To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
----------
> -----Original Message-----
> From: John Draper [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, March 07, 2006 4:51 PM
> To: Jim Becher
> Cc: [email protected]
> Subject: Re: [botnets] 2150 connections
>
> Jim Becher wrote:
>
> >To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
> >----------
> >
> >
> >
> ----------------------------------------------------------------------
> > --
> >
> > Or an automated tool that can parse the IRC list and draft
> or send an
> > e-mail to an abuse contact with a list of the machines from that
> > domain or netblock that are victims?
> >
> I did this in 2004... the biggest problem I had was getting
> the cooperation of the ISP's and some type of agreement on
> the form the multiple reports will be in. Most ISP's are only
> setup to deal with one report per spam.
>
> Sending out put reports like this makes us no better then
> spammers as far as clogging resources.
> Going full bore, I was reporting approx 25,000 spams a day,
> so that's how many Emails I was mailing out to "abuse" email
> boxes. I'm just one guy, Imagine of I had release this out in
> PD, and everyone else was doing it... ISPs would get flooded
> with reports, people would get careless and not filter their
> spam properly, leaving non-spam with the spam... worse case
> is that the poor hapless individual will loose their internet
> connection or Email.
John,
I was advocating a single e-mail to the abuse contact with a list of
machines that are victims. The e-mail should originate from a single
cooperative organization (MyNetwatchman, SANS, dshield, or the like). I
agree that if an e-mail was generated, by each organization that sees the
botnet, for each victim machine to the abuse contact -- it would be chaos.
_______________________________________________
botnets mailing list
To report a botnet PRIVATELY please email: [EMAIL PROTECTED]
http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
