Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NANOG: users

New Class C's just lit on on AT&T, Email Marketing

  

 
NANOG users RSS feed   Index | Next | Previous | View Threaded


michael at linuxmagic

Nov 3, 2009, 8:32 AM

Post #1 of 11 (769 views)
Permalink
New Class C's just lit on on AT&T, Email Marketing
A new block under AT&T, listed as being owned by:

The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
99.51.81.255

Just started an email marketing campaign to addresses stripped from the web..

We wouldn't run out of IP's if this didn't keep happening..

So called CAN-SPAM compliant of course..

Return-Path: <618882010 [at] return>
Delivered-To: support [at] linuxmagic
Received: (qmail 25942 invoked from network); 3 Nov 2009 05:26:41 -0000
Received: from unknown (HELO mail23.collegeloanassociates.com) (99.51.80.247)
by thundercracker.cityemail.com with SMTP; Mon, 02 Nov 2009 21:26:41 -0800
DKIM-Signature: v=1; a=rsa-sha1; d=signtabulararrayoffice.com; s=default;
c=simple/simple;
q=dns/txt; i=@signtabulararrayoffice.com; t=1257225979;
h=From;
bh=dua1L4dgTnW3vCenQjnlynXJ0yk=;
b=jxhpH/zBQxVZ5O4+8Yd2Va5Dj3v6Soasndd6moffduE1XIfNz7UzYntYdA6AwGZ1
qLBFmNjyNyTKjdeCc9vDa/ApxFy6LrsPMpsRjbyOjh8Io3951KpzLOPD3BwcYYsf;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
s=default; d=signtabulararrayoffice.com;
h=Received:Date:From:To:Message-id:Mime-Version:Subject:X-Ver:X-
CampaignDetail:X-Edata1:X-Log:Errors-To:List-Unsubscribe:Content-Type;
b=PhZXM6t8AayFvb3UDWPYbhL98WpXfcC/g95pqhVM2gNwjRd6hnTO+w1PB2z2Xv8/
5L7acKRTMWdCNZ8Ql1doxzrZ0QYt5u4bd48rbyQiUmMU69ToMXnvFw5mKxLtX5H+
Received: from 316-99.51.80.247 (316-99.51.80.247-s [192.168.1.75]) by
signtabulararrayoffice.com for support [at] linuxmagic; Tue, 03 Nov 2009
00:26:19 -0500
Date: Tue, 03 Nov 2009 00:26:19 -0500
From: NaughtyDating Alerts <NaughtyDatingAlerts [at] signtabulararrayoffice>

Return-Path: <618882010 [at] return>
Delivered-To: support [at] linuxmagic
Received: (qmail 28563 invoked from network); 3 Nov 2009 05:32:47 -0000
Received: from unknown (HELO mail16.bankanswer.net) (99.51.80.144)
by thundercracker.cityemail.com with SMTP; Mon, 02 Nov 2009 21:32:47 -0800
DKIM-Signature: v=1; a=rsa-sha1; d=initiativesnetwork.com; s=default;
c=simple/simple;
q=dns/txt; i=@initiativesnetwork.com; t=1257226339;
h=From;
bh=ZAz5horGN06rHfgsLW4iBy5nKtY=;
b=1sfpRla+5g4KyKZbji1fiTueDe9pLJKojoqbjic6icN+CehR20mDLLxhi1m58Jjh
4IO10Esc9T1+nDvh3D68nw0bePfCkBKYO6yOThLpGBb95ewtzZ7oFoq3agpS6tYM;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
s=default; d=initiativesnetwork.com;
h=Received:Date:From:To:Message-id:Mime-Version:Subject:X-Ver:X-
CampaignDetail:X-Edata1:X-Log:Errors-To:List-Unsubscribe:Content-Type;
b=VTbPf7DV+qu9jWHRmmpB4U8p9Ug4DMdqkz3c1KcCXPw4uyq23JKkBr/fkWJDnyAz
hI+zrGFDem3jt+ReJO7X9IK0nZsB0q7f2gZ2YyZyEP53+LnCScdpcpTWB7CnZXUM
Received: from 315-99.51.80.144 (315-99.51.80.144-s [192.168.1.78]) by
initiativesnetwork.com for support [at] linuxmagic; Tue, 03 Nov 2009 00:32:10
-0500
Date: Tue, 03 Nov 2009 00:32:10 -0500
From: CoverQuotes <CoverQuotes [at] initiativesnetwork>


--
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors - President/CEO - LinuxMagic
Products, Services, Support and Development
Visit us at http://www.linuxmagic.com
------------------------------------------------------------------------
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" is a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-589-0037 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.


jlewis at lewis

Nov 3, 2009, 8:49 AM

Post #2 of 11 (739 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
On Tue, 3 Nov 2009, Michael Peddemors wrote:

> A new block under AT&T, listed as being owned by:
>
> The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
> 99.51.81.255
>
> Just started an email marketing campaign to addresses stripped from the web..
>
> We wouldn't run out of IP's if this didn't keep happening..

I don't see how this relates to IPv4-runout. The allocation (to AT&T)
isn't all that new...and when they cancel this spammer, the space will
undoubtedly be assigned to another customer.


----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________


rubensk at gmail

Nov 3, 2009, 8:52 AM

Post #3 of 11 (735 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
>> Just started an email marketing campaign to addresses stripped from the
>> web..
>>
>> We wouldn't run out of IP's if this didn't keep happening..
>
> I don't see how this relates to IPv4-runout.  The allocation (to AT&T) isn't
> all that new...and when they cancel this spammer, the space will undoubtedly
> be assigned to another customer.

And the new customer will suffer from blocklists until he asks AT&T
for a new space, which will most likely be granted, consuming the
previous spammer allocation for ever.


Rubens


michael at linuxmagic

Nov 3, 2009, 8:54 AM

Post #4 of 11 (722 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
It was mentioned that this might be offtopic for this list, however I did want
to get a feel for the attitudes of network operators, in light of the recent
discussions regarding the Russian Operators.. and blocking routing et al..

At what point does it become an issue to the point where operators demand that
others are responsible for the activiities coming from their networks?

Wanted to start a thread on this issue..

It was mentioned that not routing operators who are puported to be
owned/operated/supported by criminal activities, in conjunction with the
Russian IP's, and the controversy on the Hurricane Electric actions..

I think this is on topic.. However, if others think it isn't I will not post
to this subject here further...

I do know that there is a lot of chatter on this list, so I fully understand
if it needs to be kept for strictly technical problems, rather than
discussions.

-- Michael --

On November 3, 2009, you wrote:
> Hi,
>
> This really is not on topic for NANOG at all (unless you want to hear
> people whine about calling it a 'class c' instead of the /23 it is,
> etc etc) but it probably *is* on topic for the mailop list. I would
> suggest setting followups to this message accordingly with nanog not
> included.
>
> On Tue, Nov 3, 2009 at 11:32 AM, Michael Peddemors
>
> <michael [at] linuxmagic> wrote:
> > A new block under AT&T, listed as being owned by:
> >
> > The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
> > 99.51.81.255
> >
> > Just started an email marketing campaign to addresses stripped from the
> > web..
> >
> > We wouldn't run out of IP's if this didn't keep happening..
> >
> > So called CAN-SPAM compliant of course..
> >


--
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors - President/CEO - LinuxMagic
Products, Services, Support and Development
Visit us at http://www.linuxmagic.com
------------------------------------------------------------------------
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" is a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-589-0037 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.


morrowc.lists at gmail

Nov 3, 2009, 9:34 AM

Post #5 of 11 (736 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
On Tue, Nov 3, 2009 at 11:54 AM, Michael Peddemors
<michael [at] linuxmagic> wrote:
> It was mentioned that this might be offtopic for this list, however I did want
> to get a feel for the attitudes of network operators, in light of the recent
> discussions regarding the Russian Operators.. and blocking routing et al..
>
> At what point does it become an issue to the point where operators demand that
> others are responsible for the activiities coming from their networks?

I think this is fairly much off topic, but.. I'd say this:
1) did you send in proper complaints to att/Sbc for the activity you
allege comes from this ip block?
2) did you get back an auto-ack?
3) did this activity start prior to today? (looking at the headers in
the original post)

If so, then I'm sure ATT will do the right thing in the next little
while... they can't turn off (for a variety of reasons) a customer
that seems may have been 'ok' for 7 months time (judging by the
reg-date for the block in question) with only a single
complaint/event.

Complaining about this on nanog-l certainly won't get any of your
concerns about this SBCIS customer addressed though.

-Chris
(note I don't see in my personal spamtraps content from this address range)


jay at west

Nov 3, 2009, 9:54 AM

Post #6 of 11 (733 views)
Permalink
Re: New Class C's just lit on on AT&T, spamming [In reply to]
Jon Lewis wrote:
> On Tue, 3 Nov 2009, Michael Peddemors wrote:
>
>> A new block under AT&T, listed as being owned by:
>>
>> The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
>> 99.51.81.255
>>
>> Just started an email marketing campaign to addresses stripped from
>> the web..

There's a far more succinct term for "email marketing campaign"...

>> We wouldn't run out of IP's if this didn't keep happening..
>
> I don't see how this relates to IPv4-runout. The allocation (to AT&T)
> isn't all that new...and when they cancel this spammer, the space will
> undoubtedly be assigned to another customer.

And that other customer will find that it's poisoned space and will need
to look for another subnet.

--
Jay Hennigan - CCIE #7880 - Network Engineering - jay [at] impulse
Impulse Internet Service - http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV


jlewis at lewis

Nov 3, 2009, 10:03 AM

Post #7 of 11 (735 views)
Permalink
Re: New Class C's just lit on on AT&T, spamming [In reply to]
On Tue, 3 Nov 2009, Jay Hennigan wrote:

>> I don't see how this relates to IPv4-runout. The allocation (to AT&T)
>> isn't all that new...and when they cancel this spammer, the space will
>> undoubtedly be assigned to another customer.
>
> And that other customer will find that it's poisoned space and will need to
> look for another subnet.

I don't buy that once IP space has been used by a spammer it's ruined
forever. Only if abuse complaints are ignored for a considerable time are
the IPs likely to end up widely privately blacklisted. Even then, I don't
believe "space is widely blacklisted, please give us more" is a valid
justification for going to ARIN for more IPs.

We've terminated spammer customers...and reused their assignments.

----------------------------------------------------------------------
Jon Lewis | I route
Senior Network Engineer | therefore you are
Atlantic Net |
_________ http://www.lewis.org/~jlewis/pgp for PGP public key_________


henry at AegisInfoSys

Nov 3, 2009, 11:23 AM

Post #8 of 11 (724 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
On Tue, Nov 03, 2009 at 12:34:37PM -0500, Christopher Morrow wrote:

> 3) did this activity start prior to today? (looking at the headers in
> the original post)

e-mail spam from 99.51.80.0/23 starting 04/15/2009, and from
99.51.84.0/24 starting 09/21/2009.

--
Henry Yen Aegis Information Systems, Inc.
Senior Systems Programmer Hicksville, New York


aaron at coinet

Nov 3, 2009, 12:10 PM

Post #9 of 11 (725 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
I don't think AT&T cares, since I complained about a massive snowshoe
spamming campaign a couple of months ago--no action taken it
seems--and they have netblocks all over the place there. A bunch of
customers were calling me since their junk was being scored low by
spamassassin and ending up in inboxes. Blah! I've seen spam from
each one of their blocks at at&t.

99.155.208-209
99.51.80-81
99.170.198-199
99.16.32-39



On Tue, Nov 03, 2009 at 08:32:10AM -0800, Michael Peddemors wrote:
> A new block under AT&T, listed as being owned by:
>
> The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
> 99.51.81.255
>
> Just started an email marketing campaign to addresses stripped from the web..
>
> We wouldn't run out of IP's if this didn't keep happening..


pbosworth at gmail

Nov 3, 2009, 12:18 PM

Post #10 of 11 (724 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
Just filter it and move on- business as usual. If we barked up every tree
we'd never get any real work done.

On Nov 3, 2009 11:33 AM, "Michael Peddemors" <michael [at] linuxmagic> wrote:

A new block under AT&T, listed as being owned by:

The Karcher Group Inc. ATTIS-9951800 (NET-99-51-80-0-1) 99.51.80.0 -
99.51.81.255

Just started an email marketing campaign to addresses stripped from the
web..

We wouldn't run out of IP's if this didn't keep happening..

So called CAN-SPAM compliant of course..

Return-Path: <618882010 [at] return>
Delivered-To: support [at] linuxmagic
Received: (qmail 25942 invoked from network); 3 Nov 2009 05:26:41 -0000
Received: from unknown (HELO mail23.collegeloanassociates.com)
(99.51.80.247)
by thundercracker.cityemail.com with SMTP; Mon, 02 Nov 2009 21:26:41
-0800
DKIM-Signature: v=1; a=rsa-sha1; d=signtabulararrayoffice.com; s=default;
c=simple/simple;
q=dns/txt; i=@signtabulararrayoffice.com; t=1257225979;
h=From;
bh=dua1L4dgTnW3vCenQjnlynXJ0yk=;
b=jxhpH/zBQxVZ5O4+8Yd2Va5Dj3v6Soasndd6moffduE1XIfNz7UzYntYdA6AwGZ1
qLBFmNjyNyTKjdeCc9vDa/ApxFy6LrsPMpsRjbyOjh8Io3951KpzLOPD3BwcYYsf;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
s=default; d=signtabulararrayoffice.com;
h=Received:Date:From:To:Message-id:Mime-Version:Subject:X-Ver:X-
CampaignDetail:X-Edata1:X-Log:Errors-To:List-Unsubscribe:Content-Type;
b=PhZXM6t8AayFvb3UDWPYbhL98WpXfcC/g95pqhVM2gNwjRd6hnTO+w1PB2z2Xv8/
5L7acKRTMWdCNZ8Ql1doxzrZ0QYt5u4bd48rbyQiUmMU69ToMXnvFw5mKxLtX5H+
Received: from 316-99.51.80.247 (316-99.51.80.247-s [192.168.1.75]) by
signtabulararrayoffice.com for support [at] linuxmagic; Tue, 03 Nov 2009
00:26:19 -0500
Date: Tue, 03 Nov 2009 00:26:19 -0500
From: NaughtyDating Alerts <NaughtyDatingAlerts [at] signtabulararrayoffice>

Return-Path: <618882010 [at] return>
Delivered-To: support [at] linuxmagic
Received: (qmail 28563 invoked from network); 3 Nov 2009 05:32:47 -0000
Received: from unknown (HELO mail16.bankanswer.net) (99.51.80.144)
by thundercracker.cityemail.com with SMTP; Mon, 02 Nov 2009 21:32:47
-0800
DKIM-Signature: v=1; a=rsa-sha1; d=initiativesnetwork.com; s=default;
c=simple/simple;
q=dns/txt; i=@initiativesnetwork.com; t=1257226339;
h=From;
bh=ZAz5horGN06rHfgsLW4iBy5nKtY=;
b=1sfpRla+5g4KyKZbji1fiTueDe9pLJKojoqbjic6icN+CehR20mDLLxhi1m58Jjh
4IO10Esc9T1+nDvh3D68nw0bePfCkBKYO6yOThLpGBb95ewtzZ7oFoq3agpS6tYM;
DomainKey-Signature: q=dns; a=rsa-sha1; c=nofws;
s=default; d=initiativesnetwork.com;
h=Received:Date:From:To:Message-id:Mime-Version:Subject:X-Ver:X-
CampaignDetail:X-Edata1:X-Log:Errors-To:List-Unsubscribe:Content-Type;
b=VTbPf7DV+qu9jWHRmmpB4U8p9Ug4DMdqkz3c1KcCXPw4uyq23JKkBr/fkWJDnyAz
hI+zrGFDem3jt+ReJO7X9IK0nZsB0q7f2gZ2YyZyEP53+LnCScdpcpTWB7CnZXUM
Received: from 315-99.51.80.144 (315-99.51.80.144-s [192.168.1.78]) by
initiativesnetwork.com for support [at] linuxmagic; Tue, 03 Nov 2009 00:32:10
-0500
Date: Tue, 03 Nov 2009 00:32:10 -0500
From: CoverQuotes <CoverQuotes [at] initiativesnetwork>


--
--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors - President/CEO - LinuxMagic
Products, Services, Support and Development
Visit us at http://www.linuxmagic.com
------------------------------------------------------------------------
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" is a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-589-0037 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.


john-nanog at johnpeach

Nov 3, 2009, 12:29 PM

Post #11 of 11 (718 views)
Permalink
Re: New Class C's just lit on on AT&T, Email Marketing [In reply to]
On Tue, 3 Nov 2009 12:10:43 -0800
"Aaron L. Meehan" <aaron [at] coinet> wrote:

> I don't think AT&T cares, since I complained about a massive snowshoe
> spamming campaign a couple of months ago--no action taken it
> seems--and they have netblocks all over the place there. A bunch of
> customers were calling me since their junk was being scored low by
> spamassassin and ending up in inboxes. Blah! I've seen spam from
> each one of their blocks at at&t.
>
> 99.155.208-209
> 99.51.80-81
> 99.170.198-199
> 99.16.32-39
>
>
99.16.32.0/21 REJECT
99.51.80.0/23 REJECT
99.155.208.0/23 REJECT
99.170.198.0/23 REJECT

will do nicely, thank-you.

--
John

NANOG users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.