On Jun 23, 2011, at 12:29 PM, John Levine wrote: >> I don't believe that there's sufficient implementation experience for >> an AS on non-solicited feedback, but I could be wrong. > > I've been sending all of my abuse reports in ARF format for several > years. I get the target addresses by a combination of looking up rDNS > in abuse.net and a largish local table of IP address ranges->domains. > It works reasonably well, at least as well as sending messages just > pasted in as text. I used to get a lot of responses that said "we're > too scared and/or incompetent to open your attachment so send it > pasted in", but I haven't gotten any of those in a while. > > My experience, which may or may not be typical of what other people > would find, is that sending reports in ARF format works fine, but > figuring out where to send them is a big challenge. In particular, > getting the addresses from WHOIS works poorly both because of the iffy > quality of WHOIS data, and because WHOIS servers don't have the > capacity to handle high volume scraping.
Since you're pretty much the only one, a "My Uncommon Practices" document could be useful. -- J.D. Falk the leading purveyor of industry counter-rhetoric solutions _______________________________________________ marf mailing list [email protected] https://www.ietf.org/mailman/listinfo/marf
