Re: [marf] draft-jdfalk-marf-as

["J.D. Falk" <[e-mail]>]

On Jun 23, 2011, at 12:29 PM, John Levine wrote:

>> I don't believe that there's sufficient implementation experience for
>> an AS on non-solicited feedback, but I could be wrong.
> 
> I've been sending all of my abuse reports in ARF format for several
> years.  I get the target addresses by a combination of looking up rDNS
> in abuse.net and a largish local table of IP address ranges->domains.
> It works reasonably well, at least as well as sending messages just
> pasted in as text.  I used to get a lot of responses that said "we're
> too scared and/or incompetent to open your attachment so send it
> pasted in", but I haven't gotten any of those in a while.
> 
> My experience, which may or may not be typical of what other people
> would find, is that sending reports in ARF format works fine, but
> figuring out where to send them is a big challenge.  In particular,
> getting the addresses from WHOIS works poorly both because of the iffy
> quality of WHOIS data, and because WHOIS servers don't have the
> capacity to handle high volume scraping.

Since you're pretty much the only one, a "My Uncommon Practices" document could be useful.

--
J.D. Falk
the leading purveyor of industry counter-rhetoric solutions