Re: [swinog] Belgian spammer

2013-08-23 Diskussionsfäden Jean-Pierre Schwickerath
If you are going to complain about someone, could you at least include headers of these spams? Also, it would be prudent to contact the ISP that the spamvertised sites are located. I'd suggest to post your full spam message in the form on www.spamcop.net and it will give you all the abuse

[swinog] How to automate abuse complaints for ip based violations

2013-08-23 Diskussionsfäden Markus Wild
Hi there, when looking through traffic analysis, I can more or less easily identify IP addresses that exhibit bad behavior (like massive port/address scanning, attempting to log into joomla/wp administration URLs, POP3/SMTP account scanning, etc) which need to be blocked. Now, since most of these

Re: [swinog] How to automate abuse complaints for ip based violations

2013-08-23 Diskussionsfäden Jean-Pierre Schwickerath
Hi Markus So, what alternatives are there? How about using services from Dshield (http://www.dshield.org/howto.html) or Threatstop (http://www.threatstop.com/IP-Reputation-Service-Overview especially step 5) Basically you submit your logs and they do the lookup for you and you can benefit

Re: [swinog] How to automate abuse complaints for ip based violations

2013-08-23 Diskussionsfäden Benoit Panizzon
Hi Markus There are a couple of standardized abuse report forms to report incidents or spam which can automaticly be processed by abuse desks. Ask Google for ARF oder X-ARF Then there is the problem of finding the abuse contacts. I agree, whois reply parsing is absolutely ugly, especialy as

Re: [swinog] How to automate abuse complaints for ip based violations

2013-08-23 Diskussionsfäden Jeroen Massar
On 2013-08-23 09:43, Markus Wild wrote: [..] My manual approach would be to lookup whois data for the respective IP (which by itself can be a multi step process, since you first need to find the right registry), and look for an abuse-contact there. But, whois isn't exactly engineered for

Re: [swinog] Belgian spammer

2013-08-23 Diskussionsfäden Klaus Ethgen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi, Am Do den 22. Aug 2013 um 10:58 schrieb Jeroen Massar: Contact Kangaroot (AS28707) who are the ISP hosting their netblock: [WHOIS info] They should be able to put a stop on this, or they will in time appear on spamhaus... Definitely

Re: [swinog] Small VoIP PBX recommendations

2013-08-23 Diskussionsfäden Stanislav Sinyagin
if you ask here: https://plus.google.com/communities/114149566116254233716 you will most probably get a quality answer. From: Andre Oppermann opperm...@networx.ch To: swi...@swinog.ch Sent: Thursday, August 22, 2013 6:56 PM Subject: [swinog] Small VoIP PBX