancel customers if they are abuse sources, that is exactly what happened here.

Lots of people are posting on nanog with outside email addresses because they don't want to be tied too closely to the corporation for which they work, it seems totally reasonable to me especially given the mix of personal and professional ties a lot of us have in this community.    The main issue here is getting results and it sounds like that happened here pretty quickly.   Most technical types are good people and for the most part will work though their corporate BS to get abuse issues solved as quickly as they can.   I know we do try to resolve abuse quickly and people who are nice and provide data up front just help expedite the process further, acting like a jerk is by far the least productive way to engage people in the nanog community. 


John

-----Original Message-----
From: Ronald F. Guilmette [mailto:rfg at tristatelogic.com] 
Sent: Thursday, March 31, 2011 5:46 PM
To: nanog at nanog.org
Subject: Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care? 


In message <AANLkTinVLqeFVYkc91d8P-N9zvDGR5PrXREypTuiM0jg at mail.gmail.com>,
rr <rooknee at gmail.com> wrote:

>Hmm, thought it was a NANOG prerequisite to be able to do a google 
>search. Should be pretty easy to find this info with that tool in your 
>handbag.

Which info is that, exactly?  Your title at Integra Telecom?

Umm... well... yes.... I guess this is you, right?

  http://www.linkedin.com/pub/randy-rooney/6/9ab/22a

So, are you THE Engineering Manager, or merely AN Engineering Manager at Integra Telecom?  I'm guessing that it is a big enough outfit that you probably have more than one.

(Sorry, but I can't help snickering a bit at your _prior_ employment.
As I feel sure you are already painfully aware, having that on your resume does not exactly inspire a whole lotta confidence in the notion that you are a straight shooter.  The words ``cover up'' are the ones that come most immediately to mind.)

>With the above tool I've got your phone # and would be happy to call 
>you if you'd like clarification on our process.

No thanks.  I didn't ask for "clarification" of your "process" (whatever the hell THAT might mean), and frankly it doesn't interest me.  Your
process is... well... your process.   Whatever it may be, it belongs to
you and you should probably keep it to yourself.  (Who knows?  Since business processes are now patentable, maybe someday you can get a patent on it!)

I did however ask for the name of the crook whose name was on the check that paid for the hijacked space routing.  Is that something you can respond to, or no?  If not, why not?

Was Integra Telecom _actually_ defrauded?  If so, who defrauded you?

Did your customer, Circle Internet defraud you?  If you are claining that THEY are also an innocent party in this, then who defrauded them?  Whose name was on the check that THEY cashed?

It really is a rather simple question, and doesn't require an elaborate, convoluted, or lengthy digression into the details of your "process".

Ya know, maybe it's just me, but it would seem to me that that if either you or your customer, Circle Internet, were in fact defrauded in this case, that both of you would be altogether ready, willing, and indeed eager to ``out'' the actual crooked perpetrator... you know... instead of, like, hiding the perp's identity and thus helping him to cover his tracks.
But I guess that's just me.  (When somebody cheats _me_, I am not myself in the habit of then going out of my way to protect him.)

Don't misunderstand me.  If your company was in fact dedrauded, then allow me to express my sincere condolences for your loss.  Or would it be more accurate to say your gain?  You DID cash the check right?  I mean your company does NOT have a policy of granting everybody three months of free service, right?

>Please just reply to me off-list.

No thanks.

As Jodie Foster said in the movie Contact, ``This isn't a person to person call.''

Crooks, hijacking, and mass spamming affect everybody on the whole Internet.

I didn't ask for the name of the crook who signed the check just for my private or personal edification.  Other ISPs should know who they need to be on the lookout for.

I can assure you that just because YOU have now stopped routing space for this crook, that doesn't mean that he's going to just fold up his tent and slink quietly away into oblivion.  In fact I already have evidence in hand that he's still got both IP space and snowshoe spamming domains located elsewhere (including elsewhere on Circle Internet, see below) that he is continuing to use, even as we speak.

On the other hand, of course, if Integra and/or Circle Internet were in fact ``in on the game'' from the get-go, then in that case I could well and truly understand why both of your companies might now be reluctant to give up your cohort.


Regards,
rfg


P.S.  I gather that nobody at your place even so much as raised an eyebrow when tiny little Circle Internet, a company whose biggest _legitimate_ IP block prior to this incident was a mere /21, suddenly showed up on your doorstep asking to have an entire fresh new /16, belonging to an major, internationally known chemical company routed for them, correct?

P.P.S.  OK, so you are reluctant to give up the actual hijacker.  So let's just skip that for now.  Instead how about if you just tell us who owns the followng domain names which are all getting DNS from Circle Internet IP space, even as we speak.  And no, I _do not_ want you to just regurgitate the fradulent bull puckey that's present within the relevant WHOIS records.

(To paraphrase Red Riding Hood "My my grandma!  What a lot of domains you have!"  Odd that all of them were created so recently, and that none of them seem even have associated web sites.  But again, I'm sure that I'm the only one in the Universe who finds any of that odd.  Yea.)


208.85.32.114
	dns2.virtualcheck.info
		pinkcreditscore.info
		pinkcreditreport.info
		pinkcreditdeals.info
		orangereports.info
		orangeoffers.info
		orangegifts.info
		orangecreditsco.info
		orangecreditreport.info
		orangecreditdeals.info
		onlinecredit-check.info
		myfreecredtiscore.info
		knowyourself.info
		healthsample.info
		happinessonline.info
		freecreditscore360.info
		doctors-orders.info
		creditscorealerts.info
208.85.32.246
	ns2.rockboys1a.com
		yesimprove.info
		withoutinvestigate.info
		withoutcritique.info
		withinfocus.info
		withenable.info
		visionconsolidate.info
		versuscoordinate.info
		validateinstruct.info
		untilreview.info
		untilfocus.info
		unforgettableidea.info
		underneathunlikemeasure.info
		underneathunlike.info
		uncommonsuggestion.info
		uncommonguidance.info
		unbelievableguidance.info
		trumpenforce.info
		totutor.info
		topconvert.info
		tipsproduce.info
		timesenable.info
		throughreview.info
		throughoutcompare.info
		thansurvey.info
		terrificexplain.info
		surveydelegate.info
		supremeteach.info
		supplyindividualize.info
		submitteach.info
		submitinstruct.info
		strikingtrust.info
		strikingproposal.info
		staggeringlearn.info
		sincesurvey.info
		searchrecommend.info
		searchproduce.info
		searchprioritize.info
		retrievelive.info
		retrievechic.info
		reserveenable.info
		researchgrow.info
		remarkablesubject.info
		registersimulate.info
		registeradvise.info
		reducequick.info
		recordteach.info
		recordinstruct.info
		recordenable.info
		reconcilelearn.info
		reconcilefresh.info
		raresubject.info
		quickhandle.info
		projectmaxi.info
		projectabc.info
		phenomenalmentor.info
		pastexperiment.info
		outstandingprove.info
		orderinstil.info
		orderevaluate.info
		operateinstil.info
		operateevaluate.info
		ontostimulate.info
		ontoexperiment.info
		ontoadvise.info
		offconduct.info
		noteworthyeducation.info
		nearbyinvestigate.info
		nearbyindividualize.info
		moremanage.info
		measurenavigate.info
		measurecontract.info
		marvellousteach.info
		marvellousintroduce.info
		magnificienttell.info
		locatemerge.info
		locateimprove.info
		locatehire.info
		locatedelegate.info
		likesurvey.info
		keyinspect.info
		investigatereview.info
		investigateinspect.info
		inexamine.info
		hotappoint.info
		groovyrecommend.info
		forsimulate.info
		followingteach.info
		flexlead.info
		flexconsider.info
		filecoordinate.info
		fantasticlearn.info
		failingevaluate.info
		extraordinarysuggestion.info
		extraordinaryproposal.info
		extraordinarylearn.info
		extractterminate.info
		extractapprove.info
		experimentsecure.info
		executeenable.info
		excludingdetect.info
		exceptionalwisdom.info
		exceptionaltutor.info
		exceptionalinfo.info
		examinelead.info
		estimateok.info
		estimatedouble.info
		dreamsupervise.info
		downmeasure.info
		distributefocus.info
		determineup.info
		detectlead.info
		despiteinstruct.info
		dealsstrengthen.info
		dayinspect.info
		critiqueattain.info
		cooloversee.info
		conservemax.info
		conductimprove.info
		conducthandle.info
		conducteliminate.info
		concerningfocus.info
		concerning.info
		computefind.info
		completehire.info
		compiletutor.info
		compileevaluate.info
		codesimulate.info
		coachstimulate.info
		classifytrain.info
		classifycoordinate.info
		circainform.info
		butindividualize.info
		budgetover.info
		budgetgrow.info
		besthandle.info
		besideevaluate.info
		beneathsimulate.info
		belowexamine.info
		behindsimulate.info
		barringcoordinate.info
		atopsurvey.info
		atopextract.info
		atenable.info
		atcompare.info
		assistindividualize.info
		answersimulate.info
		amongextract.info
		againstsimulate.info
		advocateevaluate.info
		abovemotivate.info
		finelovewithme.com
		whosthefarest.com
		rockboys1b.com
		rockboys1a.com
		leanbackfront.com
	ns1.rockboys1a.com 155
		yesimprove.info
		withoutinvestigate.info
		withoutcritique.info
		withinfocus.info
		withenable.info
		visionconsolidate.info
		versuscoordinate.info
		validateinstruct.info
		untilreview.info
		untilfocus.info
		unforgettableidea.info
		underneathunlikemeasure.info
		underneathunlike.info
		uncommonsuggestion.info
		uncommonguidance.info
		unbelievableguidance.info
		trumpenforce.info
		totutor.info
		topconvert.info
		tipsproduce.info
		timesenable.info
		throughreview.info
		throughoutcompare.info
		thansurvey.info
		terrificexplain.info
		surveydelegate.info
		supremeteach.info
		supplyindividualize.info
		submitteach.info
		submitinstruct.info
		strikingtrust.info
		strikingproposal.info
		staggeringlearn.info
		sincesurvey.info
		searchrecommend.info
		searchproduce.info
		searchprioritize.info
		retrievelive.info
		retrievechic.info
		reserveenable.info
		researchgrow.info
		remarkablesubject.info
		registersimulate.info
		registeradvise.info
		reducequick.info
		recordteach.info
		recordinstruct.info
		recordenable.info
		reconcilelearn.info
		reconcilefresh.info
		raresubject.info
		quickhandle.info
		projectmaxi.info
		projectabc.info
		phenomenalmentor.info
		pastexperiment.info
		outstandingprove.info
		orderinstil.info
		orderevaluate.info
		operateinstil.info
		operateevaluate.info
		ontostimulate.info
		ontoexperiment.info
		ontoadvise.info
		offconduct.info
		noteworthyeducation.info
		nearbyinvestigate.info
		nearbyindividualize.info
		moremanage.info
		measurenavigate.info
		measurecontract.info
		marvellousteach.info
		marvellousintroduce.info
		magnificienttell.info
		locatemerge.info
		locateimprove.info
		locatehire.info
		locatedelegate.info
		likesurvey.info
		keyinspect.info
		investigatereview.info
		investigateinspect.info
		inexamine.info
		hotappoint.info
		groovyrecommend.info
		forsimulate.info
		followingteach.info
		flexlead.info
		flexconsider.info
		filecoordinate.info
		fantasticlearn.info
		failingevaluate.info
		extraordinarysuggestion.info
		extraordinaryproposal.info
		extraordinarylearn.info
		extractterminate.info
		extractapprove.info
		experimentsecure.info
		executeenable.info
		excludingdetect.info
		exceptionalwisdom.info
		exceptionaltutor.info
		exceptionalinfo.info
		examinelead.info
		estimateok.info
		estimatedouble.info
		dreamsupervise.info
		downmeasure.info
		distributefocus.info
		determineup.info
		detectlead.info
		despiteinstruct.info
		dealsstrengthen.info
		dayinspect.info
		critiqueattain.info
		cooloversee.info
		conservemax.info
		conductimprove.info
		conducthandle.info
		conducteliminate.info
		concerningfocus.info
		concerning.info
		computefind.info
		completehire.info
		compiletutor.info
		compileevaluate.info
		codesimulate.info
		coachstimulate.info
		classifytrain.info
		classifycoordinate.info
		circainform.info
		butindividualize.info
		budgetover.info
		budgetgrow.info
		besthandle.info
		besideevaluate.info
		beneathsimulate.info
		belowexamine.info
		behindsimulate.info
		barringcoordinate.info
		atopsurvey.info
		atopextract.info
		atenable.info
		atcompare.info
		assistindividualize.info
		answersimulate.info
		amongextract.info
		againstsimulate.info
		advocateevaluate.info
		abovemotivate.info
		finelovewithme.com
		whosthefarest.com
		rockboys1b.com
		rockboys1a.com
		leanbackfront.com





More information about the NANOG mailing list