Re: [swinog] How to automate abuse complaints for ip based violations

Hey Benoit, > And of course there is the abusix.org contacts database via DNS: > > $ host -t txt 0.0.161.157.abuse-contacts.abusix.org > 0.0.161.157.abuse-contacts.abusix.org descriptive text "ab...@imp.ch" thanks, this is exactly what I was looking for! Cheers, Markus ___

Re: [swinog] How to automate abuse complaints for ip based violations

On 2013-08-23 09:43, Markus Wild wrote: [..] > My manual approach would be to lookup whois > data for the respective IP (which by itself can be a multi step process, > since you first need to find the right registry), and look for an > abuse-contact there. But, whois isn't exactly engineered for a

Re: [swinog] How to automate abuse complaints for ip based violations

Hi Markus There are a couple of standardized abuse report forms to report incidents or spam which can automaticly be processed by abuse desks. Ask Google for ARF oder X-ARF Then there is the problem of finding the abuse contacts. I agree, whois reply parsing is absolutely ugly, especialy as yo

Re: [swinog] How to automate abuse complaints for ip based violations

Hi Markus >So, what alternatives are there? How about using services from Dshield (http://www.dshield.org/howto.html) or Threatstop (http://www.threatstop.com/IP-Reputation-Service-Overview especially step 5) Basically you submit your logs and they do the lookup for you and you can benefit fro

[swinog] How to automate abuse complaints for ip based violations

Hi there, when looking through traffic analysis, I can more or less easily identify IP addresses that exhibit bad behavior (like massive port/address scanning, attempting to log into joomla/wp administration URLs, POP3/SMTP account scanning, etc) which need to be blocked. Now, since most of these