atom feed46 messages in edu.merit.nanogRe: US DOJ victim letter
FromSent OnAttachments
Jay HenniganJan 19, 2012 12:59 pm 
Michael HareJan 19, 2012 1:01 pm 
Tim JacksonJan 19, 2012 1:02 pm 
Dave EllisJan 19, 2012 1:03 pm 
Jay HenniganJan 19, 2012 1:04 pm 
Michael J McCaffertyJan 19, 2012 1:04 pm 
MLJan 19, 2012 1:05 pm 
Randy CarpenterJan 19, 2012 1:05 pm 
Alan CleggJan 19, 2012 1:08 pm 
Andrew D. DibbleJan 19, 2012 1:15 pm 
Chris AdamsJan 19, 2012 1:16 pm 
Chris AdamsJan 19, 2012 1:18 pm 
Lane PowersJan 19, 2012 1:27 pm 
PCJan 19, 2012 1:33 pm 
Carlos AlcantarJan 19, 2012 1:34 pm 
Simon LockhartJan 19, 2012 1:35 pm 
Todd LyonsJan 19, 2012 1:37 pm 
Ryan GelobterJan 19, 2012 2:36 pm 
-Hammer-Jan 20, 2012 6:06 am 
Mike AndrewsJan 20, 2012 6:55 am 
Robert BonomiJan 20, 2012 11:05 am 
Carlos AlcantarJan 27, 2012 10:11 am 
Bryan Horstmann-AllenJan 27, 2012 10:16 am 
Randy EpsteinJan 27, 2012 10:20 am 
MikeJan 27, 2012 10:21 am 
Vald...@vt.eduJan 27, 2012 10:22 am 
Randy EpsteinJan 27, 2012 10:31 am 
Carlos AlcantarJan 27, 2012 10:45 am 
Sean DonelanJan 27, 2012 10:52 am 
Jon LewisJan 27, 2012 12:22 pm 
Harry HoffmanJan 27, 2012 12:29 pm 
Martin HanniganJan 27, 2012 7:19 pm 
bman...@vacation.karoshi.comJan 28, 2012 8:30 am 
John PeachJan 28, 2012 8:39 am 
Ryan GelobterJan 28, 2012 7:11 pm 
Jack BatesJan 30, 2012 7:53 am 
Matthew S. CrockerJan 30, 2012 7:55 am 
Carlos AlcantarJan 31, 2012 2:30 pm 
Phil DyerJan 31, 2012 4:38 pm 
Ryan PavelyJan 31, 2012 4:43 pm 
Ronald BonicaJan 31, 2012 5:29 pm 
Carlos AlcantarJan 31, 2012 6:52 pm 
TFMLFeb 1, 2012 7:32 am 
PCFeb 1, 2012 11:53 am 
Robert E. SeastromFeb 2, 2012 2:57 am 
bman...@vacation.karoshi.comFeb 2, 2012 3:22 am 
Subject:Re: US DOJ victim letter
From:PC (paul@gmail.com)
Date:Feb 1, 2012 11:53:31 am
List:edu.merit.nanog

I received one on an IP block that were SWIPed to me.

Has anyone written a regular expression which matches the rogue dns server IP ranges in question?

- 85.255.112.0 through 85.255.127.255; - 67.210.0.0 through 67.210.15.255; - 93.188.160.0 through 93.188.167.255; - 77.67.83.0 through 77.67.83.255; - 213.109.64.0 through 213.109.79.255; - 64.28.176.0 through 64.28.191.255;

On Wed, Feb 1, 2012 at 8:32 AM, TFML <mail@theflux.net> wrote:

If the IP list is pointing to DNS servers, they maybe referring to the following:

http://www.us-cert.gov/reading_room/DNS-recursion033006.pdf

On Jan 31, 2012, at 7:38 PM, Phil Dyer wrote:

On Fri, Jan 27, 2012 at 3:23 PM, Jon Lewis <jle@lewis.org> wrote:

On Fri, 27 Jan 2012, Bryan Horstmann-Allen wrote:

Bit odd, if it's a phish. Even more odd if it's actually from the Fed.

It's definitely real, but seems like they're handling it as incompetently as possible.

Yep. That sounds about right.

Man, I'm feeling left out. I kinda want one now.