[Dshield] Fightback email addresses?

Tim Rushing rushing at jorsm.com
Wed Jun 11 14:29:58 GMT 2003


I think it would be a bad idea for Dshield to only send to self-reported 
abuse addresses.  It would be a good way for an attacker to hide evidence 
of a targeted attack.

However, what I think would be a good idea would be if Dshield could send 
to the ARIN abuse address (or whatever source Dshield currently uses) and 
to a self-reported abuse address.  Of course, I imagine this would mean 
significant changes in the interface, database and automation systems.

All I'm reporting to Dshield is a home system.  My ISP is small enough that 
if they get a report regarding me, I will hear about it.  However, I would 
love to be able to ask Dshield to let me know if my IP suddenly starts 
scanning.

     ---Tim Rushing

At 06:38 AM 6/11/03 -0700, Richard Roy wrote:
>Yeah, I agree, perhaps an over ride for our own domain?  Somehow though
>Dshield would have to verify we are indeed responsible for the domain/ip
>block in order to avoid more errors.  Anyone else agree?
>
>Rich
>
>-----Original Message-----
>From: Peter Gervai [mailto:grin at tolna.net]
>Sent: Wednesday, June 11, 2003 2:48 AM
>To: General DShield Discussion List
>Subject: [Dshield] Fightback email addresses?
>
>
>Hello,
>
>Sorry if this already has been bought up but I try to ask this every 6
>months (so far), and kindly waiting for a reply.
>
>I manage several IP blocks, and I am fairly unhappy that Fightback uses
>general support email instead of the abuse email. Our abuse email is
>registered in abuse.net (naturally), but it's probably not directly
>useful due to its domain-based nature.
>
>Nevertheless I want to tell fightback where to send emails for my zones.
>Probably many others want to do the same, as sending abuse reports to
>general support emails result zero actions (they're too busy to forward
>all this stuff).
>
>I wonder how fightback does select email address? (I'd like to see this
>on the Fightback info webpage/faq as well, I'm sure it is a valuable
>information for the public.) Could it be changed somehow?
>
>Peter
>
>_______________________________________________
>list mailing list
>list at dshield.org
>To change your subscription options (or unsubscribe), see:
>http://www.dshield.org/mailman/listinfo/list
>
>_______________________________________________
>list mailing list
>list at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www.dshield.org/mailman/listinfo/list






More information about the list mailing list