>I don't believe that there's sufficient implementation experience for >an AS on non-solicited feedback, but I could be wrong.
I've been sending all of my abuse reports in ARF format for several years. I get the target addresses by a combination of looking up rDNS in abuse.net and a largish local table of IP address ranges->domains. It works reasonably well, at least as well as sending messages just pasted in as text. I used to get a lot of responses that said "we're too scared and/or incompetent to open your attachment so send it pasted in", but I haven't gotten any of those in a while. My experience, which may or may not be typical of what other people would find, is that sending reports in ARF format works fine, but figuring out where to send them is a big challenge. In particular, getting the addresses from WHOIS works poorly both because of the iffy quality of WHOIS data, and because WHOIS servers don't have the capacity to handle high volume scraping. R's, John _______________________________________________ marf mailing list [email protected] https://www.ietf.org/mailman/listinfo/marf
