Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread rr
For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.

Randy Rooney

On Thu, Mar 31, 2011 at 10:04 AM, Jima na...@jima.tk wrote:
 On 03/30/2011 03:53 PM, Ronald F. Guilmette wrote:

 I just stumbled onto this one the other day.

 Apparently, Spamhaus has known about this one for THREE MONTHS already:

    http://www.spamhaus.org/sbl/sbl.lasso?query=SBL98308

 It's being routed by AS11730, aka Circle Internet LTD, a known spammer-
 friendly provider that I have come across many times in the past.

 They in turn are getting connectivity from:

    AS26769  BandCon
    AS7385   Integra Telecom

 These companies are also not known for being especially scruplous either.
 But I mean seriously, Jesus Christ!  Does ANYBODY even give a crap about
 blatant naked IP space hijacking anymore?  Or is the entire net now on
 its final slow descent into utter chaos?

  This address space seems to be offline now.  I for one forwarded info to a
 contact at Integra, but I can't attest to whether that had anything to do
 with it.

  I guess we can call this a victory for the community?  I dunno.

     Jima





Re: HIJACKED: 159.223.0.0/16 -- WTF? Does anybody care?

2011-03-31 Thread rr
Hmm, thought it was a NANOG prerequisite to be able to do a google
search. Should be pretty easy to find this info with that tool in your
handbag.

With the above tool I've got your phone # and would be happy to call
you if you'd like clarification on our process.

Please just reply to me off-list.

Randy

On Thu, Mar 31, 2011 at 12:32 PM, Ronald F. Guilmette
r...@tristatelogic.com wrote:

 In message AANLkTikMqBx=cu5autr7addyn7u7wbeoww2qa9wdz...@mail.gmail.com,
 rr rook...@gmail.com wrote:

For the record, Integra Telecom did have LOA for said netblock.
Needless to say LOA was forged on company letterhead with appropriate
signatures. Once brought to our attention we attempted to contact
customer to no avail, netblock has been removed until they prove
otherwise.

Randy Rooney


 Mr. Rooney,

 Since you have been kind enough to drop by, you know, to help clarify what
 went on here, I wonder if you would mind very much just providing a couple
 of small additional clarifications.

 First, could you tell me what job title you hold at Integra Telecom please?
 (I wouldn't even ask, but you are apparently posting from a gmail account,
 and that always makes me a bit... well... leary.)

 Second, because I am actually an ignorant son-of-a-bitch (despite any
 possible appearances to the contrary), I wonder if, just for my personal
 edification, you could tell me exactly what LOA stands for in this context.
 (Yes, I really don't know, but would like to.)

 Thirdly, I'd very much like to know if your company is in the habit of
 providing services (e.g. transit, routing) to other parties at no charge,
 and for extended periods of time

 Lastly, assuming that your company is NOT in the habit of providing services
 (e.g. routing, transit) to other parties at no charge, then I think that I
 can speak for many here when I say that I would really appreciate it if you
 could tell me/us whose name was on the check that was used to pay for the
 services that your company apparently did provide to the 159.223.0.0/16 IP
 block, apparently for a period in excess of three months.

 If in fact the other party involved in this incident deceived and defrauded
 you in some way, then I hardly think that this information, i.e. the name
 on the check that paid for all this, is something that Integra has any
 special obligation to keep secret.  Even if there ever had been any such
 obligation, leagl, ethical, or otherwise, I do believe that the other
 party involved has now nullified any such obligation by their very act
 of comitting a rather outrageous and damaging fraud upon your company.

 I look forward to your response.


 Regards,
 rfg