on Wed, Mar 21, 2001 at 08:38:39AM -0300, Carlos Laviola (claviola@ajato.com.br) wrote:
>
> On 21-Mar-2001 Arne Goetje wrote:
> >> If you read the headers you'll see it's coming from a yahoo web mail
> >> account. Not from AOL.
Though the originating *relay* IP is from citilink, IIRC. I've deleted
the original.
> > Then you should forward it including headers to abuse@yahoo.com or
> > where it came from... If you can see an ISP in the headers then
> > forward it to postmaster or abuse@ISP-domain.
> >
> > In most cases they'll delete the user's account at once...
>
> Spamcop (http://www.spamcop.net) is a very useful tool for spam
> reporting. Just copy and paste the evil thing (with headers, of
> course) and it will report it to the "proper authorities".
For command-line tools which can be integrated into mailers, ricochet
and spam.pl (an anti-spam tool, despite the name) are useful.
I also run the following script (requires 'rblcheck') to report IPs to
the ORBS open relay list for testing as open relays. Incidentally, in
the six months or so I've been doing this, the number of previously
identified open relays has fallen greatly.
------------------------------------------------------------------------
#!/bin/sh
# script to automate reporting of IPs to ORBs for testing.
PATH=/usr/bin:/bin
if [ $# -eq 0 ]; then
iplist=$( cat )
# echo "Using stdin" # testing only
else
iplist=$@
# echo "Using args" # testing only
fi
for ip in $iplist
do
if rblcheck $ip; then
echo $ip | sed -e '/^/s//Relay: /' |
mutt -s "ORBS report" relays@orbs.org && \
echo "$ip submitted to relays@orbs.org" ||
echo "error: $ip submission failed " 1>&2
fi
done
------------------------------------------------------------------------
--
Karsten M. Self <kmself@ix.netcom.com> http://kmself.home.netcom.com/
What part of "Gestalt" don't you understand? There is no K5 cabal
http://gestalt-system.sourceforge.net/ http://www.kuro5hin.org
Attachment:
pgpELHGToP8Nk.pgp
Description: PGP signature