hijacked

: You have been unsubscribed from the Hijacked mailing list

Fri, 24 Feb 2006 18:32:51 GMT

Kai Schlichting & Little Punk: Re: [Hijacked] 172, 2.0.0 space - Omnipoint Marketing, Ft Lauderdale, FL USA

Fri, 24 Feb 2006 18:33:09 GMT

At 03:22 PM 5/19/04 -0600, Bruce Gingery wrote:
>[whois.arin.net]
>
>OrgName: Omnipoint Marketing
>OrgID: OMNIP-2
>Address: 6700 N Andrews Ave.
>City: FORT LAUDERDALE
>StateProv: FL
>PostalCode: 33309
>Country: US
>
>NetRange: 206.132.224.0 - 206.132.231.255
>CIDR: 206.132.224.0/21
>
># Using dig 199.225.132.206.asn.routeviews.org.
>206.132.225.199 announced via route 206.132.224.0/21 from AS 3549
>
>ASName: GBLX
>ASHandle: AS3549
>
>Partial traceroute ...
>
>12 [67.17.66.165] ASpath: "3356 3549" via 67.16.0.0/15
> so0-0-0-2488M.ar2.TPA1.gblx.net
> 137.630 ms 100.279 ms 99.951 ms
>13 [67.17.160.122] ASpath: "3356 3549" via 67.16.0.0/15
> Omnipoint-Marketing.t3-2-3-1.ar2.TPA1.gblx.net
> 99.843 ms 100.041 ms 99.286 ms
>14 * * *
>15 [172.2.1.2]
> 172.2.1.2 THEFT BOGON!
> 98.815 ms 98.523 ms 97.983 ms
>16 [206.132.225.199] ASpath: "3549" via 206.132.224.0/21
> net.omninamed.com
> 98.504 ms * 99.588 ms

Not hijacked, just the leaking of Eddy Marin's internal VPN address in the trace.

Quick story. Eddy got hosted on Qwest last year, they tried to boot him, he sued them and got a month of uptime under a Florida court ordered injunction. (he later lost or dropped the suit, all he wanted was the uptime) A month ago he got hosted with them again, spammed for about 5 days last week, they have now canned him.

Quick story. Eddy got hosted on Global Crossing last year, they tried to boot him, he sued them and got a two and a half months of uptime under a Florida court ordered injunction. (he later lost or dropped the suit, all he wanted was the uptime) A month ago he got hosted with them again, after getting booted from Qwest last week, he's now started spamming from Global. Their abuse guys know all about it.

Who says the networks aren't the real spam problem these days?* :/

*okay, one of the real spam problems...

===================================================================== This message is from the "Hijacked" mailing list and is only sent to members who have subscribed to the list with closed-loop confirmation. To leave the list, send mail directly from the subscribed account to majordomo@numbering.com with the text unsubscribe in the message BODY =====================================================================

Bruce Gingery: [Hijacked] 172, 2.0.0 space - Omnipoint Marketing, Ft Lauderdale, FL USA

Fri, 24 Feb 2006 18:33:09 GMT

[whois.arin.net]

OrgName: Omnipoint Marketing OrgID: OMNIP-2 Address: 6700 N Andrews Ave. City: FORT LAUDERDALE StateProv: FL PostalCode: 33309 Country: US

NetRange: 206.132.224.0 - 206.132.231.255 CIDR: 206.132.224.0/21

# Using dig 199.225.132.206.asn.routeviews.org. 206.132.225.199 announced via route 206.132.224.0/21 from AS 3549

ASName: GBLX ASHandle: AS3549

Partial traceroute ...

12 [67.17.66.165] ASpath: "3356 3549" via 67.16.0.0/15
so0-0-0-2488M.ar2.TPA1.gblx.net
137.630 ms 100.279 ms 99.951 ms 13 [67.17.160.122] ASpath: "3356 3549" via 67.16.0.0/15
Omnipoint-Marketing.t3-2-3-1.ar2.TPA1.gblx.net
99.843 ms 100.041 ms 99.286 ms 14 * * * 15 [172.2.1.2]
172.2.1.2CNTRLCNTRLCNTRLCNTRLCNTRL THEFT BOGON!
98.815 ms 98.523 ms 97.983 ms 16 [206.132.225.199] ASpath: "3549" via 206.132.224.0/21
net.omninamed.com
98.504 ms * 99.588 ms

-- It is ASANINE to continue to carry traffic from hosts which are partici- pating in a denial-of-service attack upon one's facilities if one has an alternative. Routing is controlled at each gateway.

Kai Schlichting & Little Punk: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:02 GMT

On 4/12/2004 at 5:50 PM, "Adam Rothschild" wrote:

> I'm not. Darrin was released, and is now in the can on different
> charges, with an expected release date several months from now. I'll
> leave the "what" as an exercise for Lexis-Nexis and your whois client.
> :-)

> -a

There is no parole in the federal prison system, and from what I read in the court records, he got 24 months on the fraud/identity theft charges, with some time credited to him. Even with the time credit, he should have been sitting in the Federal Correctional Institution (FCI) until at least November 2004 - Bureau of Prisons lists his release date as JUNE of this year instead. Now: a.) is he serving a concurrent sentence and b.) why is it 5 months shorter than what he should have gotten?

Someone with Lexis-Nexis access, please look this up?

Thanks, (Kai)

Adam Rothschild: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:31:47 GMT

On 2004-04-12-12:30:22, Kai Schlichting & Little Punk wrote: [...]
> why are you repeating what I said in the paragraph that followed the
> one you quoted? [...]

I'm not. Darrin was released, and is now in the can on different charges, with an expected release date several months from now. I'll leave the "what" as an exercise for Lexis-Nexis and your whois client. :-)

-a

Kai Schlichting & Little Punk: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:00 GMT

On 4/11/2004 at 2:49 AM, "Adam Rothschild" wrote:

> Sorry to break it to you guys, but Darrin is currently in jail on
> totally unrelated charges. And I have a funny feeling he isn't
> advertising hijacked IP space from the prison law library. But don't
> take my word for it; hit up the inmate locator on www.bop.gov...

why are you repeating what I said in the paragraph that followed the one you quoted?

And "credit fraud and identity theft" seem very much related to AS 12277's activities. Just because the prosecutors have missed that part, and it wasn't part of the indictment, doesn't make it 'unrelated'.

What do you know about the operators of NIXC.NET/AS23321, Adam?

(Kai)

Williamelan.Net: [Hijacked] Re: Currently routed hijacked blocks list and suspicions about block 168.245.0.0/16

Fri, 24 Feb 2006 18:32:03 GMT

Well it appears our last week discussion on this list had some effect, most likely due to Chris talking to AS23221 upstreams (thank you, Chris). Currently these are all that is left being announced by them:

* i66.250.66.0/24 209.144.160.89 100 100 6347 701 209 29944 23221 i * i168.245.0.0 209.144.160.89 100 100 6347 174 23221 i * i168.245.100.0/24 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.80.0/20 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.81.0 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.84.0 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.85.0 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.86.0 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.87.0 209.144.160.89 100 100 6347 3549 30179 3638 23221 i * i216.115.95.0 209.144.160.89 100 100 6347 174 23221 i

Neither 146.20.x.x nor UUNET ip blocks are announced by them any more And in fact 146.20.0.0/16 is no longer announced by anybody - first time in long long while....

Now if only there was good way of reaching administrator of 168.245.0.0 ip block Ilham Ahmed and verifying if he knows about what is going on or not ... None of the phone## listed are working and the only email available is his Sun alumni address and he did not respond to emails sent there yet. I've looked and could not find anything current on him, if anybody knows, please let me know or try to get in touch with him yourself.

-- William Leibzon Elan Networks william@elan.net

Adam Rothschild: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:01 GMT

On 2004-04-08-19:06:44, Kai Schlichting & Little Punk wrote: [...]
> Domain name: NIXC.NET
> Domain servers in listed order:
> NS1.NIXC.NET 66.250.66.3
> NS0.NIXC.NET 146.20.64.10 <-- hijacked Erie Forge and Steel /16
>
> 66.250.66.3 announced via route 66.250.66.0/24 from AS 23221
> 146.20.64.10 announced via route 146.20.64.0/24 from AS 23221
>
> And a search for NIXC.net and "NANOG" turns up a ton of links consistently
> pointing back at one individual:
> http://answerpointe.cctec.com/maillists/nanog/historical/0104/msg00155.html
> -> Darrin Walton [...]

Sorry to break it to you guys, but Darrin is currently in jail on totally unrelated charges. And I have a funny feeling he isn't advertising hijacked IP space from the prison law library. But don't take my word for it; hit up the inmate locator on www.bop.gov...

-a

Christopher Morrow: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:00 GMT

On Apr 8, 2004, at 10:28 PM, John Reid wrote:

> At 01:08 PM 4/8/04 +0000, Chris Morrow wrote:
>> 1) how come there is no info for: ASN 12277 ?
>> (might be old news since it was behind: 3638 but is no longer)
>> 2) looking over:
>> http://www.completewhois.com/bogons/active_bogons.htm I
>> noticed there are several instances of AS701 listed announcing bogus
>> prefixes, really smaller allocations under some /16 announcements.
>> Where
>> are these smaller announcements coming from? I don't see them being
>> announced actually...
>
> Here's another bogon not mentioned by William...
>
> 192.44.0.0/19 AS702 AS702 MCI EMEA
>

This I'll check into.... no idea what the 702 folks are doing ;)

> Not hijacked... just empty space.
>
> And don't forget the one old hijacked -

Kai Schlichting & Little Punk: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:31:46 GMT

Kai Schlichting & Little Punk: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:31:47 GMT

Chris Morrow: Re: [Hijacked] Currently routed hijacked blocks list and suspicions about block 168.245.0.0/16

Fri, 24 Feb 2006 18:32:03 GMT

Items are limited to 0 lines via RSS.

Kai Schlichting & Little Punk: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:02 GMT

Kai Schlichting & Little Punk: Re: [Hijacked] Currently routed hijacked blocks list and suspicions about block 168.245.0.0/16

Fri, 24 Feb 2006 18:32:01 GMT

Items are limited to 0 lines via RSS.

Williamelan.Net: Re: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:31:48 GMT

Items are limited to 0 lines via RSS.

Chris Morrow: [Hijacked] 2 questions :)

Fri, 24 Feb 2006 18:32:03 GMT

Williamelan.Net: [Hijacked] Currently routed hijacked blocks list and suspicions about block 168.245.0.0/16

Fri, 24 Feb 2006 18:32:01 GMT

Items are limited to 0 lines via RSS.

Christopher Morrow: Re: [Hijacked] CAI Wireless netblock/asn: 205.159.72.0/24 was

Fri, 24 Feb 2006 18:32:00 GMT

Christopher Morrow: Re: [Hijacked] CAI Wireless netblock/asn: 205.159.72.0/24 was

Fri, 24 Feb 2006 18:31:46 GMT

Kai Schlichting & Little Punk: Re: [Hijacked] CAI Wireless netblock/asn: 205.159.72.0/24 was

Fri, 24 Feb 2006 18:31:47 GMT