Great Circle Associates List-Managers
(March 1999)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: list attacks
From: "Nathan J. Mehl" <memory @ blank . org>
Date: Sat, 20 Mar 1999 18:26:13 -0500
To: Joe Brennan <brennan @ watsun . cc . columbia . edu>, Benji Spencer <spunge @ spunge . org>
Cc: List-Managers @ GreatCircle . COM, majordomo-users @ GreatCircle . COM, postmaster @ apc . org, postmaster @ igc . org
In-reply-to: <CMM.0.90.4.921850124.brennan@watsol>; from Joe Brennan on Fri, Mar 19, 1999 at 08:28:44AM -0500
References: <CMM.0.90.4.921850124.brennan@watsol>

In the immortal words of Joe Brennan (brennan@watsun.cc.columbia.edu):
> 
> Are they coming from telmex.net.mx (I don't mean the From line, I mean
> the host sending them-- look at syslog)?  

BINGO.  One of the sites that I help maintain has been under _constant_
attack by this moron since the week before last.

We have over _12 Megabytes_ worth of majordomo logs showing the forged
subscribe requests from these twits.

It appears to be political in nature -- many of the addresses that he 
(they?) are forge-subscribing are in the apc.org and igc.org domains,
which are American left-ish groups with particular concerns about labor
and land issues in Latin America.  (May also have something to do with
their support of the Zapatista rebels in Chiapas, but that's just a
guess based on some of their addresses.)

We've tried to contact the responsible parties at the ISPs that the
attacks are originating from, but the language barrier has been 
problematic.  If there's anybody here who's fluent in Mexican-idiomatic
Spanish and has made contact with them, please contact me directly,
as we'd love to coordinate with you.


> I just saw more this morning, but for the first time not from
> telmex.net.mx.  And I think some of this morning's were probes to see
> what IPs we have blocked (we got all of telmex.net.mx's dialups) in
> preparation for more.  I'm going to study them shortly.

Yeah, they've been hopping between ISPs a lot.  We've got three seperate
class-B netblocks blocked already, and are hoping we don't eventually
have to end up blocking out all of .mx.

-n
 
------------------------------------------------------------<memory@blank.org>
And by / the phone / I live / in fear.
Sheer chance / will draw / you in / to here.                 (--Soul Coughing)
<http://www.blank.org/memory/>------------------------------------------------



Follow-Ups:
References:
Indexed By Date Previous: Re: list attacks
From: Joe Brennan <brennan@watsun.cc.columbia.edu>
Next: Re: list attacks
From: "Ronald F. Guilmette" <rfg@monkeys.com>
Indexed By Thread Previous: Re: list attacks
From: Joe Brennan <brennan@watsun.cc.columbia.edu>
Next: Re: list attacks
From: "Ronald F. Guilmette" <rfg@monkeys.com>

Google
 
Search Internet Search www.greatcircle.com