- swinog - vmaill01.sys

planned ddos - alert
by Pascal Gloor 24 Jul '21

24 Jul '21

Dear SwiNOG, We (Init7) expect a >100Gbps ddos this Thursday or Friday. The attack will be directed against a transit customer of ours and will be the 2nd attack from this known group against this customer. Please make sure you’re not a source and keep an eye on your graphs Thanks! Pascal

2 1

##### SwiNOG #37 - Call for Papers #####
by Simon Ryf 22 Jul '21

22 Jul '21

Dear SwiNOG community, Please forward me to whomever you think should now about our community. This is the official Call for Paper email. Please submit your proposal via https://www.swinog.ch/cfp/ The 37th meeting of the Swiss Network Operators Group (SwiNOG) will be held in Berne on top of the Gurten on Thursday December 2nd 2021. Important Dates for https://www.swinog.ch/meetings/swinog37/: 23.07.2021 Call for Papers 01.10.2021 Registration opens 31.10.2021 Call for Papers closing 15.11.2021 Final publication of agenda 25.11.2021 Registration closes 26.11.2021 Deadline for all slides 02.12.2021 Meeting day Topics for Presentations/Talks Please re-submit your paper if you're still up with a topic which you have submitted during … yeah whatever you call this period…! The number and length of presentations per session is not fixed, although we prefer the length of the presentations to be between 5 to 45 minutes. Here is a non-exhaustive list of typical SwiNOG meeting topics: * Security, DDOS Mitigation, * IPv6 * Open-Source tools and interesting Github projects * International view of the internet (incidents, outages, measurements) * Routing * Peering * Server applications (DNS, Web, etc.) * Legal issues (BÜPF, etc.) * Telecommunication politics (Net Neutrality, Incumbent monopoly, etc.) * Off-Topic if you think the audience will enjoy * Feel free to talk to us about any kind of topic and collaboration! Or you can always start a discussion on the list - I'm sure people join in. Or join our telegram group at https://t.me/SWINOG Language of Slides and Talks The whole day will be hold in English, therefore we kindly ask you to produce your presentation in English. Submission Guidelines All submissions must have a strong technical bias (or be completely off topic) and must not be promotional for your employer. Please remember that your presentations should be suitable for a target audience of technicians from varied backgrounds, working for companies whose sizes may vary considerably. To submit a proposal for a presentation, we request that you to fill in the form at https://www.swinog.ch/cfp/ We also welcome suggestions for specific presentations which you feel would be valuable to the SwiNOG community. Please be aware that your presentation will be published on the SwiNOG website after the event. We can publish modified slides if requested - it might be that some confidential data will be presented by you which are not intended for publication on the internet. Greetings, Simon SwiNOG Core Team General Information (SwiNOG Community) The Swiss Network Operators Group (SwiNOG) is an informal group of people who are concerned with engineering and operation of the Swiss Internet. SwiNOG exists to enhance the quality of Internet services available in Switzerland. It does this by fostering the free exchange of technical ideas and information between different companies and organisations. SwiNOG is a community for professionals who are operating, designing or researching the Internet. It provides a technical forum where those working on, with and for the Internet can come together to solve problems with every aspect of their (net)work. The meeting is designed to provide an opportunity for the exchange of information among network operators, engineers, researchers and other professionals close to the network community. More information about SwiNOG can be found at http://www.swinog.ch/, Facebook, Xing, Information about the meeting will be published at http://www.swinog.ch/meetings/swinog37/ General Information (SwiNOG Organisation) The SwiNOG Organisation Association is a non-profit association under article 60 and further of the swiss civil law. It manages the SwiNOG community ressources (domain, web, mailing-lists, etc..) and organises SwiNOG meetings. Contact: SwiNOG Organisation 8000 Zurich Switzerland

1 0

[FYI] Call for Presentations for the virtual European Peering Forum 2021
by Arnold Nipper 13 Jul '21

13 Jul '21

Dear all This is a call for Presentations for the virtual European Peering Forum 2021 AMS-IX, DE-CIX, LINX, Netnod are happy to host the virtual European Peering Forum (EPF) 2021 from the 20th - 22th September 2021. The event will welcome peering managers and coordinators from networks connected to the host Internet exchanges. Besides some interesting topical agenda, the three-day event accommodates room for attendees to meet virtually on a one-to-one basis to discuss bilateral peering business opportunities. The programme committee will be looking for presentations related to peering and technical topics of interconnection. Your presentation should address * Interconnection Automation * Regional Peering * Interconnection / Peering Internet Governance and Regulatory Topics * Economic and Product Trends * Peering / Interconnection strategies * Interesting findings about Peering / Interconnection * 400GE and beyond * Any other hot topic related to Interconnection / Peering Submissions =========== Presentations must be of a non-commercial nature. Product or marketing-heavy talks are strongly discouraged. Submissions of presentations should be made to the programme committee <epf-pc(a)peering-forum.eu>. Please include: * Author's name and e-mail address * Presentation title * Abstract * Slides (if available) * Time requested (max. 30 minutes incl. Q&A) Deadlines ========= Please send in your presentation asap. We decide on a first come first serve basis. The latest date for submission is July 30th. More information about the event and other activities around the virtual EPF 2021 may be found at * https://peering-forum.eu/ * https://www.facebook.com/groups/1586607564933665/ Cheers Arnold -- Keep calm, keep distance, keep connected! Arnold Nipper email: arnold(a)nipper.de mobile: +49 172 2650958

1 0

Swisscom (Emergency) Phone Outage Post-Mortem
by Tobias Brunner 12 Jul '21

12 Jul '21

Hi all, Does anyone see a chance to get hands on the post-mortem they (hopefully) write about the phone outage from last week? I'm very interested in technical details, as I always feel that from such stories we can all learn and improve. Cheers, Tobias

2 1

Geldspielgesetz: 404 COMLOT renamed to GESPA? (or did they get hacked!?)
by Jeroen Massar 07 Jul '21

07 Jul '21

Hi Folks, Is there an official announcement that I missed? Seems that blocklist.gespa.ch is the new place, and that all of comlot.ch now points to gespa.ch, but filenames have been renamed too. (see previous brokeness email in the mailarchive for old details). Considering neither is under admin.ch, cannot really say it is an official website either. Anybody got an official update about this, or did they just break the system again? Cannot find any duckduckgoogle references either. Why did Swiss Voters vote for this broken system if it is not working anyway? (it is not, because otherwise it is a perfect list to find your casinos that are 'illegal' or something).... All those poor* casino users that now have access to a bunch of unlicensed casinos... what a sad day again. Greets, Jeroen * = as the house always wins ----- $ wget -v https://blacklist.comlot.ch/blacklist.comlot.ch.pub --2021-06-03 08:21:02-- https://blacklist.comlot.ch/blacklist.comlot.ch.pub Resolving blacklist.comlot.ch (blacklist.comlot.ch)... 194.187.88.5 Connecting to blacklist.comlot.ch (blacklist.comlot.ch)|194.187.88.5|:443... connected. HTTP request sent, awaiting response... 301 Moved Permanently Location: https://blocklist.gespa.ch//blacklist.comlot.ch.pub [following] --2021-06-03 08:21:03-- https://blocklist.gespa.ch//blacklist.comlot.ch.pub Resolving blocklist.gespa.ch (blocklist.gespa.ch)... 194.187.88.5 Connecting to blocklist.gespa.ch (blocklist.gespa.ch)|194.187.88.5|:443... connected. HTTP request sent, awaiting response... 404 Not Found 2021-06-03 08:21:05 ERROR 404: Not Found. ----- It seems the "official specification" (comlot.ch redirects is gone): https://www.gespa.ch/download/pictures/9a/e78461lvxuzcv82c505b1kpckd58pf/sp… still have blocklist.comlot.ch in it. Except for the URL itself, Google also finds nothing about this: https://www.google.com/search?hl=en&q=%22blacklist.gespa.ch%22 $ dig +short comlot.ch 194.187.88.3 $ dig +short comlot.ch aaaa <none> $ dig +short comlot.ch mx 10 mx.cmsbox.com. $ dig +short comlot.ch ns ns3.netstyle.ch. ns1.netstyle.ch. ns2.netstyle.ch. $ dig +short gespa.ch a 194.187.88.3 $ dig +short gespa.ch aaaa 2a00:c38:2:9f62::2:3 dig +short comlot.ch mx 10 mx.cmsbox.com. $ dig +short gespa.ch ns ns3.netstyle.ch. ns2.netstyle.ch. ns1.netstyle.ch. I also gotta love the generic wildcard Let's Encrypt cert, though comlot.ch did that too https://crt.sh/?q=gespa.ch https://crt.sh/?q=comlot.ch Looks like a rather generic hoster. Maybe the whole domain got hacked?

2 2

Cloudflare DMCA Takedown requests - but content not present under mentioned IP
by Benoit Panizzon 06 Jul '21

06 Jul '21

Dear List I am a bit puzzled by repeated Cloudflare Takedown Requests regarding the domain: lord-film.cash we are getting. lord-film.cash has address 172.67.181.230 lord-film.cash has address 104.21.32.5 lord-film.cash has IPv6 address 2606:4700:3035::6815:2005 lord-film.cash has IPv6 address 2606:4700:3032::ac43:b5e6 According to Cloudflare, the content is hosted at an IP address under our control, on a Webserver on Port 80. I told them some time ago, there is no Webserver running under the IP address they mention. They replied, they could verify the IP with: curl -v -H "Host: lord-film.cash" [IPADDRESS]/ Still, every time I try, I don't get a connection. No wonder, that is a NAT router with Firewall. So I wonder, if either the user of that IP Address has cleverly set up a firewall which blocks all requests not via Cloudflare proxies, or if this domain uses some kind of P2P Protocol and the IP of that user is just one of 'many' which is only reachable, when some P2P tool is running and opening a UPNP Port. When I try to access the site itself: http://lord-film.cash/ I get 'access denied' from Cloudflare. Do others get similar takedown notices? Maybe even for that same domain? Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

5 5

sendinblue / newsletter sender whitelisting?
by Michael Koloff 01 Jul '21

01 Jul '21

Hello Together Question for mail infrastructure operators: In the last weeks we had requests from customers, whose "newsletter" via sendinblue could not be delivered to us. In the logs I see at the given time, that the IP of sendinblue was on the blacklist of spamcop.net. That is, the mails were rejected by us. The customer now says the mails go through everywhere else (I'm looking at you bluewin.ch), just not with you. sendinblue suggests to whitelist their IPs (> 100'000 ip addresses) (https://help.sendinblue.com/hc/de/articles/208848409-SendinBlue-IP-Bereiche) Of course I would like to avoid this. Question: How do other providers deal with such senders? Let everything from sendinblue through for the sake of the customers? Thanks for your answers. -- Michael Koloff sasag Kabelkommunikation AG

2 1

MELANI BGP Blackhole Service
by Fredy Künzler 29 Jun '21

29 Jun '21

A customer (!) pointed us to the MELANI BGP Blackhole Service which has been around for almost two years, apparently. For technical details see the attached file. Are we the only ones not aware of it? I don't recall an official announcement by the MELANI team in this list or elsewhere in the community, and as far as I know it hasn't been discussed yet within SwiNOG. While the technical implementation seems to be rather simple - an eBGP multihop session to the IP address mentioned (hosted by nine.ch), a number of legal, operational and political questions are remaining: - no IPv6 implementation, no backup (2nd) host - how is the list of IP addresses maintained? Is there a regular check and removal procedure of no-longer-botnet-addresses? - is there any guarantee that the infrastructure will never be abused for (state) censorship? - how to implement it only for end users which do want the service while not distributing the black holes in the whole backbone - and, last but not least, why MELANI team or the so called "Outreach Team vom Bund" (Quote customers email) never told the SwiNOG community about the idea? Instead, they are suggesting strange things: "Gemäss outreach, ist das bei Init7 nicht möglich da dieses gegen eure Policy verstosst?" I suppose MELANI and the "Outreach Team vom Bund" should give some explanations. They do know where to find the SwiNOG community, and their style of (non-)communication is not acceptable. -- Fredy Künzler Init7 (Switzerland) Ltd. Technoparkstrasse 5 CH-8406 Winterthur https://www.init7.net/

1 0

more S3
by Eliot Lear 28 Jun '21

28 Jun '21

Colleagues, Sorry for the terse note earlier (I hit the wrong key). In any case, I was seeing latency of anywhere from 89-300ms earlier from two vantage points- Cablecom, where it is still a bit of an issue, and Datasource, where it is now clearing. Eliot

1 0

S3 problems?
by Eliot Lear 28 Jun '21

28 Jun '21

Is anyone else seeing high latency to S3 today?

1 0

Hardware for sale
by solutions＠datawire.ch 25 Jun '21

25 Jun '21

Hey guys, We have some hardware to sell from a customer: Sophos SG 115 Sophos SG 105 Cisco Catalyst 3560 PoE 8 Port Cisco Catalyst 4506 * WS-4516-10GE * WS-X4548-GB-RJ45 (2x) * 2x PSU Cisco Catalyst 4506-E * WS-X45-SUB6-E * WS-4606-X2-E * 2 PSU Netapp FAS 3240 (2x) * 2 Filer Netapp DS4243 (4x) * 24x 2TB Netapp FAS 3140 * 2 Filer Netapp DS14 MK4 (4x) * 14x 450GB If interested, please contact me by e-mail. Vielen Dank & freundliche Grüsse Sebastian Hecht ___________________________ DATAWIRE AG Chamerstrasse 42, 6331 Hünenberg Tel. +41 41 728 09 99 E-Mail: <mailto:solutions@datawire.ch> solutions(a)datawire.ch Website: <https://datawire.ch/> https://datawire.ch

1 0

Fibrechannel Hardware for sale
by Adrian Kägi 23 Jun '21

23 Jun '21

Good day Guys We have in our Stock several fibre channel Switches for sale: See the short Inventory: 2x Brocade 5100 - 24Ports Licensed 4x HP StorageWorks 8/24 2x Brocade 300 24 Port Several SFPs for vendors above All the Switches are "Enterpise Licensed"! If you need spare parts for your existing FC Fabric, need a expensive door stoper or enrich your home office, please contact me OL. Also for further technical and financial details. Have a nice day! Cheers Adrian

1 0

Fwd: Coop.ch geoblocking?
by Serge Droz 23 Jun '21

23 Jun '21

Hi all It seems there is a SWINOG member who should clean his computer. Happy hunting Serge -------- Forwarded Message -------- Subject: Re: [swinog] Coop.ch geoblocking? Date: Mon, 21 Jun 2021 17:57:11 +0200 From: Roger <in3days(a)in3days.org> Reply-To: Roger <in3days(a)in3days.org> To: Serge Droz <s.droz(a)protonmail.ch> Good day! We mail document to you again. You can discover it at the link lower: annanigrodermatologia.it/mac-lesch/s_droz-80.zip > Hoi Roger > > ich denke nur das diese unterdrückung von unerwünschten > meinungen falsch > ist . > Das sehe ich auch so. Aber das macht Coop > ja nicht. > und im sinne coop finde ich es erstens nutzlos und > zweitens bedenklich > wenn man security probleme mit regionalesn > beschänkungen zu vermindern > versucht statt sie zu beseitigen > Keine > Ahnung warum das Coop macht, ist aber ihr Recht, ist ja Ihre Webseite. > Gruss Serge > .. so long ;) > > Roger > > > On 28.02.2021 19:37, Serge > Droz wrote: >> I think you misunderstand what free speech is. Free > speach means, you >> cannot be punished for what you say, nothing > more. It does not guarantee >> you an audience, or a platform. >> An, > although a bit US centric, explanation is here: >> > https://www.aclu.org/other/what-censorship >> >> If blocking is a good > idea for security reasons is en entirely different >> questions, and > has nothing what so ever to do with free speech or >> censorship. >> > >> Best >> Serge >> >> >> >> -- >> Serge Droz >> Security Lead >> > Proton Technologies AG >> -- Serge Droz Security Lead Proton > Technologies AG

5 7

SSL Certs question
by Andreas Fink 20 May '21

20 May '21

Hello all, I need to get some SSL certificates for some african country operations and i can unfortunately not use letsencrypt for this. I was trying to get a certificate from Swissign for this but for some reason they refuse issuing certificates to domains for Guinea and Guinea Bissau because these countries are on their embargo TLD list. It is known that some individuals from these countries are on a UN embargo list, but thats also true for some people from Germany or Switzerland or USA. And these countries are not blocked. In other words, I need another certificate provider, preferrably not under US control (so not Comodo, Digicert, Thawte, Symantec, Verisign etc), who can issue multidomain certificates for .gw, .com.gn, .sl, .io, .com domains. Anyone have a good hint?

7 10

Re: [swinog] SSL Certs question
by Willy Manga 13 May '21

13 May '21

. On 13/05/2021 14:00, swinog-request(a)lists.swinog.ch wrote: > From: Andreas Fink <afink(a)list.fink.org> > [...] In other words, I need another certificate > provider, preferrably not under US control (so not Comodo, Digicert, > Thawte, Symantec, Verisign etc), who can issue multidomain certificates > for .gw, .com.gn, .sl, .io, .com domains. Gandi https://www.gandi.net/ ? -- Willy Manga @ongolaboy https://ongola.blogspot.com/

1 0

strange download/upload speeds with ADSL : UL faster than DL
by Charles Bueche 07 May '21

07 May '21

Hello everyone, first I hope this is not too off-topic. I'm asking here because this whole layer-1 world is quite foreign to me, despite having studied electronics 30 years ago, and I have noticed some people here really know what this is all about :-) In short : my house is cabled over ADSL (aerial line). The upgrade to G.Fast is planned for July, most probably still over the aerial line. I had serious connectivity issues when it was raining, and had Swisscom/Cablex replace my aerial line (aluminium+paper, 40+ years old) by a new shiny big shielded cable, along with all the internal cabling well-done, direct cabling for the U72, new sockets and cables, etc. The current "should" speed numbers from Swisscom check-tool are : Download : 50 Mbit/s au max. au lieu de 200 Mbit/s Upload : 18 Mbit/s au max. au lieu de 100 Mbit/s However, when testing my speed, I consistently find DL at 18-19 Mbis/s and UL at 25-29 Mb/s, with a latency at about 12ms. I have done the tests with my "real" environment (ADSL bridged-modem, Unifi USG, etc) and as well with the modem in "home-office" mode, eg ADSL-router doing the PPPoE by itself, the numbers are very similar. I used several test-sites and clients, wired and not. Almost always the same numbers. Now I'm not sure why my UL is faster than my DL. After helping to have my line replaced, my provider (Solnet) said all is ok and the problem is elsewhere... but where ? Why is UL faster than DL, and why not the 50mb/s they say ? And will it really be better with g.fast, or should I go to UPC, which I'd rather not have to.... Hints welcome :-) Charles -- Charles Bueche <cblists(a)bueche.ch>

3 4

IANA AS Numbers Registry Update
by Selina Harrington 06 May '21

06 May '21

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following blocks to APNIC: 143674-144697 Assigned by APNIC 2021-05-05 144698-145721 Assigned by APNIC 2021-05-05 145722-146745 Assigned by APNIC 2021-05-05 146746-147769 Assigned by APNIC 2021-05-05 You can find the registry at: https://www.iana.org/assignments/as-numbers/ The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-blocks-2010-09-21-en Best Regards, -- Selina Harrington Lead IANA Services Specialist

1 0

Swinog's Blacklists
by Florian Blaser 29 Apr '21

29 Apr '21

Hi all, I’ve setup an internal DNSBL and URIBL to better fight spam for our customers (and am thinking about setting up an HASHBL as well soon). I’m wondering if this work could be shared with the community by integrating our data in the Swinog RBLs. Would that be an option? Kind regards, Florian

1 0

OVH
by Klaus Ethgen 27 Apr '21

27 Apr '21

Hi folks, do any of you know just one legit service that is hosted by OVH? They own massive amount of /16 networks and many of them are already in my blocklist as I have seen massive server attacks from that OVH networks. Regards Klaus -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Klaus(a)Ethgen.ch> Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C

5 4

mail.protection.outlook.com said: 451 4.7.500 Server busy. Please try again later
by Per Jessen 27 Apr '21

27 Apr '21

Does anyone have any idea what sort of rate limits are used by Office365 ? We seem to be hitting $SUBJ more and more often, so we have been scaling back delivery frequencies. It just seems a bit random and arbitrary. -- Per Jessen, Zürich (19.4°C)

2 1

someone at infomaniak
by Silvan M. Gebhardt 26 Apr '21

26 Apr '21

Can someone at Infomaniak contact me offlist urgently please. (phishing site takedown. thanks) Merci Silvan

1 0

somebody from Backbone/sipcall arround ?
by roger mgz 16 Apr '21

16 Apr '21

please contact me offlist for some Voip abuse Question Roger

1 0

New glue record, transfer of domains and such things
by Mueller Urs SBB CFF FFS 15 Apr '21

15 Apr '21

Hi there A friend reminded me to use the list, as it is sometimes a bit quiet here. ;-) My understanding of a glue record is, that the registrar of a domain is responsible to configure them (in my case at home, this was Cyon, but they were a bit puzzled, as they don't do this very often). Just to understand this technically (I'm perhaps totally wrong): - Domain registrar receives customer order (put dns.xyz.zyx with 1.2.3.4 as glue record into some system) - Registrar has an interface (fax, carrier pigeon or something similar) to tld registry, which can save the record to its database If I further change my registrar, this doesn't affect that entry, but any change has to be ordered through the new registrar. There is usually no way to do this myself (if the registrar is not offering such an interface). Please help or correct me. Thank you. Urs Müller SBB AG Cyber Defense Center Poststrasse 6, 3072 Ostermundigen Mobil +41 79 433 21 67 urs.bf.mueller(a)sbb.ch / www.sbb.ch

3 2

FYI: COMLOT Geldspielgesetz Key expired
by Jeroen Massar 14 Apr '21

14 Apr '21

As it is 1 april tomorrow, some things expired yesterday: Not After : Mar 30 13:28:58 2021 GMT That thing is.... the COMLOT key to verify those Geldspielgesetz keys for their fun list of worldwide casinos: https://blacklist.comlot.ch/comlot_blacklist.txt see full cert details below. You can get the key with or attached: $ wget -vS https://blacklist.comlot.ch/blacklist.comlot.ch.pub --2021-03-31 16:50:00-- https://blacklist.comlot.ch/blacklist.comlot.ch.pub Resolving blacklist.comlot.ch (blacklist.comlot.ch)... 194.187.88.5 Connecting to blacklist.comlot.ch (blacklist.comlot.ch)|194.187.88.5|:443... connected. HTTP request sent, awaiting response... HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Wed, 31 Mar 2021 14:50:01 GMT Content-Type: application/octet-stream Content-Length: 2927 Connection: keep-alive Last-Modified: Wednesday, 31-Mar-2021 14:50:01 GMT Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Strict-Transport-Security: max-age=15768000 Accept-Ranges: bytes Length: 2927 (2.9K) [application/octet-stream] Saving to: ‘blacklist.comlot.ch.pub’ blacklist.comlot.ch.pub 100%[==========================================================>] 2.86K --.-KB/s in 0s 2021-03-31 16:50:01 (558 MB/s) - ‘blacklist.comlot.ch.pub’ saved [2927/2927] Funny that nginx claims the file changed... the moment I downloaded it, bit strange for a static file. Anybody has contacts at COMLOT. As technically speaking, we should not be updating the list anymore into RPZ now; the process I have is thus stuck at the list from yesterday.... (not that it matters, with such a nice list, a bit of VPN and/or simply choosing any non-provider DNS server and voila... bypassed the law.... you, know, Their Law! https://www.youtube.com/watch?v=zKNoU2P0dQc Enjoy! Greet, Jeroen -- openssl x509 -in blacklist.comlot.ch.pub -text Certificate: Data: Version: 3 (0x2) Serial Number: 61:5d:a4:eb:83:eb:a0:a3:be:97:59:c9:56:9b:28:e9 Signature Algorithm: sha256WithRSAEncryption Issuer: C = CH, O = SwissSign AG, CN = SwissSign CH Person Platinum CA 2017 - G22, organizationIdentifier = NTRCH-CHE-109.357.012 Validity Not Before: Mar 30 13:28:58 2020 GMT Not After : Mar 30 13:28:58 2021 GMT Subject: C = CH, L = Bern, ST = BE, organizationIdentifier = NTRCH-CHE-196.380.112, O = Lotterie- und Wettkommission Comlot, CN = Lotterie- und Wettkommission Comlot Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:8d:2c:7f:48:c2:07:30:b9:fa:29:26:1d:29:83: 82:41:ef:73:2e:8e:dc:de:28:a4:6b:0b:93:0d:19: b6:ee:d2:c5:63:95:3f:d0:ed:a7:f3:80:70:e3:07: 48:6e:f3:e7:5a:d1:fd:80:d5:2e:4e:6d:3d:e1:db: 8e:44:2f:4f:a7:21:58:1d:c9:59:40:9b:97:85:4c: b6:5a:f6:cc:1a:71:a1:ef:59:59:65:f2:6c:be:25: 74:15:37:29:40:b1:6c:6d:3b:43:82:85:ee:5b:e8: 01:86:92:32:a5:f8:a9:ba:8b:85:6e:14:6e:ca:cc: 33:35:ff:7e:b7:fb:1c:c6:dc:c3:c4:f8:31:7b:73: c8:91:86:59:07:4b:75:1f:10:68:50:61:93:19:5b: ac:3d:43:c4:49:0a:ea:17:1b:ea:0e:f5:c1:7f:d5: db:c0:58:c5:61:19:dd:05:b7:b5:35:27:85:ea:ec: 70:6e:c5:a6:d5:c1:ca:5b:85:3e:42:08:14:f0:01: aa:b5:47:93:ed:ed:eb:20:35:db:d8:d8:58:da:6b: dc:3d:14:ee:e1:91:c8:85:12:d5:59:9c:fc:4f:04: 0e:f5:a4:d5:c0:ab:ec:57:6b:c1:d9:8f:1d:6b:dc: bf:5a:0e:58:a0:4c:01:0f:13:31:c0:0b:dd:ac:aa: 2b:6f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: 1B:2B:A0:91:2C:6F:2B:92:49:EC:96:04:BD:1C:8D:36:35:45:4D:76 X509v3 Authority Key Identifier: keyid:1E:C8:04:6D:FB:72:62:51:60:A2:73:24:6F:BE:F2:5F:4D:34:92:FC X509v3 CRL Distribution Points: Full Name: URI:http://crl.swisssign.net/1EC8046DFB72625160A273246FBEF25F4D3492FC Full Name: URI:ldap://directory.swisssign.com/CN=1EC8046DFB72625160A273246FBEF25F4D349… X509v3 Certificate Policies: Policy: 2.16.756.1.89.1.1.1.1.10 CPS: https://repository.swisssign.com/SwissSign-Platinum-CP-CPS.pdf User Notice: Explicit Text: regulated certificate Policy: 0.4.0.194112.1.3 Authority Information Access: CA Issuers - URI:http://swisssign.net/cgi-bin/authority/download/1EC8046DFB72625160A2732… OCSP - URI:http://platinum-g2.ocsp.swisssign.net/1EC8046DFB72625160A273246FBEF25F4… qcStatements: 0c0......F..0B.....F..08.2https://repository.swisssign.com/SwissSign-PDS.pd…... Signature Algorithm: sha256WithRSAEncryption 10:08:b0:64:2d:63:90:e2:07:4e:ed:d1:87:62:0a:43:88:c8: 87:b9:85:91:ae:ba:8b:f7:f6:33:d3:cd:a0:63:37:28:28:4f: c0:ec:15:06:a7:e4:86:1f:03:28:ad:e5:32:68:14:e2:ee:6e: 62:97:fc:95:7a:ac:fe:b1:a4:24:d1:99:89:2e:cd:ee:ca:c3: 76:c9:38:8e:3b:16:bd:6f:89:5e:4a:94:d5:ea:f1:73:46:15: 41:45:a4:8a:0b:8a:14:22:35:36:8c:fa:70:bb:19:73:6e:39: 93:5d:0d:5c:43:60:8e:0e:38:ed:ac:96:74:0a:b9:51:bc:23: 51:80:4d:cf:e2:64:02:80:af:dd:ef:40:b9:ba:36:0e:aa:3d: 88:d9:29:20:56:68:39:a8:74:46:79:81:df:d0:c8:fb:4b:76: 2b:c4:41:42:e8:c6:16:f7:94:7f:30:de:ba:22:d9:67:94:a7: c2:01:4f:1f:31:2b:52:16:f3:ae:c4:b6:a4:f8:87:df:7f:92: 73:e1:89:07:05:9b:8d:e9:c1:21:8a:b6:87:59:04:12:fb:b0: f3:1a:95:0e:29:5d:95:af:a2:82:54:cb:9f:77:d7:90:00:42: 06:53:88:d4:9f:26:b0:43:e9:b0:c1:9a:24:17:69:fc:87:66: e3:67:01:bf -----BEGIN CERTIFICATE----- MIIG9zCCBd+gAwIBAgIQYV2k64ProKO+l1nJVpso6TANBgkqhkiG9w0BAQsFADB5 MQswCQYDVQQGEwJDSDEVMBMGA1UEChMMU3dpc3NTaWduIEFHMTMwMQYDVQQDEypT d2lzc1NpZ24gQ0ggUGVyc29uIFBsYXRpbnVtIENBIDIwMTcgLSBHMjIxHjAcBgNV BGETFU5UUkNILUNIRS0xMDkuMzU3LjAxMjAeFw0yMDAzMzAxMzI4NThaFw0yMTAz MzAxMzI4NThaMIGlMQswCQYDVQQGEwJDSDENMAsGA1UEBxMEQmVybjELMAkGA1UE CBMCQkUxHjAcBgNVBGETFU5UUkNILUNIRS0xOTYuMzgwLjExMjEsMCoGA1UEChMj TG90dGVyaWUtIHVuZCBXZXR0a29tbWlzc2lvbiBDb21sb3QxLDAqBgNVBAMTI0xv dHRlcmllLSB1bmQgV2V0dGtvbW1pc3Npb24gQ29tbG90MIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEAjSx/SMIHMLn6KSYdKYOCQe9zLo7c3iikawuTDRm2 7tLFY5U/0O2n84Bw4wdIbvPnWtH9gNUuTm094duORC9PpyFYHclZQJuXhUy2WvbM GnGh71lZZfJsviV0FTcpQLFsbTtDgoXuW+gBhpIypfipuouFbhRuyswzNf9+t/sc xtzDxPgxe3PIkYZZB0t1HxBoUGGTGVusPUPESQrqFxvqDvXBf9XbwFjFYRndBbe1 NSeF6uxwbsWm1cHKW4U+QggU8AGqtUeT7e3rIDXb2NhY2mvcPRTu4ZHIhRLVWZz8 TwQO9aTVwKvsV2vB2Y8da9y/Wg5YoEwBDxMxwAvdrKorbwIDAQABo4IDTDCCA0gw DgYDVR0PAQH/BAQDAgeAMAwGA1UdEwQFMAMBAQAwHQYDVR0OBBYEFBsroJEsbyuS SeyWBL0cjTY1RU12MB8GA1UdIwQYMBaAFB7IBG37cmJRYKJzJG++8l9NNJL8MIIB BAYDVR0fBIH8MIH5MEegRaBDhkFodHRwOi8vY3JsLnN3aXNzc2lnbi5uZXQvMUVD ODA0NkRGQjcyNjI1MTYwQTI3MzI0NkZCRUYyNUY0RDM0OTJGQzCBraCBqqCBp4aB pGxkYXA6Ly9kaXJlY3Rvcnkuc3dpc3NzaWduLmNvbS9DTj0xRUM4MDQ2REZCNzI2 MjUxNjBBMjczMjQ2RkJFRjI1RjREMzQ5MkZDJTJDTz1Td2lzc1NpZ24lMjBBRyUy Q0M9Q0g/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNz PWNSTERpc3RyaWJ1dGlvblBvaW50MIGXBgNVHSAEgY8wgYwwfwYKYIV0AVkBAQEB CjBxMEoGCCsGAQUFBwIBFj5odHRwczovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNv bS9Td2lzc1NpZ24tUGxhdGludW0tQ1AtQ1BTLnBkZjAjBggrBgEFBQcCAjAXDBVy ZWd1bGF0ZWQgY2VydGlmaWNhdGUwCQYHBACL7EABAzCB0gYIKwYBBQUHAQEEgcUw gcIwZAYIKwYBBQUHMAKGWGh0dHA6Ly9zd2lzc3NpZ24ubmV0L2NnaS1iaW4vYXV0 aG9yaXR5L2Rvd25sb2FkLzFFQzgwNDZERkI3MjYyNTE2MEEyNzMyNDZGQkVGMjVG NEQzNDkyRkMwWgYIKwYBBQUHMAGGTmh0dHA6Ly9wbGF0aW51bS1nMi5vY3NwLnN3 aXNzc2lnbi5uZXQvMUVDODA0NkRGQjcyNjI1MTYwQTI3MzI0NkZCRUYyNUY0RDM0 OTJGQzBxBggrBgEFBQcBAwRlMGMwCAYGBACORgEEMEIGBgQAjkYBBTA4FjJodHRw czovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS9Td2lzc1NpZ24tUERTLnBkZhMC ZW4wEwYGBACORgEGMAkGBwQAjkYBBgIwDQYJKoZIhvcNAQELBQADggEBABAIsGQt Y5DiB07t0YdiCkOIyIe5hZGuuov39jPTzaBjNygoT8DsFQan5IYfAyit5TJoFOLu bmKX/JV6rP6xpCTRmYkuze7Kw3bJOI47Fr1viV5KlNXq8XNGFUFFpIoLihQiNTaM +nC7GXNuOZNdDVxDYI4OOO2slnQKuVG8I1GATc/iZAKAr93vQLm6Ng6qPYjZKSBW aDmodEZ5gd/QyPtLdivEQULoxhb3lH8w3roi2WeUp8IBTx8xK1IW867EtqT4h99/ knPhiQcFm43pwSGKtodZBBL7sPMalQ4pXZWvooJUy59315AAQgZTiNSfJrBD6bDB miQXafyHZuNnAb8= -----END CERTIFICATE-----

1 1

Mail rejection at bluewin
by Peter Rohrer 07 Apr '21

07 Apr '21

Hello everybody Since yesterday, we see a lot of bounced messages to bluewin addresses with SMTP code 554, for example: relay=mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50]:25, delay=0.16, delays=0/0.01/0.09/0.05, dsn=5.2.0, status=bounced (host mxbw-bluewin-ch.hdb-cs04.ellb.ch[195.186.227.50] said: 554 5.2.0 sc976: Rejected due to policy reasons - https://support.bluewin.ch/provider/bounce/XXXXXXXXXXXXXXXXX[redacted]== (in reply to end of DATA command)) Unfortunately, sc976 is not documented on https://postmaster.bluewin.ch/content/de/technical-details/ We can't see any general pattern behind those rejections (hosts trough our entire IP range are affected), switching to a different IP address for delivery works in most cases. Do you see the same and have any insight what is going on here? Greetings Peter

7 7

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog