To report a botnet PRIVATELY please email: [EMAIL PROTECTED] ---------- Jim Becher wrote:
>To report a botnet PRIVATELY please email: [EMAIL PROTECTED] >---------- > > > ------------------------------------------------------------------------ > > Or an automated tool that can parse the IRC list and draft or send an > e-mail to an abuse contact with a list of the machines from that > domain or netblock that are victims? > I did this in 2004... the biggest problem I had was getting the cooperation of the ISP's and some type of agreement on the form the multiple reports will be in. Most ISP's are only setup to deal with one report per spam. Sending out put reports like this makes us no better then spammers as far as clogging resources. Going full bore, I was reporting approx 25,000 spams a day, so that's how many Emails I was mailing out to "abuse" email boxes. I'm just one guy, Imagine of I had release this out in PD, and everyone else was doing it... ISPs would get flooded with reports, people would get careless and not filter their spam properly, leaving non-spam with the spam... worse case is that the poor hapless individual will loose their internet connection or Email. The experiment was quite interesting... taking place in Spring 2004 and continuing until Aug 2004 resulted in more then 750,000 spam bots getting cleaned out. > If/when we detect a machine that is part of a botnet, we usually just > report the IRC server performing the command and control (due to time > constraints). It would be beneficial to get work out to the abuse > contacts for the domains of the machines in the IRC channel. I can > imagine a lot of the reports would fall on deaf ears… as I have had > very little luck with malicious activity involving cable/DSL > subscribers in the US. > > If you just cut off the head… you still have a number of vulnerable > machines out there. Machines that will probably end up in another botnet… > It's like trying to eradicate cockroaches... they keep coming out of the walls... John _______________________________________________ botnets mailing list To report a botnet PRIVATELY please email: [EMAIL PROTECTED] http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
