subject:"RE\: Atrivo\/Intercage"

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, Sep 23, 2008 at 10:52 PM, Paul Ferguson [EMAIL PROTECTED]
wrote:

 On Tue, Sep 23, 2008 at 10:13 PM, Russell Mitchell [EMAIL PROTECTED]
 wrote:

 I believe the blocks your referring to are their 85.255 Blocks?
 Registered to InHoster. I believe those prefixes are an entity of
 their's, though I don't know for sure. Perhaps ask them?


 Thanks, thats right -- Inhoster. Operating out of Odessa and blacklisted
 virtually everywhere.


Sorry, my last post on this issue.

As you may (or may not) know, Inhoster's domain(s) were suspended due to
criminal activity:

http://whois.domaintools.com/inhoster.com

The prefixes you mention, were deliberately being originated by AS27595  up
until the recent kerfluffle and disconnect on Saturday night:

 Prefixes added and withdrawn by this origin AS in the past 7 days.

  - 64.28.176.0/20  Withdrawn
  - 67.210.0.0/21   Withdrawn
  - 67.210.8.0/22   Withdrawn
  - 67.210.14.0/23  Withdrawn
  - 69.22.162.0/23  Withdrawn
  - 69.22.168.0/21  Withdrawn
  - 69.22.184.0/22  Withdrawn
  - 69.31.64.0/20   Withdrawn
  - 69.50.160.0/19  Withdrawn
  - 85.255.113.0/24 Withdrawn
  - 85.255.114.0/23 Withdrawn
  - 85.255.116.0/22 Withdrawn
  - 85.255.120.0/23 Withdrawn
  - 85.255.122.0/24 Withdrawn
  - 216.255.176.0/20Withdrawn
  - 216.255.176.0/22Withdrawn
  - 216.255.180.0/22Withdrawn
  - 216.255.184.0/22Withdrawn
  - 216.255.188.0/22Withdrawn

And they magically reappeared in Cernel (AS36445) almost immediately:

Prefix   AS Path
  64.28.187.0/24   12654 3257 36445
  67.210.12.0/23   12654 3257 36445
  85.255.112.0/20  12654 3257 36445
  93.188.161.0/24  12654 3257 36445
  93.188.166.0/24  12654 3257 36445


This was not an accident.

So what you are saying is that these prefixes have always belonged to
Inhoster?

Thanks,

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2doTq1pz9mNUZTMRAupwAKDxEF9kyS/UoTb/Hl2FwEGM1tsj2gCfYF16
qyG0vUAmfxfdQg/vqHFCxbw=
=T+0o
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: Atrivo/Intercage

2008-09-24 Thread Jo Rhett


On Sep 23, 2008, at 8:12 PM, Joe Greco wrote:

Which is not acceptable.  You answer your abuse complaints, you shut
down your spammers.  Period, end of subject.


That's a bit '90's.  I'll settle for s/answer/handle/, because I don't
think that most sites are willing to actually discuss abuse issues  
with

random folks submitting complaints, and so that leaves you with either
sending a form letter of some sort, or not saying anything.


I went out of my way to get it written into our customer contract that  
we can discuss abuse issues with the affected parties.


And I am simply an employee, neither an executive nor an owner, so  
this took a bit of doing.  But it has given me great pleasure the few  
times that we made a mistake with a customer, and I got to tell the  
affected parties that the abuser is now homeless ;-)


--
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Paul,

Sorry I didn't make this clear enough in the previous responses.

The prefixes that are registered to Inhoster belong to Esthost.
I'm not sure how or why you think those prefixes belong to us.

These prefixes belong DIRECTLY to us:
- 69.50.160.0/19              Withdrawn
- 216.255.176.0/20            Withdrawn

These prefixes belong DIRECTLY to nLayer, and were LEASED to us:
- 69.22.162.0/23              Withdrawn
- 69.22.168.0/21              Withdrawn
- 69.22.184.0/22              Withdrawn
- 69.31.64.0/20              Withdrawn
 
The prefixes LEASED to us BY nLayer are being reclaimed at the end of this 
month 09/30/08, as the lease contract is set to cease at that time.

Hopefully, that is clear enough for you.

Thank you for your time. Have a great day.
---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Paul Ferguson [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: nanog@nanog.org
Sent: Tuesday, September 23, 2008 11:11:39 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, Sep 23, 2008 at 10:52 PM, Paul Ferguson [EMAIL PROTECTED]
wrote:

 On Tue, Sep 23, 2008 at 10:13 PM, Russell Mitchell [EMAIL PROTECTED]
 wrote:

 I believe the blocks your referring to are their 85.255 Blocks?
 Registered to InHoster. I believe those prefixes are an entity of
 their's, though I don't know for sure. Perhaps ask them?


 Thanks, thats right -- Inhoster. Operating out of Odessa and blacklisted
 virtually everywhere.


Sorry, my last post on this issue.

As you may (or may not) know, Inhoster's domain(s) were suspended due to
criminal activity:

http://whois.domaintools.com/inhoster.com

The prefixes you mention, were deliberately being originated by AS27595  up
until the recent kerfluffle and disconnect on Saturday night:

    Prefixes added and withdrawn by this origin AS in the past 7 days.

          - 64.28.176.0/20              Withdrawn
          - 67.210.0.0/21              Withdrawn
          - 67.210.8.0/22              Withdrawn
          - 67.210.14.0/23              Withdrawn
          - 69.22.162.0/23              Withdrawn
          - 69.22.168.0/21              Withdrawn
          - 69.22.184.0/22              Withdrawn
          - 69.31.64.0/20              Withdrawn
          - 69.50.160.0/19              Withdrawn
          - 85.255.113.0/24            Withdrawn
          - 85.255.114.0/23            Withdrawn
          - 85.255.116.0/22            Withdrawn
          - 85.255.120.0/23            Withdrawn
          - 85.255.122.0/24            Withdrawn
          - 216.255.176.0/20            Withdrawn
          - 216.255.176.0/22            Withdrawn
          - 216.255.180.0/22            Withdrawn
          - 216.255.184.0/22            Withdrawn
          - 216.255.188.0/22            Withdrawn

And they magically reappeared in Cernel (AS36445) almost immediately:

Prefix              AS Path
  64.28.187.0/24      12654 3257 36445
  67.210.12.0/23      12654 3257 36445
  85.255.112.0/20      12654 3257 36445
  93.188.161.0/24      12654 3257 36445
  93.188.166.0/24      12654 3257 36445


This was not an accident.

So what you are saying is that these prefixes have always belonged to
Inhoster?

Thanks,

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2doTq1pz9mNUZTMRAupwAKDxEF9kyS/UoTb/Hl2FwEGM1tsj2gCfYF16
qyG0vUAmfxfdQg/vqHFCxbw=
=T+0o
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
Engineering Architecture for the Internet
fergdawgster(at)gmail.com
ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, Sep 23, 2008 at 11:28 PM, Russell Mitchell [EMAIL PROTECTED]
wrote:


 Sorry I didn't make this clear enough in the previous responses.

 The prefixes that are registered to Inhoster belong to Esthost.
 I'm not sure how or why you think those prefixes belong to us.

 These prefixes belong DIRECTLY to us:
 - 69.50.160.0/19  Withdrawn
 - 216.255.176.0/20Withdrawn

 These prefixes belong DIRECTLY to nLayer, and were LEASED to us:
 - 69.22.162.0/23  Withdrawn
 - 69.22.168.0/21  Withdrawn
 - 69.22.184.0/22  Withdrawn
 - 69.31.64.0/20  Withdrawn

 The prefixes LEASED to us BY nLayer are being reclaimed at the end of
 this month 09/30/08, as the lease contract is set to cease at that time.

 Hopefully, that is clear enough for you.

 Thank you for your time. Have a great day.
 ---
 Russell Mitchell

 InterCage, Inc.


Clear as mud, thanks.

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2d6uq1pz9mNUZTMRAmkcAJ4toRsggJ325VfjkqK8QJKWQG4UegCg84x+
KwcuyxtFp7/x3/vScFTkP3I=
=/vFy
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Pedram M

Wow, this topic has really gotten old.


On Tue, Sep 23, 2008 at 11:31 PM, Paul Ferguson [EMAIL PROTECTED]wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 On Tue, Sep 23, 2008 at 11:28 PM, Russell Mitchell [EMAIL PROTECTED]
 wrote:


  Sorry I didn't make this clear enough in the previous responses.
 
  The prefixes that are registered to Inhoster belong to Esthost.
  I'm not sure how or why you think those prefixes belong to us.
 
  These prefixes belong DIRECTLY to us:
  - 69.50.160.0/19  Withdrawn
  - 216.255.176.0/20Withdrawn
 
  These prefixes belong DIRECTLY to nLayer, and were LEASED to us:
  - 69.22.162.0/23  Withdrawn
  - 69.22.168.0/21  Withdrawn
  - 69.22.184.0/22  Withdrawn
  - 69.31.64.0/20  Withdrawn
 
  The prefixes LEASED to us BY nLayer are being reclaimed at the end of
  this month 09/30/08, as the lease contract is set to cease at that time.
 
  Hopefully, that is clear enough for you.
 
  Thank you for your time. Have a great day.
  ---
  Russell Mitchell
 
  InterCage, Inc.
 

 Clear as mud, thanks.

 - - ferg

 -BEGIN PGP SIGNATURE-
 Version: PGP Desktop 9.6.3 (Build 3017)

 wj8DBQFI2d6uq1pz9mNUZTMRAmkcAJ4toRsggJ325VfjkqK8QJKWQG4UegCg84x+
 KwcuyxtFp7/x3/vScFTkP3I=
 =/vFy
 -END PGP SIGNATURE-


 --
 Fergie, a.k.a. Paul Ferguson
  Engineering Architecture for the Internet
  fergdawgster(at)gmail.com
  ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello John Doe,

I welcome any further comments you have.
We have to get past people such as yourself, and your blasphemous and false 
statements.

This is the same issue with the recent media and self-proclaimed Security 
Researchers. Fly-by-night mind you.

To help you out in your claims:
Yes, we did house a client whom had quite a run with their client's 
from various locations, such as Russia.
That Client is no longer hosted on our network. I myself spent all of monday 
afternoon, night, and tuesday morning shutting off EVERY machine they had 
leased in our Billing System. I'm currently working to scan further and see if 
there's anything I may have missed.

Yes, Russia is very well known for Virus and Malware writer's.

Yes, we have had issues with malware distribution from our network.
This was directly and near singularly related to the former client of ours. We 
did have another client, Hostfresh, whom had their share of malware issues.

Both have been completely and effectively removed. The server's leased to both 
of them have been canceled, and their machines have been shutoff.

Let me know if there's anything else you'd like me to state to the public.
We're on a rocky road right now. But it IS starting to smooth out.

Thank you for your time. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Mark Foo [EMAIL PROTECTED]
To: Bruce Williams [EMAIL PROTECTED]
Cc: Christopher Morrow [EMAIL PROTECTED]; nanog@nanog.org; Joe Greco [EMAIL 
PROTECTED]
Sent: Tuesday, September 23, 2008 11:08:21 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

NANOG:

Look, the people posting here who are trashing Intercage are pure security
analysts -- they
know and understand the evil that is Intercage. STOP TRYING TO ASSIST
INTERCAGE
-- you are effectively aiding and abetting the enemy.

Intercage/Atrivo hosts the malware cc botnets that DDoS your systems and
networks.

Intercage/Atrivo hosts the spyware that compromises your users' passwords.

Intercage/Atrivo hosts the adware that slows your customers' machines.

Don't take my word for it, DO YOUR OWN RESEARCH:
http://www.google.com/search?hl=enq=intercage+malware

You don't get called the ***American RBN*** for hosting a couple bad
machines. They
have and will continue to host much of the malware pumped out of America.
THEY
ARE NOT YOUR COMRADES..

These people represent the most HIGHLY ORGANZIED CRIME you will ever
come across. Most people were afraid to speak out against them until this
recent ground swell.

This is the MALWARE CARTEL. GET THE PICTURE?

Many links have been posted here that prove this already -- instead of
asking
what customers they cut off, let them show WHAT CUSTOMERS ARE LEGIT--
because there are NONE.





  I would suggest a different Step 1.  Instead of killing power, simply
  isolate the affected machine.  This might be as simple as putting up a
  firewall rule or two, if it is simply sending outgoing SMTP spam, or
  it's probably easiest (depending on the network gear of course) to
  just put the lan port into an isolated VLAN. It's not the 100%
  solution (some badness rm's itself once it loses connectivity to the
  internets) but it'd make things simpler for the client/LEA when they
  need to figure out what happened.
 
  -chris

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Pedram,

Until everyone fully understands the truth in ENGLISH, this topic will 
continue. This is what they demand.

As long as there are questions which relate to us, I will continue to respond.
When it's set in stone, and the false claims and false statements are 
corrected, this topic will cease.

I hope soon, people will realise and accept the truth that we are a LEGITIMATE 
Company that DOES Operate in the USA. We are NOT directly or in-directly 
related to any Russian's. We do NOT support, write, directly distribute, or 
knowingly allow the distribution of malware or other abusive activities to 
originate from our network. While the previous statements are questionable in 
the public's eye, I hope some time, you will understand it IS the truth.

Prove me wrong, PLEASE. 
If you know of any further malware or further abusive activities, such as the 
claimed CC Botnets, please PLEASE don't hesitate to tell me. abuse.intercage 
and russ..intercage and emil.intercage are live and operational. We are 
currently investigating the rest of our clientel and any site's or communities 
you can recommend to follow, we will follow. 

While it is clear that this will not be accepted by the community any time 
soon, it will eventually be accepted. That is what I am waiting for, however 
long it takes.

I can't stress this enough. We DO need your help to locate and eliminate 
abusive activities from our network. I know you have information, and I need 
you to atleast reclaim the faith that we WILL be very active against abuse 
originating from our network, and we WILL be proactive to locate and eliminate 
abusive activities on our network.

Thank you very much for all your time and future assistance. Have a great day.
---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Pedram M [EMAIL PROTECTED]
To: nanog@nanog.org
Sent: Tuesday, September 23, 2008 11:38:54 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Wow, this topic has really gotten old.


On Tue, Sep 23, 2008 at 11:31 PM, Paul Ferguson [EMAIL PROTECTED]wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 On Tue, Sep 23, 2008 at 11:28 PM, Russell Mitchell [EMAIL PROTECTED]
 wrote:


  Sorry I didn't make this clear enough in the previous responses.
 
  The prefixes that are registered to Inhoster belong to Esthost.
  I'm not sure how or why you think those prefixes belong to us.
 
  These prefixes belong DIRECTLY to us:
  - 69.50.160.0/19              Withdrawn
  - 216.255.176.0/20            Withdrawn
 
  These prefixes belong DIRECTLY to nLayer, and were LEASED to us:
  - 69.22.162.0/23              Withdrawn
  - 69.22.168.0/21              Withdrawn
  - 69.22.184.0/22              Withdrawn
  - 69.31.64.0/20              Withdrawn
 
  The prefixes LEASED to us BY nLayer are being reclaimed at the end of
  this month 09/30/08, as the lease contract is set to cease at that time.
 
  Hopefully, that is clear enough for you.
 
  Thank you for your time. Have a great day.
  ---
  Russell Mitchell
 
  InterCage, Inc.
 

 Clear as mud, thanks.

 - - ferg

 -BEGIN PGP SIGNATURE-
 Version: PGP Desktop 9.6.3 (Build 3017)

 wj8DBQFI2d6uq1pz9mNUZTMRAmkcAJ4toRsggJ325VfjkqK8QJKWQG4UegCg84x+
 KwcuyxtFp7/x3/vScFTkP3I=
 =/vFy
 -END PGP SIGNATURE-


 --
 Fergie, a.k.a. Paul Ferguson
  Engineering Architecture for the Internet
  fergdawgster(at)gmail.com
  ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Sep 24, 2008 at 12:12 AM, Russell Mitchell [EMAIL PROTECTED]
wrote:


 I hope soon, people will realise and accept the truth that we are a
 LEGITIMATE Company that DOES Operate in the USA. We are NOT directly or
 in-directly related to any Russian's. We do NOT support, write, directly
 distribute, or knowingly allow the distribution of malware or other
 abusive activities to originate from our network. While the previous
 statements are questionable in the public's eye, I hope some time, you
 will understand it IS the truth.

 Prove me wrong, PLEASE.

AS27595, and all prefixes which you advertise, will be ultra-scrutinized.

You can be sure that you, and many others, will know if  when criminal
activity re-appears inside prefixes hosted by Atrivo/Intercage.

The gloves are off, so to speak.

Cheers,

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2epPq1pz9mNUZTMRAumJAKD5lujVV7CTeZ6iQDEjsELHy7+I1wCfeXFH
TxVWvBONxa+jozHf9hq+k2c=
=L/4x
-END PGP SIGNATURE-



-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Paul,

GREAT! I am very pleased with that.
This is what we need, and I'm sure you can agree, this is what the Internet 
needs.

Thank you very much for your time. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Paul Ferguson [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: nanog@nanog.org
Sent: Wednesday, September 24, 2008 12:20:59 AM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Sep 24, 2008 at 12:12 AM, Russell Mitchell [EMAIL PROTECTED]
wrote:


 I hope soon, people will realise and accept the truth that we are a
 LEGITIMATE Company that DOES Operate in the USA. We are NOT directly or
 in-directly related to any Russian's. We do NOT support, write, directly
 distribute, or knowingly allow the distribution of malware or other
 abusive activities to originate from our network. While the previous
 statements are questionable in the public's eye, I hope some time, you
 will understand it IS the truth.

 Prove me wrong, PLEASE.

AS27595, and all prefixes which you advertise, will be ultra-scrutinized.

You can be sure that you, and many others, will know if  when criminal
activity re-appears inside prefixes hosted by Atrivo/Intercage.

The gloves are off, so to speak.

Cheers,

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2epPq1pz9mNUZTMRAumJAKD5lujVV7CTeZ6iQDEjsELHy7+I1wCfeXFH
TxVWvBONxa+jozHf9hq+k2c=
=L/4x
-END PGP SIGNATURE-



-- 
Fergie, a.k.a. Paul Ferguson
Engineering Architecture for the Internet
fergdawgster(at)gmail.com
ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Mark Foo

Russell:

Ferg was just being coy -- what you don't understand is there are about 3 other
security mailing lists plotting to TAKE YOUR SERVICE DOWN. You FAIL. Law
Enforcement might not take action against you (but appear to be interested now),
but the community can. GET OFF THE NET WITH YOUR MALWARE!

You mistake me for someone who believes you pack of lies! Don't you
understand each
time you post to this list gives those of us who know the opportunity
to post MORE EVIDENCE
of your MALWARE?

You disconnected Hostfresh and think that's the extent of your cimes?
Gimme a break.
Only those who are easily socially engineered would believe your
pathetic claims of innocence.
You've BEEN HOSTING MALWARE since 2003 -- SEE Nanog post:

Re: The in-your-face hijacking example
http://www.irbs.net/internet/nanog/0305/0038.html

Let me know if there's anything else you'd like me to state to the public.

Answer Ferg's question -- Why are you moving to CERNAL? Do you think this
is going to work? That's just another of Emil's networks.

We're on a rocky road right now. But it IS starting to smooth out.

That's just the calm before the storm.

Go ahead and post a response to each of these allegations:

Cybercrime's US Hosts
http://www.spamhaus.org/news.lasso?article=636

Report Slams U.S. Host as Major Source of Badware
http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_as_major.html?nav=rss_blog

A Superlative Scam and Spam Site Registrar
http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html?nav=rss_blog

ICANN cast as online scam enabler
http://www.theregister.co.uk/2008/09/03/cyber_crime_reports/

'Malware-friendly' Intercage back with the living
http://www.theregister.co.uk/2008/09/24/intercage_back_online/

On Tue, Sep 23, 2008 at 11:50 PM, Russell Mitchell [EMAIL PROTECTED] wrote:

Hello John Doe,

I welcome any further comments you have.
We have to get past people such as yourself, and your blasphemous and false
statements.

This is the same issue with the recent media and self-proclaimed Security
Researchers. Fly-by-night mind you.

To help you out in your claims:
Yes, we did house a client whom had quite a run with their client's from
various locations, such as Russia.
That Client is no longer hosted on our network. I myself spent all of monday
afternoon, night, and tuesday morning shutting off EVERY machine they had
leased in our Billing System. I'm currently working to scan further and see
if there's anything I may have missed.

Yes, Russia is very well known for Virus and Malware writer's.

Yes, we have had issues with malware distribution from our network.
This was directly and near singularly related to the former client of ours.
We did have another client, Hostfresh, whom had their share of malware issues.

Both have been completely and effectively removed. The server's leased to
both of them have been canceled, and their machines have been shutoff.

Let me know if there's anything else you'd like me to state to the public.
We're on a rocky road right now. But it IS starting to smooth out.

Thank you for your time. Have a great day.
---
Russell Mitchell

InterCage, Inc.

- Original Message
From: Mark Foo [EMAIL PROTECTED]
To: Bruce Williams [EMAIL PROTECTED]
Cc: Christopher Morrow [EMAIL PROTECTED]; nanog@nanog.org; Joe Greco
[EMAIL PROTECTED]
Sent: Tuesday, September 23, 2008 11:08:21 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

NANOG:

Look, the people posting here who are trashing Intercage are pure security
analysts -- they
know and understand the evil that is Intercage. STOP TRYING TO ASSIST
INTERCAGE
-- you are effectively aiding and abetting the enemy.

Intercage/Atrivo hosts the malware cc botnets that DDoS your systems and
networks.

Intercage/Atrivo hosts the spyware that compromises your users' passwords.

Intercage/Atrivo hosts the adware that slows your customers' machines.

Don't take my word for it, DO YOUR OWN RESEARCH:
http://www.google.com/search?hl=enq=intercage+malware

You don't get called the ***American RBN*** for hosting a couple bad
machines. They
have and will continue to host much of the malware pumped out of America.
THEY
ARE NOT YOUR COMRADES..

These people represent the most HIGHLY ORGANZIED CRIME you will ever
come across. Most people were afraid to speak out against them until this
recent ground swell.

This is the MALWARE CARTEL. GET THE PICTURE?

Many links have been posted here that prove this already -- instead of
asking
what customers they cut off, let them show WHAT CUSTOMERS ARE LEGIT--
because there are NONE.

I would suggest a different Step 1. Instead of killing power, simply
isolate the affected machine. This might be as simple as putting up a
firewall rule or two, if it is simply sending outgoing SMTP spam, or
it's probably easiest (depending on the network gear of course) to
just put the lan port

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Sep 24, 2008 at 12:27 AM, Mark Foo [EMAIL PROTECTED] wrote:

 Answer Ferg's question -- Why are you moving to CERNAL? Do you think this
 is going to work? That's just another of Emil's networks.


Actually, I was not being coy.

Okay, maybe I was.

With regards to the prefix shuffle to Cernel, I think that speaks for
itself.

With regards to ...another of Emil's networks..., I don't believe that to
be true. In fact, I think Emil is just a pawn in this entire mess.

It is clear to me -- at least -- that this entire criminal operation is
being operated out of Eastern Europe, and their foothold in the U.S. is the
major issue here.

This is the major heartburn -- ISPs and network operators in the U.S. seem
not to care about these issues, and  it becomes an 'unpopular' effort to
purge these activities in this audience.

$.02,

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2e5Wq1pz9mNUZTMRAsf6AJ47BKaCBckIkllV2XN/CJhvIGUqowCgrOSQ
kBmKYLTVEipzNwXGxIZa6Zo=
=zs8t
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Mark,

It really seems YOU _DID_ miss the memo.
I think that since no one else is responding to your non-sense, there is no 
reason for me to either.

If you have something accurate to say, I'll be happy to listen.
Until then, there's not much I can say. There's no sense in repeating myself.
 ---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Mark Foo [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow [EMAIL PROTECTED]; 
nanog@nanog.org; Joe Greco [EMAIL PROTECTED]
Sent: Wednesday, September 24, 2008 12:27:50 AM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Russell:

Ferg was just being coy -- what you don't understand is there are about 3 other
security mailing lists plotting to TAKE YOUR SERVICE DOWN. You FAIL. Law
Enforcement might not take action against you (but appear to be interested now),
but the community can. GET OFF THE NET WITH YOUR MALWARE!

You mistake me for someone who believes you pack of lies! Don't you
understand each
time you post to this list gives those of us who know the opportunity
to post MORE EVIDENCE
of your MALWARE?

You disconnected Hostfresh and think that's the extent of your cimes?
Gimme a break.
Only those who are easily socially engineered would believe your
pathetic claims of innocence.
You've BEEN HOSTING MALWARE since 2003 -- SEE Nanog post:

Re: The in-your-face hijacking example
http://www.irbs.net/internet/nanog/0305/0038.html

 Let me know if there's anything else you'd like me to state to the public.

Answer Ferg's question -- Why are you moving to CERNAL? Do you think this
is going to work? That's just another of Emil's networks.

 We're on a rocky road right now. But it IS starting to smooth out.

That's just the calm before the storm.

Go ahead and post a response to each of these allegations:

Cybercrime's US Hosts
http://www.spamhaus.org/news.lasso?article=636

Report Slams U.S. Host as Major Source of Badware
http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_as_major.html?nav=rss_blog

A Superlative Scam and Spam Site Registrar
http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html?nav=rss_blog

ICANN cast as online scam enabler
http://www.theregister.co.uk/2008/09/03/cyber_crime_reports/

'Malware-friendly' Intercage back with the living
http://www.theregister.co.uk/2008/09/24/intercage_back_online/








On Tue, Sep 23, 2008 at 11:50 PM, Russell Mitchell [EMAIL PROTECTED] wrote:

 Hello John Doe,

 I welcome any further comments you have.
 We have to get past people such as yourself, and your blasphemous and false 
 statements.

 This is the same issue with the recent media and self-proclaimed Security 
 Researchers. Fly-by-night mind you.

 To help you out in your claims:
 Yes, we did house a client whom had quite a run with their client's from 
 various locations, such as Russia.
 That Client is no longer hosted on our network. I myself spent all of monday 
 afternoon, night, and tuesday morning shutting off EVERY machine they had 
 leased in our Billing System. I'm currently working to scan further and see 
 if there's anything I may have missed.

 Yes, Russia is very well known for Virus and Malware writer's.

 Yes, we have had issues with malware distribution from our network.
 This was directly and near singularly related to the former client of ours. 
 We did have another client, Hostfresh, whom had their share of malware issues.

 Both have been completely and effectively removed. The server's leased to 
 both of them have been canceled, and their machines have been shutoff.

 Let me know if there's anything else you'd like me to state to the public.
 We're on a rocky road right now. But it IS starting to smooth out.

 Thank you for your time. Have a great day.
  ---
 Russell Mitchell

 InterCage, Inc.



 - Original Message 
 From: Mark Foo [EMAIL PROTECTED]
 To: Bruce Williams [EMAIL PROTECTED]
 Cc: Christopher Morrow [EMAIL PROTECTED]; nanog@nanog.org; Joe Greco 
 [EMAIL PROTECTED]
 Sent: Tuesday, September 23, 2008 11:08:21 PM
 Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 NANOG:

 Look, the people posting here who are trashing Intercage are pure security
 analysts -- they
 know and understand the evil that is Intercage. STOP TRYING TO ASSIST
 INTERCAGE
 -- you are effectively aiding and abetting the enemy.

 Intercage/Atrivo hosts the malware cc botnets that DDoS your systems and
 networks.

 Intercage/Atrivo hosts the spyware that compromises your users' passwords.

 Intercage/Atrivo hosts the adware that slows your customers' machines.

 Don't take my word for it, DO YOUR OWN RESEARCH:
 http://www.google.com/search?hl=enq=intercage+malware

 You don't get called the ***American RBN*** for hosting a couple bad
 machines. They
 have and will continue to host much of the malware pumped out of America.
 THEY
 ARE NOT YOUR COMRADES..

 These people represent the most HIGHLY

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Mark Foo

.
---
Russell Mitchell

InterCage, Inc.

- Original Message
From: Mark Foo [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow [EMAIL
PROTECTED]; nanog@nanog.org; Joe Greco [EMAIL PROTECTED]
Sent: Wednesday, September 24, 2008 12:27:50 AM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Russell:

Ferg was just being coy -- what you don't understand is there are about 3
other
security mailing lists plotting to TAKE YOUR SERVICE DOWN. You FAIL. Law
Enforcement might not take action against you (but appear to be interested
now),
but the community can. GET OFF THE NET WITH YOUR MALWARE!

You mistake me for someone who believes you pack of lies! Don't you
understand each
time you post to this list gives those of us who know the opportunity
to post MORE EVIDENCE
of your MALWARE?

Re: The in-your-face hijacking example
http://www.irbs.net/internet/nanog/0305/0038.html

Let me know if there's anything else you'd like me to state to the public.

Answer Ferg's question -- Why are you moving to CERNAL? Do you think this
is going to work? That's just another of Emil's networks.

We're on a rocky road right now. But it IS starting to smooth out.

That's just the calm before the storm.

Go ahead and post a response to each of these allegations:

Cybercrime's US Hosts
http://www.spamhaus.org/news.lasso?article=636

Report Slams U.S. Host as Major Source of Badware
http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_as_major.html?nav=rss_blog

A Superlative Scam and Spam Site Registrar
http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html?nav=rss_blog

ICANN cast as online scam enabler
http://www.theregister.co.uk/2008/09/03/cyber_crime_reports/

'Malware-friendly' Intercage back with the living
http://www.theregister.co.uk/2008/09/24/intercage_back_online/

On Tue, Sep 23, 2008 at 11:50 PM, Russell Mitchell [EMAIL PROTECTED] wrote:

Hello John Doe,

I welcome any further comments you have.
We have to get past people such as yourself, and your blasphemous and false
statements.

This is the same issue with the recent media and self-proclaimed Security
Researchers. Fly-by-night mind you.

Yes, Russia is very well known for Virus and Malware writer's.

Both have been completely and effectively removed. The server's leased to
both of them have been canceled, and their machines have been shutoff.

Let me know if there's anything else you'd like me to state to the public.
We're on a rocky road right now. But it IS starting to smooth out.

Thank you for your time. Have a great day.
---
Russell Mitchell

InterCage, Inc.

NANOG:

Intercage/Atrivo hosts the malware cc botnets that DDoS your systems and
networks.

Intercage/Atrivo hosts the spyware that compromises your users' passwords.

Intercage/Atrivo hosts the adware that slows your customers' machines.

Don't take my word for it, DO YOUR OWN RESEARCH:
http://www.google.com/search?hl=enq=intercage+malware

You don't get called the ***American RBN*** for hosting a couple bad
machines. They
have and will continue to host much of the malware pumped out of America.
THEY
ARE NOT YOUR COMRADES..

These people represent the most HIGHLY ORGANZIED CRIME you will ever
come across. Most people were afraid to speak out against them until this
recent ground swell.

This is the MALWARE CARTEL. GET THE PICTURE?

Many links have been posted here that prove this already -- instead of
asking
what

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Paul Wall

Russell,

Thanks to the efforts of the people on this list, you've known
Estdomains/Esthost was bad news for several weeks or more.

Why are you only now shutting them down?

Thank you for proving that our research was not for naught, and that
Atrivo/Intercage is a black hat operation which needs to be
permanently disconnected from the Internet at all costs.

Drive Slow,
Paul Wall

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Mark,

What's YOUR motivation to consistantly attack my company?

What's my motivation to continue working @ InterCage?
To keep a roof over my family's heads, and to keep them well-fed:
1.) Myself
2.) My Wife
3.) My near 2 year old Son (November)
4.) My near 3 week old Daughter (Born Sept. 4th)

It's great that you finally accepted the claim of InterCage being associated 
with the famed RBN as being alledged.
You've taken the first step into seeing how much BS information has been spread 
out about our company.

Whether you support me in my anti-abuse endeavor or not, as long as you get 
FACTUAL information, I'm happy.
However someday, I trust you will find and accept the truth about InterCage. 
From what I see now from the claims your making, that day may not come soon.

Thank you for your time. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.

- Original Message 
From: Mark Foo [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow [EMAIL PROTECTED]; 
nanog@nanog.org; Joe Greco [EMAIL PROTECTED]
Sent: Wednesday, September 24, 2008 1:14:01 AM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Russell:

Oh I got the memo, you'll be getting served one soon too.

I just wonder why you don't consider playing both sides of the fence
-- with your
knowledge of who's who in the cyber crime field, you could probably get paid
more as an informant (either to LEO or one of the Intel companies than
whatever you're doing for Emil and (allegedly) the  RBN. You can't possible
sleep well knowing what your up to now so I figure it's the money that
motivates you.

Or, maybe you don't really know anyone, you just respond to their demands and
they end up with all the money, pr0n chicks, etc. Doesn't that bother
you -- don't
you want more?

Plus, no one would know you were pulling two pay checks -- you manage systems
on one side and pass info to the other. It's actually fairly simple --
maybe you already
know this ;).

If not, please explain this:

http://www.spamhaus.org/news.lasso?article=636

Without exception, all of the major security organizations on the
Internet agree that the 'Home' of cybercrime in the western world is a
firm known as Atrivo/Intercage, based in California. We ourselves have
not come to this conclusion lightly but from many years of dealing
with criminal operations hosted by Atrivo/Intercage, gangs of
cybercriminals - mostly Russian and East European but with several US
online crime gangs as well - whose activities always lead back to
servers run by Atrivo/Intercage. We have lost count of the times we
have tracked a major virus botnet's command and control to
Atrivo/Intercage servers, readers can view here some of the current
and historic SBL records for Atrivo for a taste of what has been
happening in this network. At almost every Internet security
conference, or law enforcement seminar on cyber-crime, a presentation
will detail some attack, exploit, phish or financial crime that has
some nexus at Atrivo/Intercage.

The person who runs Atrivo/Intercage, Emil Kacperski is an expert at
playing the surprised janitor, unaware of every new criminal
enterprise found on his servers and keen to show he gets rid of some
criminals once their activities on his network are exposed. His
Internet hosting career first came to the attention of most anti-abuse
organizations when he pinched (or 'purchased stolen goods' as he put
it) and routed an unused block of 65,536 IP addresses belonging to the
County of Los Angeles.

Spamhaus has dealt with over 350 incidents of cyber-crime hosting on
Atrivo/Intercage and its related networks in the last 3 years alone,
all of which involved criminal operations such as malware, virus
spreaders and botnet command and control servers. Malware found by
Spamhaus on Atrivo/Intercage/Cernel/Hostfresh just in the last few
months included the Storm Worm installer and controller and a MySpace
spambot amongst others. Spamhaus currently sees a large amount of
activity related to malicious software and exploits being hosted on
Atrivo/Intercage which include DNS hijack malware, IFRAME browser
attacks, dialers, pirated software websites and blatantly criminal
services.

We assume that every law enforcement agency with a cyber-crimes
division has a dossier bursting at the seams on Atrivo/Intercage and
its tentacles such as Esthost, Estdomains, Cernel, Hostfresh. The only
question on everyone's mind is which agency will beat the others to
shutting the whole place down and indicting the people behind it.
Because if shut down, one thing is certain: the amount of
malware-driven crime on the Internet would drop overnight as
cyber-criminals rush to find a new crime-friendly host - difficult to
find in the US, as Atrivo/Intercage is one of the very few remaining
dedicated crime hosting firms whose customer base is composed almost,
or perhaps entirely, of criminal gangs. More importantly, millions of
Internet users

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Raymond Dijkxhoorn


Hi!


Thanks to the efforts of the people on this list, you've known
Estdomains/Esthost was bad news for several weeks or more.


[EMAIL PROTECTED] ~]# dig estdomains.com

;  DiG 9.5.0-P2  estdomains.com
;; global options:  printcmd
;; Got answer:
;; -HEADER- opcode: QUERY, status: NOERROR, id: 2970
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;estdomains.com.IN  A

;; ANSWER SECTION:
estdomains.com. 86400   IN  A   94.102.49.3

inetnum:94.102.48.0 - 94.102.63.255
netname:NL-ECATEL-20080829
descr:  Ecatel LTD
country:NL
org:ORG-EL38-RIPE
admin-c:RvE16-RIPE
tech-c: RvE16-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower:  ECATEL-MNT
mnt-routes: ECATEL-MNT
source: RIPE # Filtered

person: Reinier van Eeden
address:Archangelkade 1-3
address:1013 BE  Amsterdam
mnt-by: IQARUS-MNT
e-mail: [EMAIL PROTECTED]
phone:  +31 64 607 11 12
nic-hdl:RvE16-RIPE
source: RIPE # Filtered

The same guys were hosting several ROKSO spammers in 2006 allready. This 
smells badly!


Earlier this year they had also this one (also ROKSO)

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL65783

The company that Reinier was with was called Icarus earlier, does that 
ring a bell? 3 of the top 10 ROKSO spammers were hosted there. This is 
more then just a normal shining.


bye,
Raymond.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Pedram M

define:nanog

North American Network Operators Group A membership organization that
provides for the exchange of tecnical information among public, commercial
...

I think this conversation should have ended way long time ago.

My $0.50 cents + $1.00 or $2

Regards,
Pedram

On Wed, Sep 24, 2008 at 1:29 AM, Russell Mitchell [EMAIL PROTECTED]wrote:

 Hello Mark,

 What's YOUR motivation to consistantly attack my company?

 What's my motivation to continue working @ InterCage?
 To keep a roof over my family's heads, and to keep them well-fed:
 1.) Myself
 2.) My Wife
 3.) My near 2 year old Son (November)
 4.) My near 3 week old Daughter (Born Sept. 4th)

 It's great that you finally accepted the claim of InterCage being
 associated with the famed RBN as being alledged.
 You've taken the first step into seeing how much BS information has been
 spread out about our company.

 Whether you support me in my anti-abuse endeavor or not, as long as you get
 FACTUAL information, I'm happy.
 However someday, I trust you will find and accept the truth about
 InterCage. From what I see now from the claims your making, that day may not
 come soon.

 Thank you for your time. Have a great day.
  ---
 Russell Mitchell

 InterCage, Inc.

 - Original Message 
 From: Mark Foo [EMAIL PROTECTED]
 To: Russell Mitchell [EMAIL PROTECTED]
 Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow 
 [EMAIL PROTECTED]; nanog@nanog.org; Joe Greco 
 [EMAIL PROTECTED]
 Sent: Wednesday, September 24, 2008 1:14:01 AM
 Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 Russell:

 Oh I got the memo, you'll be getting served one soon too.

 I just wonder why you don't consider playing both sides of the fence
 -- with your
 knowledge of who's who in the cyber crime field, you could probably get
 paid
 more as an informant (either to LEO or one of the Intel companies than
 whatever you're doing for Emil and (allegedly) the  RBN. You can't possible
 sleep well knowing what your up to now so I figure it's the money that
 motivates you.

 Or, maybe you don't really know anyone, you just respond to their demands
 and
 they end up with all the money, pr0n chicks, etc. Doesn't that bother
 you -- don't
 you want more?

 Plus, no one would know you were pulling two pay checks -- you manage
 systems
 on one side and pass info to the other. It's actually fairly simple --
 maybe you already
 know this ;).

 If not, please explain this:

 http://www.spamhaus.org/news.lasso?article=636

 Without exception, all of the major security organizations on the
 Internet agree that the 'Home' of cybercrime in the western world is a
 firm known as Atrivo/Intercage, based in California. We ourselves have
 not come to this conclusion lightly but from many years of dealing
 with criminal operations hosted by Atrivo/Intercage, gangs of
 cybercriminals - mostly Russian and East European but with several US
 online crime gangs as well - whose activities always lead back to
 servers run by Atrivo/Intercage. We have lost count of the times we
 have tracked a major virus botnet's command and control to
 Atrivo/Intercage servers, readers can view here some of the current
 and historic SBL records for Atrivo for a taste of what has been
 happening in this network. At almost every Internet security
 conference, or law enforcement seminar on cyber-crime, a presentation
 will detail some attack, exploit, phish or financial crime that has
 some nexus at Atrivo/Intercage.

 The person who runs Atrivo/Intercage, Emil Kacperski is an expert at
 playing the surprised janitor, unaware of every new criminal
 enterprise found on his servers and keen to show he gets rid of some
 criminals once their activities on his network are exposed. His
 Internet hosting career first came to the attention of most anti-abuse
 organizations when he pinched (or 'purchased stolen goods' as he put
 it) and routed an unused block of 65,536 IP addresses belonging to the
 County of Los Angeles.

 Spamhaus has dealt with over 350 incidents of cyber-crime hosting on
 Atrivo/Intercage and its related networks in the last 3 years alone,
 all of which involved criminal operations such as malware, virus
 spreaders and botnet command and control servers. Malware found by
 Spamhaus on Atrivo/Intercage/Cernel/Hostfresh just in the last few
 months included the Storm Worm installer and controller and a MySpace
 spambot amongst others. Spamhaus currently sees a large amount of
 activity related to malicious software and exploits being hosted on
 Atrivo/Intercage which include DNS hijack malware, IFRAME browser
 attacks, dialers, pirated software websites and blatantly criminal
 services.

 We assume that every law enforcement agency with a cyber-crimes
 division has a dossier bursting at the seams on Atrivo/Intercage and
 its tentacles such as Esthost, Estdomains, Cernel, Hostfresh. The only
 question on everyone's mind is which agency will beat the others to
 shutting the whole place down

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Pedram M

It's actually starting to look like WHT.

On Wed, Sep 24, 2008 at 1:35 AM, Pedram M [EMAIL PROTECTED] wrote:


 define:nanog

 North American Network Operators Group A membership organization that
 provides for the exchange of tecnical information among public, commercial
 ...

 I think this conversation should have ended way long time ago.

 My $0.50 cents + $1.00 or $2

 Regards,
 Pedram


 On Wed, Sep 24, 2008 at 1:29 AM, Russell Mitchell [EMAIL PROTECTED]wrote:

 Hello Mark,

 What's YOUR motivation to consistantly attack my company?

 What's my motivation to continue working @ InterCage?
 To keep a roof over my family's heads, and to keep them well-fed:
 1.) Myself
 2.) My Wife
 3.) My near 2 year old Son (November)
 4.) My near 3 week old Daughter (Born Sept. 4th)

 It's great that you finally accepted the claim of InterCage being
 associated with the famed RBN as being alledged.
 You've taken the first step into seeing how much BS information has been
 spread out about our company.

 Whether you support me in my anti-abuse endeavor or not, as long as you
 get FACTUAL information, I'm happy.
 However someday, I trust you will find and accept the truth about
 InterCage. From what I see now from the claims your making, that day may not
 come soon.

 Thank you for your time. Have a great day.
  ---
 Russell Mitchell

 InterCage, Inc.

 - Original Message 
 From: Mark Foo [EMAIL PROTECTED]
 To: Russell Mitchell [EMAIL PROTECTED]
 Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow 
 [EMAIL PROTECTED]; nanog@nanog.org; Joe Greco 
 [EMAIL PROTECTED]
 Sent: Wednesday, September 24, 2008 1:14:01 AM
 Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 Russell:

 Oh I got the memo, you'll be getting served one soon too.

 I just wonder why you don't consider playing both sides of the fence
 -- with your
 knowledge of who's who in the cyber crime field, you could probably get
 paid
 more as an informant (either to LEO or one of the Intel companies than
 whatever you're doing for Emil and (allegedly) the  RBN. You can't
 possible
 sleep well knowing what your up to now so I figure it's the money that
 motivates you.

 Or, maybe you don't really know anyone, you just respond to their demands
 and
 they end up with all the money, pr0n chicks, etc. Doesn't that bother
 you -- don't
 you want more?

 Plus, no one would know you were pulling two pay checks -- you manage
 systems
 on one side and pass info to the other. It's actually fairly simple --
 maybe you already
 know this ;).

 If not, please explain this:

 http://www.spamhaus.org/news.lasso?article=636

 Without exception, all of the major security organizations on the
 Internet agree that the 'Home' of cybercrime in the western world is a
 firm known as Atrivo/Intercage, based in California. We ourselves have
 not come to this conclusion lightly but from many years of dealing
 with criminal operations hosted by Atrivo/Intercage, gangs of
 cybercriminals - mostly Russian and East European but with several US
 online crime gangs as well - whose activities always lead back to
 servers run by Atrivo/Intercage. We have lost count of the times we
 have tracked a major virus botnet's command and control to
 Atrivo/Intercage servers, readers can view here some of the current
 and historic SBL records for Atrivo for a taste of what has been
 happening in this network. At almost every Internet security
 conference, or law enforcement seminar on cyber-crime, a presentation
 will detail some attack, exploit, phish or financial crime that has
 some nexus at Atrivo/Intercage.

 The person who runs Atrivo/Intercage, Emil Kacperski is an expert at
 playing the surprised janitor, unaware of every new criminal
 enterprise found on his servers and keen to show he gets rid of some
 criminals once their activities on his network are exposed. His
 Internet hosting career first came to the attention of most anti-abuse
 organizations when he pinched (or 'purchased stolen goods' as he put
 it) and routed an unused block of 65,536 IP addresses belonging to the
 County of Los Angeles.

 Spamhaus has dealt with over 350 incidents of cyber-crime hosting on
 Atrivo/Intercage and its related networks in the last 3 years alone,
 all of which involved criminal operations such as malware, virus
 spreaders and botnet command and control servers. Malware found by
 Spamhaus on Atrivo/Intercage/Cernel/Hostfresh just in the last few
 months included the Storm Worm installer and controller and a MySpace
 spambot amongst others. Spamhaus currently sees a large amount of
 activity related to malicious software and exploits being hosted on
 Atrivo/Intercage which include DNS hijack malware, IFRAME browser
 attacks, dialers, pirated software websites and blatantly criminal
 services.

 We assume that every law enforcement agency with a cyber-crimes
 division has a dossier bursting at the seams on Atrivo/Intercage and
 its tentacles such as Esthost, Estdomains, Cernel, Hostfresh

RE: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread michael.dillon

 It is clear to me -- at least -- that this entire criminal 
 operation is being operated out of Eastern Europe, and their 
 foothold in the U.S. is the major issue here.

If you believe that this is a criminal operation then you
should keep this discussion OFF THE LIST and discourage
anyone from taking any action against the bad guys that
might disrupt evidence gathering. If this is a criminal
matter, then it is best to keep quiet, collect good evidence,
and go to court. Better to get a court injunction ordering
them to stop sending malware, and then collect evidence
showing that they violated the injunction. To do this,
they need to have functioning upstream connections to your
network.

NANOG is not the place to discuss these things.

None of this is network operational. The whole discussion
amounts to a shouting match between vigilantes and their
victims. Some of those victims might also be bad guys, but
a shouting match on NANOG does not prove this one way or
the other.

--Michael Dillon

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Michael,

THANK YOU for the Intervention.

If anyone would like to continue the chats, drop me an email, and we can 
continue talks OFF NANOG.

Thank you all very much for your time and careful consideration into the issues 
we're having. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: [EMAIL PROTECTED] [EMAIL PROTECTED]
To: nanog@nanog.org
Sent: Wednesday, September 24, 2008 2:23:01 AM
Subject: RE: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 It is clear to me -- at least -- that this entire criminal 
 operation is being operated out of Eastern Europe, and their 
 foothold in the U.S. is the major issue here.

If you believe that this is a criminal operation then you
should keep this discussion OFF THE LIST and discourage
anyone from taking any action against the bad guys that
might disrupt evidence gathering. If this is a criminal
matter, then it is best to keep quiet, collect good evidence,
and go to court. Better to get a court injunction ordering
them to stop sending malware, and then collect evidence
showing that they violated the injunction. To do this,
they need to have functioning upstream connections to your
network.

NANOG is not the place to discuss these things.

None of this is network operational. The whole discussion
amounts to a shouting match between vigilantes and their
victims. Some of those victims might also be bad guys, but
a shouting match on NANOG does not prove this one way or
the other.

--Michael Dillon

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Gadi Evron


On Wed, 24 Sep 2008, Russell Mitchell wrote:

Hello Mark,

What's YOUR motivation to consistantly attack my company?


I don't know this Mark, but it seems like he is copying your strategy of 
stay up last and you win as you both make little sense.


Gadi.




What's my motivation to continue working @ InterCage?
To keep a roof over my family's heads, and to keep them well-fed:
1.) Myself
2.) My Wife
3.) My near 2 year old Son (November)
4.) My near 3 week old Daughter (Born Sept. 4th)

It's great that you finally accepted the claim of InterCage being associated with the famed 
RBN as being alledged.
You've taken the first step into seeing how much BS information has been spread 
out about our company.

Whether you support me in my anti-abuse endeavor or not, as long as you get 
FACTUAL information, I'm happy.
However someday, I trust you will find and accept the truth about InterCage. 
From what I see now from the claims your making, that day may not come soon.

Thank you for your time. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.

- Original Message 
From: Mark Foo [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: Bruce Williams [EMAIL PROTECTED]; Christopher Morrow [EMAIL PROTECTED]; 
nanog@nanog.org; Joe Greco [EMAIL PROTECTED]
Sent: Wednesday, September 24, 2008 1:14:01 AM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Russell:

Oh I got the memo, you'll be getting served one soon too.

I just wonder why you don't consider playing both sides of the fence
-- with your
knowledge of who's who in the cyber crime field, you could probably get paid
more as an informant (either to LEO or one of the Intel companies than
whatever you're doing for Emil and (allegedly) the  RBN. You can't possible
sleep well knowing what your up to now so I figure it's the money that
motivates you.

Or, maybe you don't really know anyone, you just respond to their demands and
they end up with all the money, pr0n chicks, etc. Doesn't that bother
you -- don't
you want more?

Plus, no one would know you were pulling two pay checks -- you manage systems
on one side and pass info to the other. It's actually fairly simple --
maybe you already
know this ;).

If not, please explain this:

http://www.spamhaus.org/news.lasso?article=636

Without exception, all of the major security organizations on the
Internet agree that the 'Home' of cybercrime in the western world is a
firm known as Atrivo/Intercage, based in California. We ourselves have
not come to this conclusion lightly but from many years of dealing
with criminal operations hosted by Atrivo/Intercage, gangs of
cybercriminals - mostly Russian and East European but with several US
online crime gangs as well - whose activities always lead back to
servers run by Atrivo/Intercage. We have lost count of the times we
have tracked a major virus botnet's command and control to
Atrivo/Intercage servers, readers can view here some of the current
and historic SBL records for Atrivo for a taste of what has been
happening in this network. At almost every Internet security
conference, or law enforcement seminar on cyber-crime, a presentation
will detail some attack, exploit, phish or financial crime that has
some nexus at Atrivo/Intercage.

The person who runs Atrivo/Intercage, Emil Kacperski is an expert at
playing the surprised janitor, unaware of every new criminal
enterprise found on his servers and keen to show he gets rid of some
criminals once their activities on his network are exposed. His
Internet hosting career first came to the attention of most anti-abuse
organizations when he pinched (or 'purchased stolen goods' as he put
it) and routed an unused block of 65,536 IP addresses belonging to the
County of Los Angeles.

Spamhaus has dealt with over 350 incidents of cyber-crime hosting on
Atrivo/Intercage and its related networks in the last 3 years alone,
all of which involved criminal operations such as malware, virus
spreaders and botnet command and control servers. Malware found by
Spamhaus on Atrivo/Intercage/Cernel/Hostfresh just in the last few
months included the Storm Worm installer and controller and a MySpace
spambot amongst others. Spamhaus currently sees a large amount of
activity related to malicious software and exploits being hosted on
Atrivo/Intercage which include DNS hijack malware, IFRAME browser
attacks, dialers, pirated software websites and blatantly criminal
services.

We assume that every law enforcement agency with a cyber-crimes
division has a dossier bursting at the seams on Atrivo/Intercage and
its tentacles such as Esthost, Estdomains, Cernel, Hostfresh. The only
question on everyone's mind is which agency will beat the others to
shutting the whole place down and indicting the people behind it.
Because if shut down, one thing is certain: the amount of
malware-driven crime on the Internet would drop overnight as
cyber-criminals rush to find a new crime-friendly host - difficult to
find in the US, as Atrivo

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Joe Greco

 Hello Joe,
 
 If we can't power down the machine, due to evidence loss. We 
 can't nullroute the IP, as stated, some malware will delete 
 itself or alter itself when Net Access is lost.
 Now we can filter a single port, in the case of spam, phishing, etc?

You can do whatever you need to, of course.  The right thing to do is
not always immediately apparent.  Some time looking at the traffic on
a mirror port (etc) can provide useful clues about how to proceed to
an experienced professional.

Unfortunately, my experience suggests that handling incidents on the
datacenter side is a somewhat different skill set than handling the
sorts of incidents that are commonly found on consumer Internet 
connections.  The relative value of an infected machine approaches
zero, while the value of a controlling system is fairly high, which
implies that more effort may have been put into active defenses, which
in turn implies other things.  The Geek Squad or other Nerds On
Wheels services are probably not going to be able to effectively 
clean off an impacted server, much less determine useful and clever
ways to analyze what is going on, which is where it pays to have someone
with contacts into the security community.

Alas, I believe that all of this basic stuff should be immediately 
obvious and familiar to those in the hosting community, which leads me
to other questions that are more along the lines of what others have
been asking in this thread, and probably not relevant to NANOG.  

In the event that you are what you claim to be, rather than what many
believe you to be based on past history and appearances, you would be
well advised to make some contacts within the security community, and
be prepared to acquire some expensive advice the next time you have
an incident.  You would need more help than you're going to be able to
get on NANOG.

And if you're what many people seem to think, well, tough.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

RE: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread James Thomas

Very well said.

James

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
Sent: Wednesday, September 24, 2008 5:23 AM
To: nanog@nanog.org
Subject: RE: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 It is clear to me -- at least -- that this entire criminal 
 operation is being operated out of Eastern Europe, and their 
 foothold in the U.S. is the major issue here.

If you believe that this is a criminal operation then you
should keep this discussion OFF THE LIST and discourage
anyone from taking any action against the bad guys that
might disrupt evidence gathering. If this is a criminal
matter, then it is best to keep quiet, collect good evidence,
and go to court. Better to get a court injunction ordering
them to stop sending malware, and then collect evidence
showing that they violated the injunction. To do this,
they need to have functioning upstream connections to your
network.

NANOG is not the place to discuss these things.

None of this is network operational. The whole discussion
amounts to a shouting match between vigilantes and their
victims. Some of those victims might also be bad guys, but
a shouting match on NANOG does not prove this one way or
the other.

--Michael Dillon

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Rich Kulawiec

On Wed, Sep 24, 2008 at 04:19:16AM -0400, Paul Wall wrote:
 Thanks to the efforts of the people on this list, you've known
 Estdomains/Esthost was bad news for several weeks or more.
 
 Why are you only now shutting them down?

several weeks?  Try several years.  And do note the rationale
(below) for the refusal to shut them down.

 From [EMAIL PROTECTED] Sun Sep  4 13:58:23 EDT 2005
 Newsgroups: news.admin.net-abuse.blocklisting
 From: [EMAIL PROTECTED]
 Subject: Re: Atrivo/InterCage Abuse
 Approved: NANAB Moderators [EMAIL PROTECTED]
 Injection-Info: f14g2000cwb.googlegroups.com; posting-host=69.107.73.156;
posting-account=2w8xwQ0AAADzda9cIvAir5JUpndTEjLg
 Nntp-Posting-Date: Fri, 2 Sep 2005 17:48:03 + (UTC)
 Nntp-Posting-Host: 69.107.73.156
 X-Http-Useragent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 
 1.1.4322),gzip(gfe),gzip(gfe)
 Organization: http://groups.google.com
 Message-ID: [EMAIL PROTECTED]
 References: [EMAIL PROTECTED]
[EMAIL PROTECTED]
 X-Trace: posting.google.com 1125683283 16154 127.0.0.1 (2 Sep 2005 17:48:03 
 GMT)
 Date: Fri, 2 Sep 2005 19:51:13 GMT
 X-Robomod: STUMP, [EMAIL PROTECTED] (Igor Chudov), C++/Perl/Unix Consulting
 
 Hello fhh,
 
 There is no network of esthost. The network in which Esthost resides
 is our network. Esthost is one of our larger clients, They are very
 successful in the industry of web hosting and domain registration. They
 just recently became an ICANN Accredited Registrar. I won't comment on
 why they're so successful... But for some, that may be obvious.
 
 I believe an investigation by law enforcement is a very corrective
 step... That would definately clean Esthost up.
 
 I can honestly say, there are 2 of our major clients who are very
 successful... and with both of those comes occasional abuse. On one,
 it's the occasional spam via exploit. The other... Esthost... Well... A
 lot worse abuse then just spam.
 
 One of the things I find quite rediculous is people have taken all of
 our business emails from whois etc, and placed them in spam runs. How
 stupid can you get?... Honestly! You have never received a spam email
 that came from our business servers... Our clients (like EVERY other
 companies clients) do get the abuse of spam from their servers. For all
 of our clients (esthost aside)... This is not very often. We can't
 please everyone. We try... But when you have to go through and work
 with a client like esthost who doesn't quite take abuse too
 seriously... and the only other thing you can do is null their client's
 server it's hard to get a correct action taken. The correct
 action on any intentional spammer is to be immediately removed. As well
 as intentional virii distributors. This is seen with iframecash.biz...
 We took reports from P Thompson and demanded their removal... That
 appeared to be resolved... and then they pop up again.
 
 If I had the ability... I would cut Esthost as a client... But, in
 doing so, it causes nearly a quarter if not half of the company's
 monthly revenue to be cut. That is not too good of a move nor
 reasonably possible ;)
 
 People consider Atrivo/InterCage to be some abuse supporting company...
 If only any of you knew what the position would be in a company our
 size.
 
 It's not as easy as you believe it to be ;)
 
 Thank you for your time. Have a great day.
 
 --
 Russell Mitchell - Russ[at]Atrivo.com
 Atrivo Technologies

Re: Atrivo/Intercage

2008-09-24 Thread Andrew D Kirch


Tom Sparks (Applied Operations) wrote:

Basically is what it boils down to for me - its easy to blame
an NSP/ISP/Hoster for what their clients do, it takes real dedication to
find out whats *actually* going on.
  

We did, and now we're solving the problem.

Andrew

Re: Atrivo/Intercage

2008-09-24 Thread Scott Weeks

--- [EMAIL PROTECTED] wrote:
From: Andrew D Kirch [EMAIL PROTECTED]

 Basically is what it boils down to for me - its 
 easy to blame an NSP/ISP/Hoster for what their 
 clients do, it takes real dedication to find out 
 whats *actually* going on.

: We did, and now we're solving the problem.
--



Apparently, this is what's going on.  Making money at the expense of everyone 
else on the internet:

---
 If I had the ability... I would cut Esthost as a 
 client... But, in doing so, it causes nearly a 
 quarter if not half of the company's monthly 
 revenue to be cut. That is not too good of a move 
 nor reasonably possible ;)
 
 People consider Atrivo/InterCage to be some abuse 
 supporting company...

 If only any of you knew what the position would be 
 in a company our size.
 
 It's not as easy as you believe it to be ;)

 Russell Mitchell - Russ[at]Atrivo.com
 Atrivo Technologies
--


scott

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Paul Wall

On Wed, Sep 24, 2008 at 12:13 AM, Russell Mitchell [EMAIL PROTECTED] wrote:
 Hello Paul,

 Those are their IP Blocks. We were simply routing them, as they were our 
 client.
 They've owned these blocks for quite a while. They seem to have moved that 
 after a day of being down.

You're not very good at this are you? For future reference, when
you're trying to pretend like you've cleaned up your act and someone
asks you why your second largest cyber criminal customer is no longer
on your network, you say we kicked them off for abuse too, not they
left us after a day of being down due to outages caused by our hosting
of an even bigger criminal.

Drive Slow,
Paul Wall

Re: Atrivo/Intercage

2008-09-24 Thread William Pitcock

Hi,

On Wed, 2008-09-24 at 07:06 -0700, Scott Weeks wrote:
 --- [EMAIL PROTECTED] wrote:
 From: Andrew D Kirch [EMAIL PROTECTED]
 
  Basically is what it boils down to for me - its 
  easy to blame an NSP/ISP/Hoster for what their 
  clients do, it takes real dedication to find out 
  whats *actually* going on.
 
 : We did, and now we're solving the problem.
 --
 
 
 
 Apparently, this is what's going on.  Making money at the expense of everyone 
 else on the internet:
 
 ---
  If I had the ability... I would cut Esthost as a 
  client... But, in doing so, it causes nearly a 
  quarter if not half of the company's monthly 
  revenue to be cut. That is not too good of a move 
  nor reasonably possible ;)
  
  People consider Atrivo/InterCage to be some abuse 
  supporting company...
 
  If only any of you knew what the position would be 
  in a company our size.
  
  It's not as easy as you believe it to be ;)
 
  Russell Mitchell - Russ[at]Atrivo.com
  Atrivo Technologies
 --
 
 

Esthost (the main problem) is actually cut off as of this morning. So
actually, they are taking steps to fix the problem.

However, as we all know, there is the real story, and then there is the
NANOG story. We should keep this all in mind, Intercage are actually
trying hard to clean up their network, and now is the time to stop with
the whining and actually help them identify the problems.

Esthost is a tricky situation because it is a significant portion of
their income... but they are offline. I would be reluctant to cut them
off too if I were in their position... not because it's the right thing
to do, but because they are such a large client that I might not be able
to pay the bills at the end of the month. If you were in their position,
wouldn't you have concerns about terminating ANY source of income that
is that large too?

That said, they should have dropped Esthost before it got that big, but
they didn't. People make bad choices, but for fucks sake, lets move on
already.

I have also noticed that most of the people doing the whining aren't
even the people who are tracking the problem. Again, a case of the NANOG
story verses the real story...

William

Re: Atrivo/Intercage

2008-09-24 Thread William Pitcock

Hi,

On Wed, 2008-09-24 at 17:54 -0700, Scott Weeks wrote:
 
 --- [EMAIL PROTECTED] wrote:
 I have also noticed that most of the people doing the whining aren't
 even the people who are tracking the problem. Again, a case of the NANOG
 story verses the real story...
 --
 
 
 
 I didn't whine.

No, but others have, and it isn't helpful towards resolving this
problem.

Ultimately, neither is forcing them off the internet. Well, in
actuality, that resolves part of the problem, but I suspect that a lot
of the affected cybercrime has moved to other networks by now... so in
reality the real problem isn't solved (except that the problem is mostly
being moved away from Intercage). And shutting down ISPs who host these
guys will solve nothing either. They will jump providers until the end
of time.

The solution here is to go after the *people* who make this crap. They
*are* breaking the law and we have the proof.

William

Re: Atrivo/Intercage

2008-09-24 Thread Christopher Morrow

On Wed, Sep 24, 2008 at 9:50 PM, William Pitcock
[EMAIL PROTECTED] wrote:

 The solution here is to go after the *people* who make this crap. They
 *are* breaking the law and we have the proof.

agreed... but keep in mind 'breaking the law' is relative... So, CP is
illegal in the US, but maybe not where it was made (CP's not the best
example of course because it lives in a wierd place in everyone's
laws)... how about simple hacking? that's illegal in the US (mostly,
depending on what's being done) but not in other places, and perhaps
not if committed outside the local jurisdiction(s).

-Chris

Re: Atrivo/Intercage

2008-09-24 Thread Gadi Evron


On Wed, 24 Sep 2008, William Pitcock wrote:

No, but others have, and it isn't helpful towards resolving this
problem.

Ultimately, neither is forcing them off the internet. Well, in
actuality, that resolves part of the problem, but I suspect that a lot
of the affected cybercrime has moved to other networks by now... so in
reality the real problem isn't solved (except that the problem is mostly
being moved away from Intercage). And shutting down ISPs who host these
guys will solve nothing either. They will jump providers until the end
of time.


The fear is evolution in technological advancement they may make rather 
than just where they will scatter to, but that is a solid point. Still, we 
have seen in the past that they evolve regardless. The future will tell 
whether this was a foolishness, or a step in the right directions.



The solution here is to go after the *people* who make this crap. They
*are* breaking the law and we have the proof.


I couldn't agree more. Unfortunately, that isn't happening. Whethr I like 
it or not there are two layers of attackers. The initiator, and the proxy. 
The proxy is on networks, and networks we can reach out to.


Gadi.



William

Re: Atrivo/Intercage

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Wed, Sep 24, 2008 at 7:02 PM, Laurence F. Sheldon, Jr.
[EMAIL PROTECTED] wrote:


 Apprehending criminals is the Law's job.

 My job is making sure they don't deal that sh*t in MY parkinglot.


Exactly.

It could be argued (since _is_ the North American Network Operators Group)
that pushing this sort of criminal activity _out_ of North America is a
good First Step to be able to better manage the situation.

- - ferg

-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2vKTq1pz9mNUZTMRAhK3AJ41SKDLnteNVSqjoNlLDMNutY3sNACgu3O8
EZT2NSbpVvHcd7XRgjBAAQA=
=bmQI
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: Atrivo/Intercage

2008-09-24 Thread Scott Weeks



--- [EMAIL PROTECTED] wrote:
From: William Pitcock [EMAIL PROTECTED]
 
 I didn't whine.

No, but others have, and it isn't helpful towards resolving this
problem.



I also wrote you that in private, but you decided to make it public without 
asking me.  That type of action makes your position less valid.

scott

Re: Atrivo/Intercage

2008-09-24 Thread William Pitcock

Hi,

On Wed, 2008-09-24 at 19:39 -0700, Scott Weeks wrote:
 
 --- [EMAIL PROTECTED] wrote:
 From: William Pitcock [EMAIL PROTECTED]
  
  I didn't whine.
 
 No, but others have, and it isn't helpful towards resolving this
 problem.
 
 
 
 I also wrote you that in private, but you decided to make it public without 
 asking me.  That type of action makes your position less valid.

I apologize, I didn't notice that it was private.

William

Re: Atrivo/Intercage

2008-09-23 Thread Joe Greco

 On Sep 22, 2008, at 4:33 PM, Tom Sparks (Applied Operations) wrote:
  Intercage is not a big shop, there are very few people involved in  
  running it
 
 I have no dog in this fight, but I would comment on the small shop  
 issue as it relates to handling abuse complaints.
 
 I own a small colo/hosting shop too.  We don't have many employees.   
 If we had to deal with so many abuse complaints that things were  
 getting lost in the noise, I'd have to seriously examine my AUP and  
 associated enforcement policies, add staff to handle abuse issues, or  
 both.  Being small isn't an excuse.  In fact, a small shop that runs a  
 clean network should be far better at handling abuse issues than the  
 larger players could ever hope to be.

I would have to agree with this latter bit.  We count incidents per YEAR.
On a hand.  Mostly because we haven't made a habit of accepting random
clients, I guess, but were it a problem, it would be made not to be.

Being proactive is a big part of this.  For example, when ARIN began to
allow abuse contacts for IP space, we fairly quickly registered a POC
for it.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

Re: Atrivo/Intercage

2008-09-23 Thread Gadi Evron


http://www.giantitp.com/comics/oots0595.html

I think that sums up this thread.


On Tue, 23 Sep 2008, Joe Greco wrote:


On Sep 22, 2008, at 4:33 PM, Tom Sparks (Applied Operations) wrote:

Intercage is not a big shop, there are very few people involved in
running it


I have no dog in this fight, but I would comment on the small shop
issue as it relates to handling abuse complaints.

I own a small colo/hosting shop too.  We don't have many employees.
If we had to deal with so many abuse complaints that things were
getting lost in the noise, I'd have to seriously examine my AUP and
associated enforcement policies, add staff to handle abuse issues, or
both.  Being small isn't an excuse.  In fact, a small shop that runs a
clean network should be far better at handling abuse issues than the
larger players could ever hope to be.


I would have to agree with this latter bit.  We count incidents per YEAR.
On a hand.  Mostly because we haven't made a habit of accepting random
clients, I guess, but were it a problem, it would be made not to be.

Being proactive is a big part of this.  For example, when ARIN began to
allow abuse contacts for IP space, we fairly quickly registered a POC
for it.

... JG
--
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-23 Thread Paul Wall

Hold the rejoicing, Atrivo is back, this time on UnitedLayer.

I'd contact them, only they seem to change CTOs every month or two,
does anybody know who's currently in charge?

Thank you, and Drive Slow,
Paul Wall

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Well, their management team is listed here:

http://www.unitedlayer.com/team.html

- - ferg

On Tue, Sep 23, 2008 at 5:46 PM, Paul Wall [EMAIL PROTECTED] wrote:
 Hold the rejoicing, Atrivo is back, this time on UnitedLayer.

 I'd contact them, only they seem to change CTOs every month or two,
 does anybody know who's currently in charge?

 Thank you, and Drive Slow,
 Paul Wall



-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2Y/zq1pz9mNUZTMRAnfWAKClED9vjhHusr2Y6+HJ4Bc9fHAosACeOhfK
8coixrmTH5I3Hlh2phmut5w=
=gzBi
-END PGP SIGNATURE-



-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: Atrivo/Intercage

2008-09-23 Thread Jo Rhett


On Sep 22, 2008, at 1:33 PM, Tom Sparks (Applied Operations) wrote:

I also don't believe Intercage was complicit in any
net-crime; Thats not to say it didn't exist, but more along the lines
of they got lost in the noise of running a business.


Which is not acceptable.  You answer your abuse complaints, you shut  
down your spammers.  Period, end of subject.


--
Jo Rhett
Net Consonance : consonant endings by net philanthropy, open source  
and other randomness

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=0-593512929-125655=:9145

--0-593512929-125655=:9145
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST=
 Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha=
ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som=
e of the public media, such as google, DroneBL, as well as several Anti-Mal=
ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire=
ly GONE, we should not have any further issues.=0AIn the case that somethin=
g=A0does arise, such as an exploited host, we're currently developing a gam=
e plan for=A0response to=A0the issues.=0ATo make the best effort towards co=
mbatting=A0abuse on our network, here's what I have planned so far for ANY =
Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,=
 Call/Email the client whom the affected machine is leased to.=0AStep 3, Al=
low the client=A0the option to=A0investigate the machine further (Nullroute=
 access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o=
r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the =
Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments=
? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.=
 If it's clear that the server owner is the cause of the abusive material e=
tc, the client will then be immediately cancelled. No questions.=A0=0A=0A=
=0AIt seems that this approach will be the best supported by the anti-abuse=
 communities, so please let me know your input.=0A=0AThank you for your tim=
e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A=
=0A=0A- Original Message =0AFrom: Paul Wall [EMAIL PROTECTED]=
=0ATo: Mark Foo [EMAIL PROTECTED]=0ACc: [EMAIL PROTECTED]: Tues=
day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage=
: NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on =
UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon=
th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a=
nd Drive Slow,=0APaul Wall=0A=0A=0A  
--0-593512929-125655=:9145
Content-Type: text/html; charset=us-ascii

htmlheadstyle type=text/css!-- DIV {margin:0px;} 
--/style/headbodydiv style=font-family:times new roman, new york, 
times, serif;font-size:12ptPHello All,/P
Pnbsp;/P
PIt seems you all missed the memo.BRAs of about 11PM PST Last night 
09/22/08, Esthost has been ENTIRELY Shutdown. They no longer have ANY Machine 
on my network./P
Pnbsp;/P
PI'm currently starting to monitor some of the public media, such as google, 
DroneBL, as well as several Anti-Malware community websites for abuse./P
Pnbsp;/P
PBeing that Esthost is now entirely GONE, we should not have any further 
issues./P
PIn the case that somethingnbsp;does arise, such as an exploited host, we're 
currently developing a game plan fornbsp;response tonbsp;the issues./P
PTo make the best effort towards combattingnbsp;abuse on our network, here's 
what I have planned so far for ANY Type of abuse:/P
PStep 1,nbsp;Suspend Power to the affected machine./P
PStep 2, Call/Email the client whom the affected machine is leased to./P
PStep 3, Allow the clientnbsp;the option tonbsp;investigate the machine 
further (Nullroute access via KVM)/P
PStepnbsp;4, Verify thenbsp;reported content, domain, user, or 
exploitnbsp;is patched/eliminated from the machine./P
PStep 5,nbsp;Remove the Nullroute. Allow the machine to return to the 
network./P
Pnbsp;/P
PAny comments? /P
Pnbsp;/P
PThis isnbsp;the result of a zero tolerance policy regarding abuse. If it's 
clear that the server owner is the cause of the abusive material etc, the 
client will then be immediately cancelled. No questions.nbsp;/P
DIV style=FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, 
serif
DIV/DIV
DIVnbsp;/DIV
DIVIt seems that this approach will be the best supported by the anti-abuse 
communities, so please let me know your input./DIV
DIVnbsp;/DIV
DIVThank you for your time. Have a great day.BRnbsp;/DIV---BRRussell 
MitchellBR
DIVInterCage, Inc.BR/DIV
DIV style=FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, 
serifBR
DIV style=FONT-SIZE: 13px; FONT-FAMILY: arial, helvetica, sans-serif- 
Original Message BRFrom: Paul Wall lt;[EMAIL PROTECTED]gt;BRTo: Mark 
Foo lt;[EMAIL PROTECTED]gt;BRCc: nanog@nanog.orgBRSent: Tuesday, 
September 23, 2008 5:46:58 PMBRSubject: Re: YAY! Re: Atrivo/Intercage: NO 
Upstream depeerBRBRHold the rejoicing, Atrivo is back, this time on 
UnitedLayer.BRBRI'd contact them, only they seem to change CTOs every month 
or two,BRdoes anybody know who's currently in charge?BRBRThank you, and 
Drive Slow,BRPaul WallBRBR/DIV/DIV/DIV/divbr

  /body/html
--0-593512929-125655=:9145--

Re: Atrivo/Intercage

2008-09-23 Thread Joe Greco

 On Sep 22, 2008, at 1:33 PM, Tom Sparks (Applied Operations) wrote:
  I also don't believe Intercage was complicit in any
  net-crime; Thats not to say it didn't exist, but more along the lines
  of they got lost in the noise of running a business.
 
 Which is not acceptable.  You answer your abuse complaints, you shut  
 down your spammers.  Period, end of subject.

That's a bit '90's.  I'll settle for s/answer/handle/, because I don't
think that most sites are willing to actually discuss abuse issues with
random folks submitting complaints, and so that leaves you with either
sending a form letter of some sort, or not saying anything.  Further,
many places seem to send form letters but not do anything.  I am not
sure that there is much (or any) value-add in sending a response, unless
further information is needed.

From my point of view, the best response is when the problem simply goes
away.  A personal reply (rather than a form letter) is also generally a
really good sign that someone cares enough to show that they're doing
something, but again that seems to be the exception rather than the
norm.  The Afterburner experience, however, should be an excellent 
example for the difference that simply *showing* you care and are doing
something makes.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-23 Thread Joe Greco

 Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST=
  Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha=
 ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som=
 e of the public media, such as google, DroneBL, as well as several Anti-Mal=
 ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire=
 ly GONE, we should not have any further issues.=0AIn the case that somethin=
 g=A0does arise, such as an exploited host, we're currently developing a gam=
 e plan for=A0response to=A0the issues.=0ATo make the best effort towards co=
 mbatting=A0abuse on our network, here's what I have planned so far for ANY =
 Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,=
  Call/Email the client whom the affected machine is leased to.=0AStep 3, Al=
 low the client=A0the option to=A0investigate the machine further (Nullroute=
  access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o=
 r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the =
 Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments=
 ? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.=
  If it's clear that the server owner is the cause of the abusive material e=
 tc, the client will then be immediately cancelled. No questions.=A0=0A=0A=
 =0AIt seems that this approach will be the best supported by the anti-abuse=
  communities, so please let me know your input.=0A=0AThank you for your tim=
 e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A=
 =0A=0A- Original Message =0AFrom: Paul Wall [EMAIL PROTECTED]=
 =0ATo: Mark Foo [EMAIL PROTECTED]=0ACc: [EMAIL PROTECTED]: Tues=
 day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage=
 : NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on =
 UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon=
 th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a=
 nd Drive Slow,=0APaul Wall=0A=0A=0A  

Speaking of missing memos...  mailing lists are not highly compatible 
with HTML or some clients that like to encode list mail.  The above is 
what your mail looked like to some people.

I would suggest a different Step 1.  Instead of killing power, simply
isolate the affected machine.  This might be as simple as putting up a
firewall rule or two, if it is simply sending outgoing SMTP spam, or
for more complex issues, downing the port facing the machine in question.
Killing the power may destroy useful forensic clues about what happened 
to the system, and may damage the system.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-23 Thread Christopher Morrow

please to not email in html format... yikes! Russ, could you re-mail
whatever content you just sent, in plain text?

On Tue, Sep 23, 2008 at 11:07 PM, Russell Mitchell [EMAIL PROTECTED] wrote:
 MIME-Version: 1.0
 Content-Type: multipart/alternative; boundary=0-593512929-125655=:9145

 --0-593512929-125655=:9145
 Content-Type: text/plain; charset=iso-8859-1
 Content-Transfer-Encoding: quoted-printable

 Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST=
  Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha=
 ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som=
 e of the public media, such as google, DroneBL, as well as several Anti-Mal=
 ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire=
 ly GONE, we should not have any further issues.=0AIn the case that somethin=
 g=A0does arise, such as an exploited host, we're currently developing a gam=
 e plan for=A0response to=A0the issues.=0ATo make the best effort towards co=
 mbatting=A0abuse on our network, here's what I have planned so far for ANY =
 Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,=
  Call/Email the client whom the affected machine is leased to.=0AStep 3, Al=
 low the client=A0the option to=A0investigate the machine further (Nullroute=
  access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o=
 r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the =
 Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments=
 ? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.=
  If it's clear that the server owner is the cause of the abusive material e=
 tc, the client will then be immediately cancelled. No questions.=A0=0A=0A=
 =0AIt seems that this approach will be the best supported by the anti-abuse=
  communities, so please let me know your input.=0A=0AThank you for your tim=
 e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A=
 =0A=0A- Original Message =0AFrom: Paul Wall [EMAIL PROTECTED]=
 =0ATo: Mark Foo [EMAIL PROTECTED]=0ACc: [EMAIL PROTECTED]: Tues=
 day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage=
 : NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on =
 UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon=
 th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a=
 nd Drive Slow,=0APaul Wall=0A=0A=0A
 --0-593512929-125655=:9145
 Content-Type: text/html; charset=us-ascii

 htmlheadstyle type=text/css!-- DIV {margin:0px;} 
 --/style/headbodydiv style=font-family:times new roman, new york, 
 times, serif;font-size:12ptPHello All,/P
 P /P
 PIt seems you all missed the memo.BRAs of about 11PM PST Last night 
 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer have ANY Machine 
 on my network./P
 P /P
 PI'm currently starting to monitor some of the public media, such as 
 google, DroneBL, as well as several Anti-Malware community websites for 
 abuse./P
 P /P
 PBeing that Esthost is now entirely GONE, we should not have any further 
 issues./P
 PIn the case that something does arise, such as an exploited host, we're 
 currently developing a game plan for response to the issues./P
 PTo make the best effort towards combatting abuse on our network, here's 
 what I have planned so far for ANY Type of abuse:/P
 PStep 1, Suspend Power to the affected machine./P
 PStep 2, Call/Email the client whom the affected machine is leased to./P
 PStep 3, Allow the client the option to investigate the machine further 
 (Nullroute access via KVM)/P
 PStep 4, Verify the reported content, domain, user, or exploit is 
 patched/eliminated from the machine./P
 PStep 5, Remove the Nullroute. Allow the machine to return to the 
 network./P
 P /P
 PAny comments? /P
 P /P
 PThis is the result of a zero tolerance policy regarding abuse. If it's 
 clear that the server owner is the cause of the abusive material etc, the 
 client will then be immediately cancelled. No questions. /P
 DIV style=FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, 
 serif
 DIV/DIV
 DIV /DIV
 DIVIt seems that this approach will be the best supported by the anti-abuse 
 communities, so please let me know your input./DIV
 DIV /DIV
 DIVThank you for your time. Have a great day.BR /DIV---BRRussell 
 MitchellBR
 DIVInterCage, Inc.BR/DIV
 DIV style=FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, 
 serifBR
 DIV style=FONT-SIZE: 13px; FONT-FAMILY: arial, helvetica, sans-serif- 
 Original Message BRFrom: Paul Wall [EMAIL PROTECTED]BRTo: Mark Foo 
 [EMAIL PROTECTED]BRCc: nanog@nanog.orgBRSent: Tuesday, September 23, 
 2008 5:46:58 PMBRSubject: Re: YAY! Re: Atrivo/Intercage: NO Upstream 
 depeerBRBRHold the rejoicing, Atrivo is back, this time on 
 UnitedLayer.BRBRI'd contact them, only they seem to change CTOs every 
 month or two

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-23 Thread Christopher Morrow

On Tue, Sep 23, 2008 at 11:20 PM, Joe Greco [EMAIL PROTECTED] wrote:

 I would suggest a different Step 1.  Instead of killing power, simply
 isolate the affected machine.  This might be as simple as putting up a
 firewall rule or two, if it is simply sending outgoing SMTP spam, or

it's probably easiest (depending on the network gear of course) to
just put the lan port into an isolated VLAN. It's not the 100%
solution (some badness rm's itself once it loses connectivity to the
internets) but it'd make things simpler for the client/LEA when they
need to figure out what happened.

-chris

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-23 Thread Bruce Williams

using bolt cutters on cables has a certain satisfaction...

On Tue, Sep 23, 2008 at 8:23 PM, Christopher Morrow
[EMAIL PROTECTED] wrote:
 On Tue, Sep 23, 2008 at 11:20 PM, Joe Greco [EMAIL PROTECTED] wrote:

 I would suggest a different Step 1.  Instead of killing power, simply
 isolate the affected machine.  This might be as simple as putting up a
 firewall rule or two, if it is simply sending outgoing SMTP spam, or

 it's probably easiest (depending on the network gear of course) to
 just put the lan port into an isolated VLAN. It's not the 100%
 solution (some badness rm's itself once it loses connectivity to the
 internets) but it'd make things simpler for the client/LEA when they
 need to figure out what happened.

 -chris

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Apologies, Yahoo was set to Rich Text :(

-

Hello All,

It seems you all missed the memo.As of about 11PM PST
Last night 09/22/08, Esthost has been ENTIRELY Shutdown. 
They no longer have ANY Machine on my network.

I'm currently starting to monitor some of the public media, such as google, 
DroneBL, as well as several Anti-Malware community websites for abuse.
Being that Esthost is now entirely GONE, we should not have any further issues.
In the case that something does arise, such as an exploited host, we're 
currently developing a game plan for response to the issues. 

To make the best effort towards combatting abuse on our network, here's what I 
have planned so far for ANY Type of abuse:
Step 1, Suspend Power to the affected machine.
Step 2, Call/Email the client whom the affected machine is leased to.
Step 3, Allow the client the option to investigate the machine further 
(Nullroute access via KVM)=
Step 4, Verify the reported content, domain, user, or exploit is 
patched/eliminated from the machine.
Step 5, Remove the Nullroute. Allow the machine to return to the network. 

Any comments? This is the result of a zero tolerance policy regarding abuse.

If it's clear that the server owner is the cause of the abusive material etc, 
the client will then be immediately cancelled. No questions. 
It seems that this approach will be the best supported by the anti-abuse 
communities, so please let me know your input.

Thank you for your time. Have a great day.

---
Russell Mitchell
InterCage, Inc.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Hi Russ,

While I think that is great and everything, can you explain why Cernel is
now originating prefixes which were originally originated by
Atrivo/Intercage?

I'd be curious as to your explanation.

Thanks,

- - ferg


On Tue, Sep 23, 2008 at 9:05 PM, Russell Mitchell [EMAIL PROTECTED]
wrote:
 Apologies, Yahoo was set to Rich Text :(

 -

 Hello All,

 It seems you all missed the memo.As of about 11PM PST
 Last night 09/22/08, Esthost has been ENTIRELY Shutdown.
 They no longer have ANY Machine on my network.

 I'm currently starting to monitor some of the public media, such as
 google, DroneBL, as well as several Anti-Malware community websites for
 abuse. Being that Esthost is now entirely GONE, we should not have any
 further issues. In the case that something does arise, such as an
 exploited host, we're currently developing a game plan for response to
 the issues.

 To make the best effort towards combatting abuse on our network, here's
 what I have planned so far for ANY Type of abuse: Step 1, Suspend Power
 to the affected machine.
 Step 2, Call/Email the client whom the affected machine is leased to.
 Step 3, Allow the client the option to investigate the machine further
 (Nullroute access via KVM)= Step 4, Verify the reported content, domain,
 user, or exploit is patched/eliminated from the machine. Step 5, Remove
 the Nullroute. Allow the machine to return to the network.

 Any comments? This is the result of a zero tolerance policy regarding
 abuse.

 If it's clear that the server owner is the cause of the abusive material
 etc, the client will then be immediately cancelled. No questions. It
 seems that this approach will be the best supported by the anti-abuse
 communities, so please let me know your input.

 Thank you for your time. Have a great day.

 ---
 Russell Mitchell
 InterCage, Inc.








-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2cBUq1pz9mNUZTMRAtbAAJwKk/H/9Pz4YelIgnYvtuCCDhmuswCfcrfV
PTUD/SyPo8+zHpACucRPqk4=
=+rwg
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

It may be true that Estdomains has moved a couple of the external-facing a
hosting hosts into the a Netherlands hosting provider in conjunction with
this whole situation -- folks are watching very carefully.

estdomains.com A 94.102.49.3
storefront.estdomains.com A 94.102.49.5
www.estdomains.com A 94.102.49.4
www.estsecure.com A 94.102.49.5

AS  | IP   | AS Name
29073   | 94.102.49.3  | ECATEL-AS AS29073, Ecatel Network

% Information related to '94.102.48.0 - 94.102.63.255'

inetnum: 94.102.48.0 - 94.102.63.255
netname: NL-ECATEL-20080829
descr: Ecatel LTD
country: NL
org: ORG-EL38-RIPE
admin-c: RvE16-RIPE
tech-c: RvE16-RIPE
status: ALLOCATED PA
mnt-by: RIPE-NCC-HM-MNT
mnt-lower: ECATEL-MNT
mnt-routes: ECATEL-MNT
source: RIPE # Filtered

organisation: ORG-EL38-RIPE
org-name: Ecatel LTD
org-type: LIR
address: Ecatel LTD
Reinier van Eeden
P.O.Box 19533
2521 CA The Hague
NETHERLANDS
phone: +31702204015
fax-no: +31702204015
e-mail: [EMAIL PROTECTED]
admin-c: RvE16-RIPE
mnt-ref: ECATEL-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered


DNSLogger:

estdomains.com   A  94.102.49.3
estdomains.com   A  216.255.176.238
estdomains.com   NS ans1.esthost.com
estdomains.com   NS ans2.esthost.com
estdomains.com   NS temp1.estdomains.com
estdomains.com   NS ns1.estdomains.com
estdomains.com   NS temp2.estdomains.com
estdomains.com   NS ns2.estdomains.com

http://www.bfk.de/bfk_dnslogger.html

Thanks,

- - ferg

On Tue, Sep 23, 2008 at 9:05 PM, Russell Mitchell [EMAIL PROTECTED]
wrote:
 Apologies, Yahoo was set to Rich Text :(

 -

 Hello All,

 It seems you all missed the memo.As of about 11PM PST
 Last night 09/22/08, Esthost has been ENTIRELY Shutdown.
 They no longer have ANY Machine on my network.


-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2cVCq1pz9mNUZTMRAtC1AJ9UK326w0H3C8lpB1cxz6EJC6KbqwCgjlwA
3WvkkgfWuVapwt1OKbys4dk=
=B4vI
-END PGP SIGNATURE-

-- 
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawgster(at)gmail.com
 ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Paul,

Those are their IP Blocks. We were simply routing them, as they were our client.
They've owned these blocks for quite a while. They seem to have moved that 
after a day of being down.

I haven't been monitoring their blocks, and made the decision Sunday Night that 
they were no longer going to be allowed on our network.
I believe the blocks your referring to are their 85.255 Blocks? Registered to 
InHoster. I believe those prefixes are an entity of their's, though I don't 
know for sure. Perhaps ask them?
Cernel is their own ASN. It's not associated with our company.

Thank you for your time. Have a great day. 
---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Paul Ferguson [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: nanog@nanog.org
Sent: Tuesday, September 23, 2008 9:22:03 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Hi Russ,

While I think that is great and everything, can you explain why Cernel is
now originating prefixes which were originally originated by
Atrivo/Intercage?

I'd be curious as to your explanation.

Thanks,

- - ferg


On Tue, Sep 23, 2008 at 9:05 PM, Russell Mitchell [EMAIL PROTECTED]
wrote:
 Apologies, Yahoo was set to Rich Text :(

 -

 Hello All,

 It seems you all missed the memo.As of about 11PM PST
 Last night 09/22/08, Esthost has been ENTIRELY Shutdown.
 They no longer have ANY Machine on my network.

 I'm currently starting to monitor some of the public media, such as
 google, DroneBL, as well as several Anti-Malware community websites for
 abuse. Being that Esthost is now entirely GONE, we should not have any
 further issues. In the case that something does arise, such as an
 exploited host, we're currently developing a game plan for response to
 the issues.

 To make the best effort towards combatting abuse on our network, here's
 what I have planned so far for ANY Type of abuse: Step 1, Suspend Power
 to the affected machine.
 Step 2, Call/Email the client whom the affected machine is leased to.
 Step 3, Allow the client the option to investigate the machine further
 (Nullroute access via KVM)= Step 4, Verify the reported content, domain,
 user, or exploit is patched/eliminated from the machine. Step 5, Remove
 the Nullroute. Allow the machine to return to the network.

 Any comments? This is the result of a zero tolerance policy regarding
 abuse.

 If it's clear that the server owner is the cause of the abusive material
 etc, the client will then be immediately cancelled. No questions. It
 seems that this approach will be the best supported by the anti-abuse
 communities, so please let me know your input.

 Thank you for your time. Have a great day.

 ---
 Russell Mitchell
 InterCage, Inc.








-BEGIN PGP SIGNATURE-
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFI2cBUq1pz9mNUZTMRAtbAAJwKk/H/9Pz4YelIgnYvtuCCDhmuswCfcrfV
PTUD/SyPo8+zHpACucRPqk4=
=+rwg
-END PGP SIGNATURE-


-- 
Fergie, a.k.a. Paul Ferguson
Engineering Architecture for the Internet
fergdawgster(at)gmail.com
ferg's tech blog: http://fergdawg.blogspot.com/

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

Hello Joe,

If we can't power down the machine, due to evidence loss. We can't nullroute 
the IP, as stated, some malware will delete itself or alter itself when Net 
Access is lost.
Now we can filter a single port, in the case of spam, phishing, etc?

I'll look further into the JunOS. I'm not too familiar with the rules on the 
Juniper, so I'll take a look further, and see how to achieve this on a single 
IP rather then the network.

Thank you for your time. Have a great day.
 ---
Russell Mitchell

InterCage, Inc.



- Original Message 
From: Joe Greco [EMAIL PROTECTED]
To: Russell Mitchell [EMAIL PROTECTED]
Cc: nanog@nanog.org
Sent: Tuesday, September 23, 2008 8:20:18 PM
Subject: Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

 Hello All,=0A=A0=0AIt seems you all missed the memo.=0AAs of about 11PM PST=
  Last night 09/22/08, Esthost has been ENTIRELY Shutdown. They no longer ha=
 ve ANY Machine on my network.=0A=A0=0AI'm currently starting to monitor som=
 e of the public media, such as google, DroneBL, as well as several Anti-Mal=
 ware community websites for abuse.=0A=A0=0ABeing that Esthost is now entire=
 ly GONE, we should not have any further issues.=0AIn the case that somethin=
 g=A0does arise, such as an exploited host, we're currently developing a gam=
 e plan for=A0response to=A0the issues.=0ATo make the best effort towards co=
 mbatting=A0abuse on our network, here's what I have planned so far for ANY =
 Type of abuse:=0AStep 1,=A0Suspend Power to the affected machine.=0AStep 2,=
  Call/Email the client whom the affected machine is leased to.=0AStep 3, Al=
 low the client=A0the option to=A0investigate the machine further (Nullroute=
  access via KVM)=0AStep=A04, Verify the=A0reported content, domain, user, o=
 r exploit=A0is patched/eliminated from the machine.=0AStep 5,=A0Remove the =
 Nullroute. Allow the machine to return to the network.=0A=A0=0AAny comments=
 ? =0A=A0=0AThis is=A0the result of a zero tolerance policy regarding abuse.=
  If it's clear that the server owner is the cause of the abusive material e=
 tc, the client will then be immediately cancelled. No questions.=A0=0A=0A=
 =0AIt seems that this approach will be the best supported by the anti-abuse=
  communities, so please let me know your input.=0A=0AThank you for your tim=
 e. Have a great day.=0A=A0---=0ARussell Mitchell=0A=0AInterCage, Inc.=0A=0A=
 =0A=0A- Original Message =0AFrom: Paul Wall [EMAIL PROTECTED]=
 =0ATo: Mark Foo [EMAIL PROTECTED]=0ACc: [EMAIL PROTECTED]: Tues=
 day, September 23, 2008 5:46:58 PM=0ASubject: Re: YAY! Re: Atrivo/Intercage=
 : NO Upstream depeer=0A=0AHold the rejoicing, Atrivo is back, this time on =
 UnitedLayer.=0A=0AI'd contact them, only they seem to change CTOs every mon=
 th or two,=0Adoes anybody know who's currently in charge?=0A=0AThank you, a=
 nd Drive Slow,=0APaul Wall=0A=0A=0A      

Speaking of missing memos...  mailing lists are not highly compatible 
with HTML or some clients that like to encode list mail.  The above is 
what your mail looked like to some people.

I would suggest a different Step 1.  Instead of killing power, simply
isolate the affected machine.  This might be as simple as putting up a
firewall rule or two, if it is simply sending outgoing SMTP spam, or
for more complex issues, downing the port facing the machine in question.
Killing the power may destroy useful forensic clues about what happened 
to the system, and may damage the system.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer