Re: Spamming of NANOG list members

2019-06-02 Thread Mike Hammett
- From: b...@theworld.com To: nanog@nanog.org Sent: Saturday, June 1, 2019 3:18:42 PM Subject: Re: Spamming of NANOG list members WARNING: I AM ABOUT TO PONTIFICATE! Many of the lists etc I'm on get spamt and that's followed by a stream of "we're getting spamt!" (eit

Re: Spamming of NANOG list members

2019-06-01 Thread bzs
WARNING: I AM ABOUT TO PONTIFICATE! Many of the lists etc I'm on get spamt and that's followed by a stream of "we're getting spamt!" (either directly or scraped) agonizing, over and over. I've been involved in the spam problems since before some of you were bornt (ok I'll stop with the stupid p

Re: Spamming of NANOG list members

2019-06-01 Thread colin johnston
See this as well today But gmail auto trashed it :) Col > On 1 Jun 2019, at 14:50, Niels Bakker wrote: > > * s...@ottie.org (Scott Christopher) [Sat 01 Jun 2019, 12:04 CEST]: >> I wonder if this crap corresponds positively with the price of Bitcoin. > > Only speculation (read: market manipul

Re: Spamming of NANOG list members

2019-06-01 Thread Niels Bakker
* s...@ottie.org (Scott Christopher) [Sat 01 Jun 2019, 12:04 CEST]: I wonder if this crap corresponds positively with the price of Bitcoin. Only speculation (read: market manipulation) by holders of massive amounts of bitcoin drives the price of cryptocurrencies: https://davidgerard.co.uk/blo

Re: Spamming of NANOG list members

2019-06-01 Thread Scott Christopher
M. Omer GOLGELI wrote: > There are also variants of it with subjects like > > " Ref Id: %VARIABLE% " > and > "%Domain.tld% Ref Id: %VARIABLE% " > > > > And as Bryan said, we are increasingly getting more and more as well. I wonder if this crap corresponds positively with the price of Bitcoin

Re: Spamming of NANOG list members

2019-06-01 Thread M. Omer GOLGELI
There are also variants of it with subjects like " Ref Id: %VARIABLE% " and "%Domain.tld% Ref Id: %VARIABLE% " And as Bryan said, we are increasingly getting more and more as well. M. Omer GOLGELI --- AS202365 June 1, 2019 6:05 AM, "Richard" mailto:rgolod...@infratection.com?to=%22Richard%22%20)>

Re: Spamming of NANOG list members

2019-05-31 Thread Grant Taylor via NANOG
On 5/31/19 5:53 PM, Bryan Holloway wrote: Anybody else noticed a significant uptick in these e-mails? When I first saw this thread, I hadn't seen any. A couple days later, I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?) Intriguing. I've not yet received a single one. -- Grant

Re: Spamming of NANOG list members

2019-05-31 Thread Paul Ferguson
On 5/31/2019 8:05 PM, Richard wrote: > On 5/31/19 8:07 PM, Niels Bakker wrote: >> * br...@shout.net (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]: >>> Anybody else noticed a significant uptick in these e-mails? >>> >>> When I first saw this thread, I hadn't seen any. A couple days later, >>> I go

Re: Spamming of NANOG list members

2019-05-31 Thread Richard
On 5/31/19 8:07 PM, Niels Bakker wrote: > * br...@shout.net (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]: >> Anybody else noticed a significant uptick in these e-mails? >> >> When I first saw this thread, I hadn't seen any. A couple days later, >> I got my first one. (yay!) Now I'm getting 2-3 a

Re: Spamming of NANOG list members

2019-05-31 Thread Niels Bakker
* br...@shout.net (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]: Anybody else noticed a significant uptick in these e-mails? When I first saw this thread, I hadn't seen any. A couple days later, I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?) Yes. It's pretty annoying. And som

Re: Spamming of NANOG list members

2019-05-31 Thread Bryan Holloway
Anybody else noticed a significant uptick in these e-mails? When I first saw this thread, I hadn't seen any. A couple days later, I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?)

Re: 29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]

2019-05-29 Thread Dan Hollis
On Wed, 29 May 2019, Paul Ferguson wrote: AS | IP | AS Name 14061 | 68.183.65[.]234| DIGITALOCEAN-ASN - DigitalOcean, LLC, US (shared hosting) 16276 | 158.69.127[.]22| OVH, FR (shared hosting) 51167 | 173.249.2[.]31 | CONTABO, DE (shared hosting) 46475 | 74

Re: 29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]

2019-05-29 Thread Paul Ferguson
> On May 29, 2019, at 9:14 AM, Niels Bakker wrote: > > * fergdawgs...@mykolab.com (Paul Ferguson) [Wed 29 May 2019, 18:04 CEST]: >> This is apparently (?) part of a wave of spoofed malspams impersonating >> messages with ‘weaponized' attachments sent to the NANOG (North American >> Network Op

Re: 29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]

2019-05-29 Thread Niels Bakker
* fergdawgs...@mykolab.com (Paul Ferguson) [Wed 29 May 2019, 18:04 CEST]: This is apparently (?) part of a wave of spoofed malspams impersonating messages with ‘weaponized' attachments sent to the NANOG (North American Network Operators Group) mailing list. They're not sent to the list, they'r

29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]

2019-05-29 Thread Paul Ferguson
*Just an FYI, the obfuscated URLs and IPs below are malicious.* This is apparently (?) part of a wave of spoofed malspams impersonating messages with ‘weaponized' attachments sent to the NANOG (North American Network Operators Group) mailing list. Background: https://mailman.nanog.org/pipermail

Re: Spamming of NANOG list members

2019-05-24 Thread Grant Taylor via NANOG
On 5/24/19 4:11 PM, Eric Tykwinski wrote: I guess you don’t get Comcast abuse reports, below is an example: "e7f05f85ba44ad3393e7b086eed202ee b2cca3a3ae3825c36999e12722e83830" , "Ed d95a762f93c99703afe76d25f1679ea4" Those look like they are probably MD5 hashes (I'm guessing) of names. So y

Re: Spamming of NANOG list members

2019-05-24 Thread Eric Tykwinski
Rich, Comment’s inline: On May 24, 2019, at 5:58 PM, Rich Kulawiec wrote > On Fri, May 24, 2019 at 06:34:25PM +0300, Scott Christopher wrote: >> https://marc.info/?l=nanog&r=1&w=2 and https://lists.gt.net/nanog/ >> mangle email addresses in the headers but do nothing about email addresses >> tha

Re: Spamming of NANOG list members

2019-05-24 Thread Rich Kulawiec
On Fri, May 24, 2019 at 06:34:25PM +0300, Scott Christopher wrote: > https://marc.info/?l=nanog&r=1&w=2 and https://lists.gt.net/nanog/ > mangle email addresses in the headers but do nothing about email addresses > that are quoted / attributed in the body. There is zero, as in 0.0, point in mangl

Re: Spamming of NANOG list members

2019-05-24 Thread Daniel Seagraves
I just got one of these and have not posted in a long time. They must be crawling archives.

Re: Spamming of NANOG list members

2019-05-24 Thread Brian Kantor
An interesting development: my posting to this list a few minutes ago seems to have triggered an autoresponder asking me to confirm the issuance of a support ticket by Liquid Web, whoever they are. - Brian > > On Fri, May 24, 2019 at 08:17:31AM -0700, Brian Kantor wrote: > > > Anne, the w

Re: Spamming of NANOG list members

2019-05-24 Thread Scott Christopher
Rich Kulawiec wrote: > On Fri, May 24, 2019 at 08:17:31AM -0700, Brian Kantor wrote: > > Anne, the way that such addresses are often harvested is that one of > > the spammers (or his agent) becomes a member of the list and simply > > records the addresses of persons posting to the list. They the

Re: Spamming of NANOG list members

2019-05-24 Thread John Peach
On 5/24/19 11:36 AM, Rich Kulawiec wrote: On Fri, May 24, 2019 at 08:17:31AM -0700, Brian Kantor wrote: Anne, the way that such addresses are often harvested is that one of the spammers (or his agent) becomes a member of the list and simply records the addresses of persons posting to the list.

Re: Spamming of NANOG list members

2019-05-24 Thread Rich Kulawiec
On Fri, May 24, 2019 at 08:17:31AM -0700, Brian Kantor wrote: > Anne, the way that such addresses are often harvested is that one of > the spammers (or his agent) becomes a member of the list and simply > records the addresses of persons posting to the list. They then > get spammed. I rather susp

Re: Spamming of NANOG list members

2019-05-24 Thread Scott Christopher
Anne P. Mitchell, Esq. wrote: > Question: Is the member list with email addresses public?? Otherwise, > one has to wonder how they got these addresses? https://marc.info/?l=nanog&r=1&w=2 and https://lists.gt.net/nanog/ mangle email addresses in the headers but do nothing about email addresse

Re: Spamming of NANOG list members

2019-05-24 Thread Mike Hammett
ssage - From: "William Herrin" To: "Anne P. Mitchell, Esq." Cc: "J. Hellenthal via NANOG" Sent: Friday, May 24, 2019 10:14:47 AM Subject: Re: Spamming of NANOG list members On Fri, May 24, 2019 at 8:08 AM Anne P. Mitchell, Esq. < amitch...@isipp.com >

Re: Spamming of NANOG list members

2019-05-24 Thread Brian Kantor
Anne, the way that such addresses are often harvested is that one of the spammers (or his agent) becomes a member of the list and simply records the addresses of persons posting to the list. They then get spammed. - Brian On Fri, May 24, 2019 at 09:07:28AM -0600, Anne P. Mitchell, Esq. w

Re: Spamming of NANOG list members

2019-05-24 Thread William Herrin
On Fri, May 24, 2019 at 8:08 AM Anne P. Mitchell, Esq. wrote: > Question: Is the member list with email addresses public?? Otherwise, > one has to wonder how they got these addresses? > Everyone who posts does so with an email address that becomes known to everyone who subscribes and published

Re: Spamming of NANOG list members

2019-05-24 Thread Anne P. Mitchell, Esq.
Question: Is the member list with email addresses public?? Otherwise, one has to wonder how they got these addresses? Anne Anne P. Mitchell, Attorney at Law CEO/President, Institute for Social Internet Public Policy GDPR, CCPA (CA) & CCDPA (CO) Compliance Consultant Author: Section 6 of the C

Re: Spamming of NANOG list members

2019-05-24 Thread Sandra Murphy
So sheer coincidence. Literally. —Sandy > On May 23, 2019, at 7:07 PM, Niels Bakker wrote: > > * sa...@tislabs.com (Sandra Murphy) [Fri 24 May 2019, 00:28 CEST]: >> And it arrived oddly coincident with my visit to the cvent registration >> page. Any others who had that coincidence? > > No,

Re: Spamming of NANOG list members

2019-05-23 Thread Niels Bakker
* sa...@tislabs.com (Sandra Murphy) [Fri 24 May 2019, 00:28 CEST]: And it arrived oddly coincident with my visit to the cvent registration page. Any others who had that coincidence? No, and I've gotten like five by now. -- Niels.

Re: Spamming of NANOG list members

2019-05-23 Thread Sandra Murphy
Mine came 21 May. It was a .doc. Sent from charter.net, with the user portion of the sender very similar to a nanog contributor. And it arrived oddly coincident with my visit to the cvent registration page. Any others who had that coincidence? —Sandy > On May 23, 2019, at 5:39 PM, Richar

Re: Spamming of NANOG list members

2019-05-23 Thread Richard
On 5/23/19 4:16 PM, Matt Harris wrote: > On Thu, May 23, 2019 at 4:13 PM Hansen, Christoffer > mailto:christof...@netravnen.de>> wrote: > > Appreciate the warning! > > On 23/05/2019 19:46, Valerie Wittkop wrote: > > These messages are not flowing through NANOG servers, nor using > t

Re: Spamming of NANOG list members

2019-05-23 Thread Matt Harris
On Thu, May 23, 2019 at 4:13 PM Hansen, Christoffer < christof...@netravnen.de> wrote: > Appreciate the warning! > > On 23/05/2019 19:46, Valerie Wittkop wrote: > > These messages are not flowing through NANOG servers, nor using the > NANOG domain. They are not messages coming from the NANOG organ

Re: Spamming of NANOG list members

2019-05-23 Thread Hansen, Christoffer
Appreciate the warning! On 23/05/2019 19:46, Valerie Wittkop wrote: > These messages are not flowing through NANOG servers, nor using the NANOG > domain. They are not messages coming from the NANOG organization. Please be > aware if you receive a message matching this description and always make

Spamming of NANOG list members

2019-05-23 Thread Valerie Wittkop
Hello NANOG Community, It has come to our attention there are spamming messages being sent to members of the NANOG mail list spoofed to look as though they are coming from the NANOG organization. The messages being sent refer to NANOG Remittance, with an attachment containing a virus. These m