swinog

swinog@lists.swinog.ch

2933 discussions

Belgian spammer
by Klaus Ethgen 23 Aug '13

23 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello, slowly I get pissed of from one Belgian spammer. Do anybody else see high personalized spam from smtp\.ymlp\d*\.net or smtp\d*\.ymlpsrv\.net? First I found them in uni zürich where they spammed all employees and all students with some festivals in zürich and now I even get spams from those spammer privately. It is not clear where the addresses comes from and I even wounder how this spammer is able to stay outside of all dnsrbls. And as he spawns new nodes on and on it is only possible to block him with the above regexes. Anybody saw any legal mail from this spammer? Gruß Klaus - -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Klaus(a)Ethgen.de> Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQGcBAEBCgAGBQJSFdYHAAoJEKZ8CrGAGfasNmkL/igYRH62Sc8yOIpgr3IwVXC+ cXIVUTOJ5Y5oBZd0Tg3E21iJI3nYhYXKKttphfiYDHalKZirPDIAHITh8VBtUh7i VjAD7CjMOB2ll5oXGEORRT7t09zq2OJuIh14cg4UDPSVxT33Pj6IdPRTz9weNZw/ Xeu7cRv0WRts1r+f/zMinAw/eAXYdblsyTvJ99Yf71Pok6TE1/SSBI57Gz4RZl+l M7mr6l3sKI5B1H0a+S+nIiS6dxFMbeeSDVn70FFDDDNa6FulkozeRs7icyIEiCFw GI1kSGAwHilsosH4iqJw3gQY0rg44Xy3lE0gu+GLYv4SaH6sWV6nhuslUXzhUN6K SX08oEXG71lA5sQyMqMU3gXxZM2FswEOfbdCrBIv+IvXZ9AljsEIEl97I18wYXX7 a7SksyjUkkkuSlOGgQWD4YTA/87Z2CD0zdfdkRyBmL+Kh39H6WLwEFzQOlNCMEBU 8KeS2xj1lvRhcwyqnsY6qJXs2MYTgFvujeKJ/BgYRQ== =WQAv -----END PGP SIGNATURE-----

3 7

Small VoIP PBX recommendations
by Andre Oppermann 23 Aug '13

23 Aug '13

I'm looking for recommendations on small VoIP PBX systems with these properties: - works well with Snom, Aastra, and Soft-phones - 10-15 phones - basic admin (web gui) to configure accounts and assign numbers (DDI) - reliable and secure operation - support for uplink SIP trunking (no BRI ports) - log for CDRs to see who cost how much An opensource solution running on Linux/FreeBSD would be preferred, a small and good complete "hardware" solution for a couple of hundred bucks would acceptable as well. In either case it should be relatively straight forward and low hassle installation and operation. What would you recommend? Which packages would you rather avoid? Thanks -- Andre

6 6

How to automate abuse complaints for ip based violations
by Markus Wild 23 Aug '13

23 Aug '13

Hi there, when looking through traffic analysis, I can more or less easily identify IP addresses that exhibit bad behavior (like massive port/address scanning, attempting to log into joomla/wp administration URLs, POP3/SMTP account scanning, etc) which need to be blocked. Now, since most of these IPs are not the actual culprits, but merely infected machines, it would be helpful for the internet health as a whole to report such incidents to their respective ISPs. Here's where the problem starts:) My manual approach would be to lookup whois data for the respective IP (which by itself can be a multi step process, since you first need to find the right registry), and look for an abuse-contact there. But, whois isn't exactly engineered for automated mass lookups (+), and if I did this I'm sure I'd probably be violating terms of use of at least some of the registry whois servers, and be locked out. So, what alternatives are there? I saw that abuse.net keeps a nice DNS based lookup service for domain names, but they unfortunately don't do this for IP addresses. How are others doing this? I know I occasionally received output of fail2ban scripts when working for a larger ISP. Are these all in-house local developments? Cheers, Markus (+) joomla/wp scans alone yielded > 3000 ip addresses in one day for our little network...

4 4

cisco switches: new config with vlan defintion is not applied to startup-config for some reason
by Lukas Eisenberger 21 Aug '13

21 Aug '13

Hi list During a future migration I will migrate the configuration of around onehundert already existing switches. Because I am lazy as many it guys I prepared the configs which I want to apply to the switches in order to safe time. Many things change from the previous config to the future one: lacp uplinks, vlan defintions, management vlan and so on. So during the miration I want to do something like this: copy tftp://10.6.100.3/config.txt startup-config and do a reload or configure replace tftp://10.6.100.3/config.txt I tested my miration path in the lab and I figured out that low numbering vlans in the range of 2-1001 are for some strange reason not applied to the config. I tried also deleting vlan.dat and change to vtp of or transparent/server/client and diffrent vtp versions before applying the config without success. Does somebody have a clou about the strange behaviour? I use iso version 15.0(2)SE on a 2960S Cheers Luke

3 3

Domain ip-plus.net hijacked?
by Fredy Kuenzler 20 Aug '13

20 Aug '13

It seems that the Domain ip-plus.net got hijacked by some domain grabber: http://www.ip-plus.net/ Traceroutes to any Swisscom host look rather ugly. -- Fredy Kuenzler Init7 (Switzerland) Ltd. AS13030 St. Georgen-Strasse 70 CH-8400 Winterthur Skype: flyingpotato Phone: +41 44 315 4400 Fax: +41 44 315 4401 Twitter: @init7 / @kuenzler http://www.init7.net/

9 8

DDoS Attack to ZUGERNET
by ZUGERNET NOC 19 Aug '13

19 Aug '13

Dear all We are memeber on this list since many years now, but not so chatty, more listening. But today I feel a strong necessity to contact the community, since we (ISP ZUGERNET, AS 28859) are being attacked many times over the last 24 hours with huge traffic disabling our network completely. The attack is really very damaging: to ourselves, to our customers and to their customers and partners. You can imagine... If someone of you can give me a hint on how to track down, WHO is causing this, I would really appreciate any help and may it be very small. I know, that technically such attacks are not trackable - but what I mean is more: if someone can share some "underground knowledge" with me to possibly finding out which bot-net is used (under the control of whom etc; we can share some netflow capture with a huge amount of source-ip-addresses) and possibly has "underground-contacts" to find out more about them...? Thank you in advance! Feel free to answer me off-list if you feel more appropriate. Kind regards, Patrick Hofmann ___________________________________________________________________________ ZUGERNET, Hofmann Informatik AG · Grienbachstr. 17 · 6300 Zug · Switzerland http://www.zugernet.ch/ · fon +41 (0)41 766 88 22 · fax +41 (0)41 766 88 33

4 4

Domain ip-plus.net hijacked?
by Fredy Kuenzler 19 Aug '13

19 Aug '13

1 0

DNS amplification attack (bfhmm.com in TXT)
by Michael Richter 16 Aug '13

16 Aug '13

Anyone else see such packets on his DNS servers? I've just blocked that query. http://blog.righter.ch/?p=581 no comments if it's not the best idea :-)) Freundliche Grüsse sasag Kabelkommunikation AG Michael Richter Professional Bachelor ODEC in Engineering mrichter(a)sasag.ch 052 633 01 71

1 0

DNS Secondary providers in Geneva
by Peter Hessler 14 Aug '13

14 Aug '13

Hi Everyone My company is looking for a Secondary DNS name server, preferrably located in Geneva. Our Primary NS is in Zurich, and we would like geographic redundancy. Please contact me off-list, if you know of a provider or are willing to provide this yourself.

1 0

SwiNOG-BE123 - Beer Event 123 @ Pumpstation / ZH
by Steven Glogger 02 Aug '13

02 Aug '13

Dear SwiNOGers, Enjoy the Sun, the Beer and the Lake. Details for the next event: ----------------------------------------------- Event: SwiNOG-BE123 - Beer Event 123 When? Monday, 5th August 2013 18:30 Where? Pumpstation Utoquai 10, 8008 Zürich http://www.pumpstation.ch/ (GoogleMaps Link: http://goo.gl/maps/a7O3Q) !! In case it would rain: we would move over to another place. Stay tuned and check your mailbox before coming... !! !! Please note: I cannot reserve ANY table - the first one to come should get a big table for all ,-) !! ----------------------------------------------- Registration: Start: Friday, 2nd August 2013 - 14:05 Stop: Monday, 5th August 2013 - 14:00 Reg-URL: http://swinog.be/ ----------------------------------------------- Since we have to make reservations, I need to know who's coming and who not. If you can't attend and you're registered please inform me ASAP (+41 79 277 92 35). greetings -steven

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog