This is a good Idea and I've seen notifications sent by a product
called "Early Bird(?)" that informs the responsible individuals based on the
info listed in the Domain Name Registry. Useful, as long as the Domain Name
Registry information is accurate. We had to block a specific clients IP due
to his all-in-one Server/Workstation/Everything sytem being infected with a
virus while he was on a two week vacation. SInce his systems are not
inhouse, we had no other way to stop his system from sending out the virus
repeatedly to all of the addresses everytime his sytem rebooted it's self
(some sort of batch file that ran every night while he was away).
Kevin Childers
---------- Original Message ----------------------------------
From: "John Tolmachoff" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Mon, 22 Apr 2002 08:01:47 -0700
>On Friday, it was brought up about the forged headers, and you mentioned
>about the new feature that was going to be added over the weekend. You
>work entirely too much! :) That got me thinking about sending it to the
>IP instead.
>
>The way I see it, if there is a lot of virus or other activity coming
>from an IP, I would want to block that. But to be fair, I would want to
>somehow let them know. After all, maybe they do not know what is going
>on.
>
>Of course, I would like to do this as automatically as possible.
>
>My thought, if I could send the virus notice to the IP address, then if
>I keep receiving from that IP after a period of time, I would then
>blacklist it.
>
>Comments?
>
>Let's see; reply from Len: Imgate.
>
>John Tolmachoff
>IT Manager, Network Engineer
>211 E. Imperial Hwy., Suite 106
>Fullerton, CA 92835
>714-578-7999, ext. 104
>[EMAIL PROTECTED]
>www.reliancesoft.com
>
>
>
> >-----Original Message-----
> >From: [EMAIL PROTECTED]
> >[mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry
> >Sent: Monday, April 22, 2002 7:50 AM
> >To: [EMAIL PROTECTED]
> >Subject: RE: [IMail Forum] Forged Headers
> >
> >
> >>In that case, with the discussion concerning sending the automatic
> >virus
> >>notices, what about the thoughts of sending it to Postmaster and/or
> >>abuse at the IP address?
> >
> >You can do that (by using an E-mail template file with "To:
> >postmaster@[%REMOTEIP%],abuse@[%REMOTEIP%]"). However, it seems that
> >most
> >mail server admins aren't set up to accept mail to the IP address (or if
> >
> >they do, it doesn't go anywhere).
> >
> >FYI, the new release of Declude this morning lets you disable specific
> >notifications based on the virus (such as disabling the notification to
> >the
> >sender of the Klez virus, while still notifying the recipient), so this
> >shouldn't be as much of an issue.
> >
> > -Scott
> >---
> >Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
> >IMail. http://www.declude.com
> >
> >---
> >[This E-mail was scanned for viruses by Declude Virus
> >(http://www.declude.com)]
> >
> >
> >Please visit http://www.ipswitch.com/support/mailing-lists.html
> >to be removed from this list.
> >
> >An Archive of this list is available at:
> >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
> >Please visit the Knowledge Base for answers to frequently asked
> >questions: http://www.ipswitch.com/support/IMail/
> >
> >
> >Please visit http://www.ipswitch.com/support/mailing-lists.html
> >to be removed from this list.
> >
> >An Archive of this list is available at:
> >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >
> >Please visit the Knowledge Base for answers to frequently asked
> >questions: http://www.ipswitch.com/support/IMail/
> >
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit the Knowledge Base for answers to frequently asked
questions: http://www.ipswitch.com/support/IMail/
