China - open proxies/relays, incorrect WHOIS data, bouncing role accounts, ignoring complaints... Rogue country - hopeless. Blocked using the china.blackholes.us database: http://blackholes.us/ Rogueness examples: http://www.DolphinWave.org/spam/CHINANET-BJ.txt http://www.DolphinWave.org/spam/CHINANET-HN.txt http://www.DolphinWave.org/spam/CHINANET-GD.txt http://www.DolphinWave.org/spam/CHINANET-ZJ.txt Update: 11-Feb-2005: Chinanet also blocks spam complaints. Update: 10-May-2005: Add to it guestbooks spamming now! China: Access denied - firewalled! === Bullet-proof spam hosting - is what China all about === Path: uni-berlin.de!fu-berlin.de!postnews.google.com!not-for-mail From: john@bel.bc.ca (Binary John) Newsgroups: news.admin.net-abuse.email Subject: Spam haven in China Date: 13 Jan 2005 10:50:40 -0800 Organization: http://groups.google.com Lines: 69 Message-ID: <80ad6a91.0501131050.768b812f@posting.google.com> NNTP-Posting-Host: 216.18.1.21 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Trace: posting.google.com 1105642240 32399 127.0.0.1 (13 Jan 2005 18:50:40 GMT) X-Complaints-To: groups-abuse@google.com NNTP-Posting-Date: Thu, 13 Jan 2005 18:50:40 +0000 (UTC) Xref: uni-berlin.de news.admin.net-abuse.email:2392780 I am posting an email I recently received in the hopes it will be read by the SPEWS team. As an ISP we are engaged in the battle against spam, and I was disheartened to get this. We have been bombarded by spam from this country, and now it seems they are setting themselves up as a haven for spammers. Dear Sir: We have just visit your web site. We are very interested in co-operating with you. We offer bullet proof web hosting & dedicated server. Benefits: If you want to promote your web site via commercial email, bullet proof web hosting is a must! As you may already know, many web hosting companies have Terms of Service (TOS) or Acceptable Use Policies (AUP) against the delivery of emails advertising or promoting your site. If your web site host receives complaints or discovers that your web site has been advertised in email broadcasts, they may disconnect your account and shut down your web site. We offer reliable bulk email friendly web hosting services. You can now have the peace of mind knowing that your web site is secure during your email marketing campaigns. We also offer bullet-proof dedicated servers. You control the content and administration of your server via root access. Fixed IPs or Dynamic IP Linux/Windows/Free BSD 1024MB RAM DDR P4 2.66GHz 36GB SCSI Unlimited Data Transfer Price: No setup fee US$ 599.00 for per month You can use the server for any of the following: Direct Bulk Mailing or Proxy Mailing Bulk Web Site Hosting Proxy, Relay or Port Scanning We also can customize your customer email addresses and send out your message for you. We have 220 million fresh email addresses. Our company is based in China. We are look forward to doing business with you. Best regards! Chan Pin Sales Support Sales@DNS8899.com BizBoosting@Yahoo.com Instant Messenger Support: ICQ: 339616524 Yahoo: BizBoosting AOL: Director20000 === Some WHOS data === $ host DNS8899.com DNS8899.com is an alias for bizok.vrserver.net. bizok.vrserver.net has address 218.86.52.25 $ jwhois 218.86.52.25 [Querying whois.apnic.net] [whois.apnic.net] % [whois.apnic.net node-1] % Whois data copyright terms http://www.apnic.net/db/dbcopyright.html inetnum: 218.85.0.0 - 218.86.127.255 netname: CHINANET-FJ descr: CHINANET Fujian province network descr: Data Communication Division descr: China Telecom country: CN admin-c: CH93-AP tech-c: CA67-AP mnt-by: MAINT-CHINANET mnt-lower: MAINT-CHINANET-FJ changed: hostmaster@ns.chinanet.cn.net 20020422 status: ALLOCATED NON-PORTABLE source: APNIC role: CHINANETFJ IP ADMIN address: 7,East Street,Fuzhou,Fujian,PRC country: CN phone: +86-591-3333169-293 fax-no: +86-591-3371954 e-mail: fjnic@fjdcb.fz.fj.cn trouble: send spam reports and abuse reports trouble: to abuse@fjdcb.fz.fj.cn trouble: Please include detailed information and trouble: times in UTC admin-c: FH71-AP tech-c: FH71-AP nic-hdl: CA67-AP mnt-by: MAINT-CHINANET-FJ changed: fjnic@fjdcb.fz.fj.cn 20020719 source: APNIC person: Chinanet Hostmaster address: No.31 ,jingrong street,beijing address: 100032 country: CN phone: +86-10-66027112 fax-no: +86-10-58501144 e-mail: hostmaster@ns.chinanet.cn.net e-mail: anti-spam@ns.chinanet.cn.net nic-hdl: CH93-AP mnt-by: MAINT-CHINANET changed: hostmaster@ns.chinanet.cn.net 20021016 remarks: hostmaster is not for spam complaint,please send spam complaint to anti-spam@ns.chinanet.cn.net source: APNIC $ jwhois DNS8899.com [Querying whois.internic.net] [Redirected to whois.OnlineNIC.com] [Querying whois.OnlineNIC.com] [whois.OnlineNIC.com] <...> Registrant: Qing Zhang emaildata@163.com +86.13860960133 Qing Zhang Beijing Beijing,Beijing,CN 100000 Domain Name:dns8899.com Record last updated at 2004-12-23 05:02:08 Record created on 2004/12/23 Record expired on 2005/12/23 Domain servers in listed order: ns1.dns-diy.com ns2.dns-diy.com Administrator: Name-- Qing Zhang EMail-: (emaildata@163.com) tel --: +86.13860960133 org: Qing Zhang Beijing Beijing,Beijing,CN 100000 Technical Contactor: Name-- Qing Zhang EMail-: (emaildata@163.com) tel --: +86.13860960133 org: Qing Zhang Beijing Beijing,Beijing,CN 100000 Billing Contactor: Name-- Qing Zhang EMail-: (emaildata@163.com) tel --: +86.13860960133 org: Qing Zhang Beijing Beijing,Beijing,CN 100000 Registration Service Provider: name: tel: +86.13860991301 fax: +86.13860991301 web:http:// === Chinanet blocks spam complaints === Path: uni-berlin.de!fu-berlin.de!newshub.sdsu.edu!tethys.csu.net !nntp.csufresno.edu!sn-xit-02!sn-xit-01!sn-post-01!supernews.com !news.supernews.com!not-for-mail From: Jeff Higgins Newsgroups: news.admin.net-abuse.email Subject: Chinanet Blocking Complaints Date: Thu, 10 Feb 2005 18:14:36 -0500 Organization: Posted via Supernews, http://www.supernews.com Message-ID: X-Newsreader: Forte Free Agent 1.93/32.576 English (American) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@supernews.com Lines: 38 Xref: uni-berlin.de news.admin.net-abuse.email:2399086 Looks like Chinanet abuse (anti-spam@ns.chinanet.cn.net) has had enough of my complaints ... ****************************** Hi. This is the qmail-send program at ns.chinanet.cn.net. I'm afraid I wasn't able to deliver your message to the following addresses. This is a permanent error; I've given up. Sorry it didn't work out. : Connected to 219.142.44.11 but greeting failed. Remote host said: 451 Audit system deny remote ip I'm not going to try again; this message has been in the queue too long. --- Below this line is a copy of the message. Return-Path: Received: (qmail 25918 invoked by uid 89); 10 Feb 2005 03:07:48 -0000 Delivered-To: ns.chinanet.cn.net-anti-spam@ns.chinanet.cn.net Received: (qmail 25907 invoked by uid 104); 10 Feb 2005 03:07:47 -0000 Received: from unknown (HELO mymailserver.com) (mailserver IP) by 0 with SMTP; 10 Feb 2005 03:07:47 -0000 Received: from localhost ([my client]) by mymailserver.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 9 Feb 2005 22:08:30 -0500 From: J Higgins To: anti-spam@ns.chinanet.cn.net (et al) Subject: **Chinanet Spam-Think 2008 Beijing** Occurrence #394 --> http://Zhang.wdre24-454.com/cs/?theman 219.153.14.34 ****************************** OK ... so they've received 394 complaints (1 for each occurrence) from me since 1/1/2005 ... I guess I can understand the block ... but lets not hear any talk about Chinanet cleaning up their spam problem ... Jeff === And add to it guestbooks spamming, my complaint === Received: from mail.dolphinwave.org ([192.168.0.253]) by mail.dolphinwave.org (8.13.1/8.13.1) with ESMTP id j4AC0SM2007770; Tue, 10 May 2005 15:00:30 +0300 From: Admin Organization: Private person To: abuse-May@2005.dolphinwave.org, nanas@killfile.org, hostmaster@ns.chinanet.cn.net, anti-spam@ns.chinanet.cn.net, postmaster@chinanet.cn.net, ctsummary@special.abuse.net, IPADM@PUBLIC.XA.SN.CN, PostMaster@pub.xaonline.com, postmaster@PUBLIC.XA.SN.CN, dengyan@ha.chinamobile.com, weichenguang@chinamobile.com, lidaiyong@chinamobile.com, info@chinamobile.com, security@chinamobile.com, abuse@chinamobile.com, postmaster@chinamobile.com, admin@chinamobile.com, limin@mail.fhnet.cn.net, ip_admin_hb@public.wh.hb.cn, spam_hb@public.wh.hb.cn, abuse_hb@public.wh.hb.cn, zhangyl68@public.wh.hb.cn, postmaster@wh.hb.cn, abuse@fjdcb.fz.fj.cn, abuse@bizcn.com, postmaster@bizcn.com, postmaster@cnmsn.net Subject: [misc] Guestbook spamming from China! (21down.cn, jfsky.com, jf228.com) Date: Tue, 10 May 2005 15:00:20 +0300 User-Agent: KMail/1.7.1 X-Complaints-To: abuse[@]dolphinwave[.]org (live person) X-PGP-key: 0xAAE2A579 X-PGP-key-fingerprint: 5B8E 3B28 7199 8CD3 4133 FA87 000B 0FB6 AAE2 A579 X-No-Confirm: Yes MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200505101500.21090@2005.dolphinwave.org> X-AntiVirus: checked by AntiVir Milter (version: 1.1.0-6; AVE: 6.30.0.12; VDF: 6.30.0.166; host: mail.dolphinwave.org) X-Loop: dev.null@dolphinwave.org X-IMAPbase: 1113180229 706 Status: R X-UID: 706 Content-Length: 3762 X-Keywords: X-Status: NC X-KMail-EncryptionState: X-KMail-SignatureState: X-KMail-MDN-Sent: China! I had enough of this unstoppable abuse from your networks, and you ignoring it. I have no other option to protect my networks than to firewall you completely! Enjoy your intranet! ======= Guestbook spamming was (GMT+0300) ======= name = aaaa mail = icq = aim = yim = msn = location = 5 url = http://www.21down.cn text = QQ下载 注册机声色图库 破解游戏外挂软件下载
破解软件 电子书杀毒软件 大型软件 行业软件黑客软件
下载软件下载下载[link=http://www.jfsky.com]破解软件下载 date = 05.10.2005 14:14 ip = 219.144.216.219 Spammer: 219.144.216.219 <== CHINANET shanxi (CHINANET-SN) Date: 10-May-2005, 14:11:58-14:14:25 (GMT+0300) Spamvertised web pages: www.jfsky.com [211.142.183.37] <== China Mobile (CMNET-henan) www.21down.cn [219.139.58.230] <== CHINANET hubei (CHINANET-HB) www.jf228.com [211.142.183.37] <== China Mobile (CMNET-henan) Spammers' nameservers: bizcn.com, cnmsn.net Spammer got to my guestbook explicitly looking for guestbooks to spam, from the Google search, as can be seen from my webserver logs (GMT+0300): 219.144.216.219 - - [10/May/2005:14:11:56 +0300] "GET /Guestbook/guestbook.php HTTP/1.1" 200 14836 "http://www.google.com/search?q=inurl:guestbook/guestbook.php+&hl=zh-CN&lr=&newwindow=1&start=630&sa=N" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 219.144.216.219 - - [10/May/2005:14:11:58 +0300] "GET /Guestbook/guestbook.css HTTP/1.1" 200 2808 "http://www.dolphinwave.org/Guestbook/guestbook.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 219.144.216.219 - - [10/May/2005:14:11:58 +0300] "GET /Guestbook/gif/lustig.gifHTTP/1.1" 200 375 "http://www.dolphinwave.org/Guestbook/guestbook.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" <...> 219.144.216.219 - - [10/May/2005:14:14:09 +0300] "POST /Guestbook/guestbook.phpHTTP/1.1" 302 1 "http://www.dolphinwave.org/Guestbook/guestbook.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 219.144.216.219 - - [10/May/2005:14:14:17 +0300] "GET /Guestbook/guestbook.php?act=show HTTP/1.1" 200 15581 "http://www.dolphinwave.org/Guestbook/guestbook.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" 219.144.216.219 - - [10/May/2005:14:14:25 +0300] "GET /Guestbook/gif/icq.gif HTTP/1.1" 200 366 "http://www.dolphinwave.org/Guestbook/guestbook.php?act=show" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" === On blocking Chinese IP addresses === === http://www.theregister.co.uk/2005/08/31/blocking_chinese_ip_addresses/ === === QUOTE === On blocking Chinese IP addresses By Scott Granneman, SecurityFocus (feedback at theregister.co.uk) Published Wednesday 31st August 2005 07:19 GMT Comment In the 1980s, I was unbeatable in Trivial Pursuit, and to this day, I still possess a love of trivia. Here's some neat facts about the Great Wall of China. Did you know... * The Great Wall sprawls more than 1500 miles in length. * You can see the Great Wall from low orbit, but not from the Moon (urban legend!). * With the materials used to build the Great Wall, you could build 120 Egyptian pyramids, or a six inch tall wall completely around the equator. * At its peak, one of every 3 Chinese men was busy building the Great Wall. * You know what Richard Nixon said when he was in China and was taken to the Great Wall? "I think that you would have to conclude that this is a great wall." It's true! Recently I was thinking about China again when I heard two stories from friends that sounded eerily similar. In both cases, web servers were hacked due to a vulnerability in home-grown PHP apps, and after the inevitable (and always painful) server rebuilds, a new attention to security in totum was now observed. Unnecessary services were disabled, all scripts and third-party apps were carefully audited, and user privileges were tightened with a lug wrench. As part of the new attention to security, the admins began to pay close attention to the web server's access and error logs, and what they saw astonished them. Their web servers were pounded constantly by requests for proxy services - and they weren't running proxies. Their web servers were asked, every few minutes, to run CGI scripts - and there weren't any CGI scripts on the machines. Requests for directory indexes came in fast and furious, and yet directory indexing was shut off. Someone was asking, over and over again, for files that didn't exist - files with really weird, suspicious names. (I'm sure many of you are going to leave comments below saying "What idiots! How painfully obvious! Only a fool would be surprised by this stuff!" You may very well be correct in all three statements, but that still doesn't mean that many, many people do not know this stuff, and need to be educated about it.) Even more interesting, the vast majority of these highly shady requests were coming from machines in China. The IP addresses ranged all over the map, but every time WHOIS was run on them, back came a block in China. Eventually, it seemed like every province in China was involved, as this fragmentary list shows: * Oriental Cable Network Co., Shanghai * China Guangdong Province Network * China Fujian Province Network * China Hubei Province Network * China Beijing Province Network * China Hangzhou Node Network * Shanghai sichuanshengpenganxianjianyezonggongsi Co., Ltd * China Anhui Province Network * China United Telecommunications Corporation, Xicheng District, Beijing, China * China Jiangmen Broadband Network And on and on. Both of my friends thought about their situations, and both came to the same conclusion: block the entire IP ranges! Use WHOIS to look up the IP address' range, then block 'em with the server's firewall. This quickly grew into a mammoth, seemingly neverending task, but it immediately began to pay off. Fishy web server requests tapered off greatly, and while there are still a few every day, it's now become a manageable problem. If things keep up at the same pace, sometime in the next few months they're going to have blocked every IP in China. As Korean IPs pop up in the error log, those get blocked as well. And what about Taiwan? Russia? India? And more? First, let's look at why China is such a problem. Well, to my mind, there are several potential causes for the flood of Chinese hackerish web requests. New users. The middle class in China is growing (http://news.bbc.co.uk/1/hi/world/asia-pacific/3732914.stm), and since many, many computers are made in China (http://www.lenovo.com/news/ca/en/2005/08/081005q1results.html) and are therefore inexpensive, it's not surprising that more and more Chinese are buying PCs (http://www.technewsworld.com/story/39010.html). Unfortunately, Chinese citizens are about as well-trained and about as security conscious as typical citizens in Western nations ... which means, not at all. One of my friends would always scan the IP addresses of the Chinese machines targeting him, and he reported that those machines invariably were riddled with hacker tools and open ports. Were the owners of these machines even aware that their computers were being used to attack other machines? Who knows? And what's the Chinese word for "owned"? Chinese hackers. I have no doubt that there are gangs of Chinese hackers - whether employed by the government, organized crime, or freelance - that are working as hard as they can to take over computers around the world for all sorts of nefarious purposes. They're just like hacker gangs anywhere else in the world. Spam networks, phishing, DDOS attacks: it's all being done. There was a recent TIME magazine article (http://www.time.com/time/magazine/printout/0,8816,1098961,00.html) about Chinese hackers that I found hysterical in tone and factuality, but the overall message of the piece rings true to me. When they told me what they had done - independently, mind you, of each other - I asked them the same question: did you tell your web hosting clients? In both cases, they said they had not. In fact, one told me, "I'm hosting the web site of the local professional society, for instance, and there is absolutely no reason for anyone in China to access that site. I'm also hosting a site for nurses. Why would someone in China need that? I can't think of any clients who have content that a person in China would need to see. OK, I take that back. I have two churches on there, and maybe, maybe, a missionary or someone like that in China would want to access their sites. In that case, I figure that the church will get contacted, and then I'll get contacted, and at that time I'll allow access for that specific IP. But that's it. Anyone else in China - screw 'em." I don't know what to think about that attitude. On the one hand, I can understand his frustration, and his logic makes sense... to a point. If none of his clients have web sites that someone in China has a good reason to access, then maybe it's OK to block them. On the other hand, how can he be so sure? And should it really be up to clients to have to figure out that over a billion Chinese can't access their sites? Should he tell his clients? Perhaps what his clients don't know will help keep them from getting confused. Then there's also the legality of taking action against a hacker who has compromised a machine, after all the heavy forensics are done. It's hard enough to convince law enforcement to followup on a cyber crime; it's harder still when the hacker lives in another country. Blocking Chinese IP address ranges is one thing, but going further and blocking every country except where your organization (or client's organization) does business becomes a slippery slope very fast. Here's a good question. What needs to come first: the needs of the web servers my friends run, or the needs of a guy sitting in Shanghai that wants to view the content of that web site? I'm not sure if the Chinese government even realizes the extent of the problems coming out of its IP space, or if it even cares. But if things don't improve sometime soon, Chinese Net users may find that they have more than just the government's odious Great Firewall (http://en.wikipedia.org/wiki/Internet_censorship_in_China) to deal with; instead, they may be faced with millions of firewall blocks all over the world. So tell me, and I'll pass your thoughts along to my friends: what should they do? Copyright © 2005, SecurityFocus (http://www.securityfocus.com/) Scott Granneman is a senior consultant for Bryan Consulting Inc. in St. Louis. He specializes in Internet Services and developing Web applications for corporate, educational, and institutional clients. Related stories Chinese cyber-dissident jailed (3 August 2005) http://www.theregister.co.uk/2005/08/03/china_internet/ China signs anti-spam pact (4 July 2005) http://www.theregister.co.uk/2005/07/04/china_spam/ Geeks should 'outsource themselves' - Mongolian BoFH (24 June 2005) http://www.theregister.co.uk/2005/06/24/doctor_john_outsource/ 'Disgust' as Microsoft censors Chinese blogs (14 June 2005) http://www.theregister.co.uk/2005/06/14/microsoft_disgust/ Verizon faces lawsuit over email blocking (21 January 2005) http://www.theregister.co.uk/2005/01/21/verizon_class_action/ China's IT: an inside outsider's view (17 November 2004) http://www.theregister.co.uk/2004/11/17/letter_piracy_china/ Chinese Government nets 'Internet Villain' gong (12 November 2004) http://www.theregister.co.uk/2004/11/12/futur_awards/ China urges ISPs to sign 'self-disciplinary' pact (21 June 2004) http://www.theregister.co.uk/2004/06/21/china_pact/ IT giants fingered over links to China (4 December 2003) http://www.theregister.co.uk/2003/12/04/it_giants_fingered_over_links/ © Copyright 2005 === QUOTE END ===