25 Oct 2003

16 Sep 2003

05 Sep 2003

30 Jul 2003

26 April 2003

12 April 2003

25 Mar 2003

20 Jan 2003

Squidefender responses

From:abuse [at] ihug [dot] com [dot] au
Sent: Friday, August 01, 2003 15:12
Subject: Re: Attack on our proxyserver

Dear Sir/Madam,

The end-user involved has been identified and notified that they
have a virus, and have cleaned their computer.

As a side note, a courteous message stating "a user of yours
may be unknowingly infected with code red and we'd
appreciate if you tell them" would have been much better than
pages of threats about legal action.

Play nice in future.

-- 

Kind Regards
ihug Abuse Team

From: Mohammad Mahbub Hasan Milton
Sent: Friday, August 01, 2003 02:40
Subject: Re: Attack on our proxyserver

Dear Sir/Madam,

We have taken steps about that. If the the problem still please mail us.

Thanking You,
Mohammad Mahbub Hasan Milton
Jr. System Admin
Link3 Technologies Ltd.

At 08:57 AM 7/31/2003 -0700, Sajjid Pasha wrote:
> IP: 203.76.104.18 IS INFECTED WITH CODE RED VIRUS AND REQUIRES
> IMMEDIATE ATTENTION FROM THE NETWORK CENTER STAFF TO REMOVE THE
> MACHINE FROM THE NETWORK AND CLEAN THE MACHINE WITH MICROSOFT PATCHES
> FOR BOTH CODE RED 1 AND 2
[snip CodeRed info from their internal mail.]

From: nasiruc
Sent: Wednesday, July 02, 2003 01:20
Subject: Re: Attack on our proxyserver

Dear Mr. J. Waale,

We are very sorry to spreading virus frm our
node....According to your mail
we have cleaned our node.

It is really appreciable your awareness regarding virus...
and help us not to spread more virus over the Internet.

Again we are apologized for spreading virus over the Internet .

Rgds
Nasir

From: World Wide Web Owner On Behalf Of Aaron Smith via RT
Sent: Wednesday, April 30, 2003 02:10
Subject: [calpop.com #641] IPs has been taken care of

we have handled all customers that have been spamming from the
following IP blocks 216.240.* 209.223.*

From: World Wide Web Owner On Behalf Of Lynn Hoover via RT
Sent: Monday, April 14, 2003 02:42
Subject: [calpop.com #524] Attack on our proxyserver

I have requested a null route which will be put in place on
this IP as soon as our Router Administrator gets a chance today.

I am sorry that your network was attacked by this and we will track
down this user and kick him off the network.

Lynn Hoover

From: Knox Wimberly
Sent: Friday, March 21, 2003 05:26
Subject: Re: Attack on our proxyserver

This downstream customer has been notified and has assured us he has
patched his system to prevent this.

Please let me know ASAP if you see any further activity of this sort.

Knox Wimberly
SmartWeb, LLC

From: ServInt Admin
Sent: Friday, March 21, 2003 04:32
Cc: Network Operations
Subject: Re: Attack on our proxyserver

Dear sir,

After thorough investigation, we have discovered that the attacks did
indeed originate from a box on the ServInt network which belongs to one
of our clients. We believe the attack came as a result of an unpatched
server that needed to be updated in order to prevent misuse by outside
forces. This box is now being patched and the activity should not
reoccur. Obviously, ServInt does not condone such network-unfriendly
activity. If you experience any further problems, please let us know
and we will act quickly to make sure that they get permanently resolved.


Christian J. Dawson

Network Abuse Manager
ServInt Internet Services

From: Network Operations Center
Sent: Friday, March 21, 2003 02:53
Subject: Re: Attack on our proxyserver

Hi,

I have already forwarded this issue to our admin department.  They deal
with these type of issues for our company.  Please direct any future
inquiries to admin@servint.com rather than noc@servint.com.

-Chris
-ServInt NOC

From: AntiSpam
Sent: Thursday, February 13, 2003 16:54
Subject: RE: Attack on our proxyserver

Dear Sir/Madam,

Thanks for your notifying

203.187.55.51  is one of our user.

We  have been informed him/her and asked to solved this problem
as soon as possible(maybe due to virus--Nimda or CodeRed).

If he still do nothing to protect his computer system from virus
attacked

According to the contract , we will stop his internet access
after certain evident collected.

Sorry for bothering you.

Gigamedia Service Center

Sent: Tuesday, February 11, 2003 23:04
Subject: Re: Attack on our proxyserver

          Dear colleague,

          thank you for reporting this to us.

>The following lines from the squid log file validate
>the abuse of our host (pwc.com.kh) by 130.235.61.197:
>1044940410.033 1 130.235.61.197 TCP_DENIED/403 977 CONNECT 
> mx0.gmx.net:25 - NONE/- -

          Lund university take incidents like this very seriously and
          we will investigate the incident as soon as possible. The
          computer is owned by a student and connected on one of our
          residential netsworks.

          Sincerely,
               Magnus Persson

Sent: Sunday, February 09, 2003 06:36
Subject: Re: Attack on our proxyserver

I will terminate this customer immediately..

Lynn

203.162.7.214 is a dialup IP so that we can not control that machine.
Thank you for information.

Dear sir/madam,
Thank you for the Information. We have investigated and may inform you
that the IP address is an modem for user dial-up connecting. Maybe the
PC of this user is infected.
Thank you for collaboration.
Best regards
Do Ngoc Uan

From: Mitex Service/Support
Sent: Friday, January 24, 2003 12:14
Subject: Re: Attack on our proxyserver

Hi

I am so sorry if this have cause any problem.

The IP address is used on our public network, users have agree to not
make any illegal access.  We have not any legal way by the Swedish law
to make active control what an user are doing on there connection. But
this your information is taken seriously and appropriate action will be
taken. The problem is we must follow the Swedish law and in some cases
this is not compatible with other countries law.

Please let us now if this is an continuing problem, as we just now can
tell the user this cant be repeated. If it happens again then we have to
close your address down.

Even we accept the problem we cant accept the way you are telling us
about the problem.  You write:
>"Scanning for open ports on any system that not legally belong to you
>or are under your supervision is a criminal act."

We are very well aware abut how the Internet works, you dont need to
be sarcastic.

We have 500 user on our network, we cant or we are not allowed to
control what the user is doing on the Internet, we can only take
action when there an user have made some non legal action to an other
site on Internet.

Regards

Charlie G Mentores
System manager at Mitex.net(WORK)