Security Basics mailing list archives

Re: spam/virus reporting to abuse () whereever com


From: Isaac Perez <suscripcions () tsolucio com>
Date: Fri, 20 Jul 2007 18:49:54 +0200

Hi,
what we have learned trhough several years of abuse/spam reporting is
that:
-Check the headers of the email. There you can find the original ip
adress, is not as easily/usually spoofed as the email adress.
-With the source ip adress you can make a whois (check www.dnsstuff.com)
for it and if you have luck you will have a email to send the abuse.
-In the email you should add:
        -Source IP adress of the abuse
        -Your time-zone
        -A copy of the email message, headers included, or a copy of the
logs.
-There are a few chances that you get a way to report the abuse.
-Even if you get it there are less chances that anything will be done.
-Very very few times you get an answer from the owner or the ISP saying
that the corrective actions will be done.

If you want our template for this kind of emails only ask for it :-)


El mié, 18-07-2007 a las 15:49 +1000, Murda Mcloud escribió:
What is the usual etiquette for informing an abuse email address at an
ISP
that spam/viruses appear to be coming from a certain IP in their
block?

I was just going to send the headers from the various emails. 
The 'spam' engine is spoofing various domains
I'd guess that the box is owned.

 






Current thread: