August 2012 - anti-abuse-wg - mailman.ripe.net

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Alessandro Vesely 30 Aug '12

30 Aug '12

On Mon 20/Aug/2012 12:10:35 +0200 Emilio Madaio wrote: > > Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net > before 17 September 2012. As an Internet user, I fully support the proposal 2011-06 "Abuse Contact Management in the RIPE NCC Database" --

1 0

vacancesloisirs.fr
by Reza Farzan 29 Aug '12

29 Aug '12

Hello All, This domain, vacancesloisirs.fr, has been promoting itself in spamvertised that sends out. Based on my rudimentary research, the spamvertised website "vacancesloisirs.fr" resides on this IP address: 193.238.229.26 which belongs to Hostway in Germany: inetnum: 193.238.228.0 - 193.238.231.255 netname: HOSTWAY-1 descr: Hostway Deutschland GmbH Their NOC, however, denies that the IP is theirs, and they are not responsible for this domain. I have sent reports to these two addresses, abuse(a)hostway.de and abuse(a)as24679.net, is there another ISP that is responsible for this website, "vacancesloisirs.fr"? Any information would be appreciated. Thank you, Reza Farzan <mailto:rezaf@mindspring.com> rezaf(a)mindspring.com

3 4

Loop error in APNIC whois database
by U.Mutlu 28 Aug '12

28 Aug '12

What do you think about the following technical conversation with APNIC: My last reply, no answer yet: But then how cany I query the content of tech-c handle RCNP1-AP ? As demonstrated below, when I do "whois -h whois.apnic.net RCNP1-AP" then it again shows the same handle, ie. an error loop... XXXXX XXXXX via RT wrote, On 08/28/2012 10:27 AM: > Dear U.Mutlu, > > This is not an error. The role object admic-c and tech-c can use > nic-handle of other person objects or the nic-handle of the role object > itself. > > Thanks, > -- XXXXX ________________________________________________________________________ APNIC Helpdesk > helpdesk(a)apnic.net Asia Pacific Network Information Centre (APNIC) Tel: +61 7 3858 3188 PO Box 3646 South > Brisbane, QLD 4101 Australia Fax: +61 7 3858 3199 6 Cordelia Street, South Brisbane, QLD http://www.apnic.net > ________________________________________________________________________ * Sent by email to save paper. Print > only if necessary. On Tue Aug 28 01:00:01 2012, security(a)mutluit.com wrote: >> >Hello, >> >there is a loop (error) in the whois database for the handle RCNP1-AP >> >as it doesn't get resolved, instead it again returns the same >> >handle...: >> > >> ># whois -h whois.apnic.net RCNP1-AP >> > >> >% [whois.apnic.net node-1] >> >% Whois data copyright terms >> >http://www.apnic.net/db/dbcopyright.html >> > >> >role: RK CABLE NET PRIVATE LIMITED - network administr >> >address: Block No 1-2, & 13-18, 1st & 2nd Floor,Annapurna >> >Shopping Centre, Adajan Patiya Circle, Rander >> >Road, >> >country: IN >> >phone: +91-261-2780343 >> >fax-no: +91-261-2787879 >> >e-mail:abuse@rkinfratel.com >> >admin-c: RCNP1-AP >> >tech-c: RCNP1-AP >> >nic-hdl: RCNP1-AP >> >mnt-by: MAINT-RKCABLENET-IN >> >changed:hm-changed@apnic.net 20120523 >> >source: APNIC >> > >> > >> >Regards, >> >U.Mutlu

7 11

mynet.com - A spam network without any abuse contact
by U.Mutlu 27 Aug '12

27 Aug '12

Hi, how come that for the domain mynet.com, clearly a spam network, there is no abuse-contact in the whois database? whois mynet.com gives: " Domain Name: MYNET.COM ------------------------------------------------------------------------ Promote your business to millions of viewers for only $1 a month Learn how you can get an Enhanced Business Listing here for your domain name. Learn more at http://www.NetworkSolutions.com/ ------------------------------------------------------------------------ " ie. a spam network...

3 6

mynet.com - A spam network without any abuse contact
by Reza Farzan 26 Aug '12

26 Aug '12

Hello, MYNET (Mynet Medya Yay. Ulus. Elek.) is a Turkish based domain with these IP addresses: addresses 212.101.97.6 212.101.97.7 212.101.97.8 212.101.122.35 True, this domain does not have a designated Abuse contact, but you may want to send your request to any or all of these addresses: - ripeteknik(a)mynet.com.tr - ripeinfo(a)mynet.com.tr - hakan.turkoner(a)mynet.com - admin(a)mynet.com - administrator(a)mynet.com When reporting any Spam, please make sure that you include its header as well. Thank you, Reza Farzan rezaf(a)mindspring.com -----Original Message----- From: anti-abuse-wg-bounces(a)ripe.net [mailto:anti-abuse-wg-bounces@ripe.net] On Behalf Of U.Mutlu Sent: Sunday, August 26, 2012 3:57 PM To: anti-abuse-wg(a)ripe.net Subject: [anti-abuse-wg] mynet.com - A spam network without any abuse contact Hi, how come that for the domain mynet.com, clearly a spam network, there is no abuse-contact in the whois database? whois mynet.com gives: " Domain Name: MYNET.COM ------------------------------------------------------------------------ Promote your business to millions of viewers for only $1 a month Learn how you can get an Enhanced Business Listing here for your domain name. Learn more at http://www.NetworkSolutions.com/ ------------------------------------------------------------------------ " ie. a spam network...

1 0

new draft Clean IT cyber terrorism
by Dr Michiel de Weger 21 Aug '12

21 Aug '12

2 1

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by U.Mutlu 21 Aug '12

21 Aug '12

Emilio Madaio wrote, On 08/20/2012 12:10 PM: > Dear Colleagues, > > The proposal described in 2011-06, "Abuse Contact Management in the > RIPE NCC Database", is now at its Concluding Phase. > > You can find the full proposal at: > > https://www.ripe.net/ripe/policies/proposals/2011-06 > > Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net > before 17 September 2012. I fully support this proposal. Kind regards, U.Mutlu mutluit.com

1 0

RIPE 65 Draft Agenda
by Brian Nisbet 21 Aug '12

21 Aug '12

Colleagues, We have just over a month to go before RIPE65, so I wanted to share the draft WG agenda. The WG meeting will take place on Thursday 27th September at 14:00 CEST. A. Administrative Matters * Welcome * Scribe, Jabber, Stenography * Microphone Etiquette * Approve Minutes from RIPE 64 * Finalise agenda B. Update * B1. Recent List Discussion * B2. CleanIT Project Update * B3. RIPE NCC Data Protection Legal Advice Update C. Policies * RIPE Policy 2011-06 D. Interactions * D1. Working Groups * D3. RIPE NCC Gov/LEA Interactions Update E. Presentation * E1. Operation of "Copy Shops" X. A.O.B. Z. Agenda for RIPE 66 As always, if you have any comments or anything to add, please don't hesitate to get in contact. Regards, Brian & Tobias

1 0

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Arnold 20 Aug '12

20 Aug '12

On 20/08/2012 3:10 AM, Emilio Madaio wrote: > Dear Colleagues, > > The proposal described in 2011-06, "Abuse Contact Management in the > RIPE NCC Database", is now at its Concluding Phase. > > > You can find the full proposal at: > > https://www.ripe.net/ripe/policies/proposals/2011-06 > > Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net > before 17 September 2012. > > > Regards > > Emilio Madaio > Policy Development Officer > RIPE NCC > > > FWIW, as a plain old 'net citizen interested in reporting and reducing SPAM, I wholeheartedly endorse the proposal Arnold -- Fight Spam - report it with the latest wxSR 0.5 http://www.columbinehoney.net/wxSR.shtml

1 0

Re: [anti-abuse-wg] 2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Davide Migliavacca 20 Aug '12

20 Aug '12

> Please e-mail any final comments about this proposal to anti-abuse- > wg(a)ripe.net > before 17 September 2012. I fully support the proposal 2011-06 in its current form. Kind regards, Davide Migliavacca Cto, contactlab

1 0

Re: [anti-abuse-wg] anti-abuse-wg Digest, Vol 12, Issue 16
by Wout de Natris 20 Aug '12

20 Aug '12

Brian, >From my side a full support for the proposal. Without any obligations the proposal may never work as foreseen. And I would like to stress that Jerry Upton wrote on behalf of M3AAWG and in function as director, so representing the M3AAWG members. Looking at who those members are, I venture to see this as a very large support on behalf of the proposal. Best, Wout > From: anti-abuse-wg-request(a)ripe.net > Subject: anti-abuse-wg Digest, Vol 12, Issue 16 > To: anti-abuse-wg(a)ripe.net > Date: Mon, 20 Aug 2012 12:00:02 +0200 > > Send anti-abuse-wg mailing list submissions to > anti-abuse-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://www.ripe.net/mailman/listinfo/anti-abuse-wg > or, via email, send a message with subject or body 'help' to > anti-abuse-wg-request(a)ripe.net > > You can reach the person managing the list at > anti-abuse-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of anti-abuse-wg digest..." > > > Today's Topics: > > 1. 2011-06 Move to Last Call (Abuse Contact Management in the > RIPE NCC Database) (Brian Nisbet) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 20 Aug 2012 08:55:07 +0100 > From: Brian Nisbet <brian.nisbet(a)heanet.ie> > Subject: [anti-abuse-wg] 2011-06 Move to Last Call (Abuse Contact > Management in the RIPE NCC Database) > To: anti-abuse-wg(a)ripe.net > Message-ID: <5031ED5B.6090905(a)heanet.ie> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Colleagues, > > RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC > Database) has reached the end of its extended Review Phase and a > decision must now be made regarding the next steps. I (Tobias, as the > main proposer, has, as agreed & discussed stepped back from his co-chair > duties on this one) have gone through the various mails and discussions > from the the review phase, a short summary of which is below. > > I feel that the main thrust of the discussion on 2011-06 gave support to > the proposal. > > The initial discussion phase lead to a redrafting of the proposal and > some questions over the mandatory nature of the attribute and the future > of the IRTs. It was also clarified that while there may be further > output from the ACM-TF and/or further proposals in this space, 2011-06 > was considered to be standalone. > > The second version was published on 16th April 2012, addressing, I > believe, a number of points raised during the initial discussion phase. > Some objections remained, such as opinions on the mandatory nature of > the object and the lack of a wider plan. > > In May 2012 it was decided to go ahead and move the proposal to Review > Phase, during which the RIPE NCC presented their impact analysis. This > gave rise to discussion regarding the future of the IRT object. I > believe that it has been clarified that while the NCC will put plans in > place to deal with the decommissioning of the IRT object, they will, of > course, only do so if the community proposes this. They have > acknowledged that 2011-06 does not contain this proposal and so no > action regarding the IRT object will be taken on foot of this proposal. > I believe that the wider IRT community are happy with this. > > There was relatively little discussion during Review Phase, so it was > extended for a further four weeks. During this time a number of > objections were restated (mandatory nature and data protection issues) > and discussed and a few new expressions of support were made. > > Overall it appears that there are three sustained objections to the > proposal and twelve clear expressions of support. The opinion of some > members of the list (who have commented) is unclear, however I feel > there is sufficient consensus to move this proposal to Last Call. > > Emilio will made the formal announcement from the RIPE NCC PDO. > > If you disagree with this interpretation, please let me know. > > Brian > Co-Chair, Anti-Abuse WG > > > > End of anti-abuse-wg Digest, Vol 12, Issue 16 > *********************************************

4 3

2011-06 Last Call for Comments (Abuse Contact Management in the RIPE NCC Database)
by Emilio Madaio 20 Aug '12

20 Aug '12

Dear Colleagues, The proposal described in 2011-06, "Abuse Contact Management in the RIPE NCC Database", is now at its Concluding Phase. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2011-06 Please e-mail any final comments about this proposal to anti-abuse-wg(a)ripe.net before 17 September 2012. Regards Emilio Madaio Policy Development Officer RIPE NCC

1 0

2011-06 Move to Last Call (Abuse Contact Management in the RIPE NCC Database)
by Brian Nisbet 20 Aug '12

20 Aug '12

Colleagues, RIPE Proposal 2011-06 (Abuse Contact Management in the RIPE NCC Database) has reached the end of its extended Review Phase and a decision must now be made regarding the next steps. I (Tobias, as the main proposer, has, as agreed & discussed stepped back from his co-chair duties on this one) have gone through the various mails and discussions from the the review phase, a short summary of which is below. I feel that the main thrust of the discussion on 2011-06 gave support to the proposal. The initial discussion phase lead to a redrafting of the proposal and some questions over the mandatory nature of the attribute and the future of the IRTs. It was also clarified that while there may be further output from the ACM-TF and/or further proposals in this space, 2011-06 was considered to be standalone. The second version was published on 16th April 2012, addressing, I believe, a number of points raised during the initial discussion phase. Some objections remained, such as opinions on the mandatory nature of the object and the lack of a wider plan. In May 2012 it was decided to go ahead and move the proposal to Review Phase, during which the RIPE NCC presented their impact analysis. This gave rise to discussion regarding the future of the IRT object. I believe that it has been clarified that while the NCC will put plans in place to deal with the decommissioning of the IRT object, they will, of course, only do so if the community proposes this. They have acknowledged that 2011-06 does not contain this proposal and so no action regarding the IRT object will be taken on foot of this proposal. I believe that the wider IRT community are happy with this. There was relatively little discussion during Review Phase, so it was extended for a further four weeks. During this time a number of objections were restated (mandatory nature and data protection issues) and discussed and a few new expressions of support were made. Overall it appears that there are three sustained objections to the proposal and twelve clear expressions of support. The opinion of some members of the list (who have commented) is unclear, however I feel there is sufficient consensus to move this proposal to Last Call. Emilio will made the formal announcement from the RIPE NCC PDO. If you disagree with this interpretation, please let me know. Brian Co-Chair, Anti-Abuse WG

1 0

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by "Michele Neylon :: Blacknight" 18 Aug '12

18 Aug '12

We've ended up with IP space that had a "reputation" in the past It's quite annoying to discover that you IP block, or a part of it, is blacklisted before you even get a chance to use it .. Though I wonder is the overall scarcity of IPv4 space going to mean that IP blocks will end up being reassigned more quickly as there's fewer and fewer .. Mr Michele Neylon Blacknight Solutions ♞ Hosting & Colocation, Brand Protection ICANN Accredited Registrar http://www.blacknight.co http://blog.blacknight.com/ http://blacknight.cat http://mneylon.tel Intl. +353 (0) 59 9183072 US: 213-233-1612 Locall: 1850 929 929 Direct Dial: +353 (0)59 9183090 Facebook: http://fb.me/blacknight Twitter: http://twitter.com/mneylon ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,Ireland Company No.: 370845

11 34

Re: [anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated
by Joe St Sauver 16 Aug '12

16 Aug '12

Thor commented: #Email spam is universally defined as unsolicited bulk email. It must be #extremely rare for someone to join an anti-abuse *working* group without #knowing basic concepts such as this one. Actually, the question of "what's spam?" can be surprisingly tricky when things like national and local legislation gets factored in, to the point that some organizations prefer to refer to "unwanted email" or "abusive email" instead of "spam" instead. See, for example, reports from the MAAWG Email Metrics Program, e.g., www.maawg.org/sites/maawg/files/news/MAAWG_2011_Q1Q2Q3_Metrics_Report_15.pdf which reports industry percentages for "abusive email" Regards, Joe

2 1

Hold time for abused address space - DNSChanger IP's reallocated
by Heather Schiller 15 Aug '12

15 Aug '12

Last Friday, RIPE reallocated 2 address blocks involved in DNSChanger malware - one of them is already routed. Infected users are still sending DNS queries to this address space. The new holders of this space are getting a lot of DNS queries - they are in the position to see who is infected, what they are querying for and provide any DNS response they wish to those queries. News article: http://www.cso.com.au/article/433502/new_hijack_threat_emerges_dns_changer_… RIPE's response: https://www.ripe.net/internet-coordination/news/clarification-on-reallocate… I think reallocation of this address space so quickly, is irresponsible and puts users at risk. The RIR's debogonize other address ranges and check their status before allocation. The court appointed honest DNS service was only turned down a month ago, with thousands of users still infected. While users have had plenty of opportunity to clean up their computers, many are still infected. In some cases, providers have intentionally chosen not to notify their customers. I asked on the address-policy list, how long RIPE holds back netblocks before allocation. From RIPE's response above, they hold address blocks for 6 weeks and it sounds as though they would have reallocated it while the court appointed honest DNS service was running had that 6 weeks expired before the court ordered honest service ended. Court order or not, should there be a policy/process to give guidance to RIR's on how to handle abused address space? Should address space that has been "poisoned" where it continues to get traffic from infected hosts long after the servers/malware/domains are removed be reallocated to new unsuspecting organizations? Should the space be held for some specified amount of time? Or until it drops below some threshold of traffic? Should a research or security organization be contracted to work on cleaning up the space? should the RIR do that? --Heather

1 0

Comments on Abuse Contact Management in the RIPE Database
by Jerry Upton 15 Aug '12

15 Aug '12

The Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) is a global nonprofit organization founded to develop effective modelsand solutions to combat online abuse such as phishing, botnets, fraud, spam,viruses and denial-of-service attacks that can cause great harm to bothindividual and national economies. M3AAWG includes technical experts,researchers and policy specialists from a broad base of Internet serviceproviders and network operators representing over one billion email accounts,and from key technology providers, academia and volume messaging senderorganizations M3AAWG supports RIPE’s proposal to introduce a new contactattribute named "abuse-c:", which can be included in inetnum,inet6num and aut-num objects(https://www.ripe.net/ripe/policies/proposals/2011-06). The investigation and prosecution of criminal activity andabuse on the Internet would be greatly facilitated by the availability of suchdata being included in WHOIS. Theproliferation of spam and the transmission of malware of all types, which arethe fundamental target of the work undertaken by M3AAWG and its members, arethe most common and serious types of privacy intrusions, occurring billions oftimes a day, worldwide. ARIN Draft Policy “Abuse Contact Management in the RIPE NCCDatabase” states “abuse-c … provides a more efficient way for maintainers toorganize their provided information and helps to increase accuracy andefficiency in routing abuse reports to the correct network contact. Inaddition, it helps all kinds of institutions to find the correct abuse contactinformation more easily.” For anti-abuse researchers, investigators and systemsoperators, WHOIS and a publicly available point of intercept identifying anabuse contact is essential and fundamental information. People who manage abuseof their networks need to easily, readily and accurately identify all entitieson a given network. Therefore,M3AAWG firmly supports the adoption of the RIPE Draft Policy “Abuse ContactManagement in the RIPE NCC Database.” Sincerely, Jerry Upton, Executive Director Messaging, Malware and Mobile Anti-Abuse Working Group(M3AAWG) jerry.upton(a)m3aawg.org http://www.m3aawg.org

1 0

Agenda Items - RIPE 65 - First Call
by Brian Nisbet 08 Aug '12

08 Aug '12

Colleagues, I do hope you're all enjoying your summer holidays, but I wanted to mention that RIPE 65 is around six weeks away (give or take) and the Anti-Abuse Working Group session has space on the agenda for any items you may will to raise at the meeting. Please contact me on or off list if you think you might like to present on (or just talk about) any items of interest to the community. Regards, Brian.

1 0

the mandatory abuse field
by Frank Gadegast 04 Aug '12

04 Aug '12

Hi all, I really have the feeling, that some in the community fear a mandatory abuse field, and try find any strange argument against it, but I really cannot see why. If somebody does not want to receive abuse reports or does not want to do something against abuse originating from his own resources or likes to receive them not via email or has whatever else reason, well, name it this-email-address-is-not-being-read(a)yourdomain.com or no-reply(a)example.com or send it to devnull ... Lots of resource holders are already doing the same, we keep a list of there email addresses, so we do not have to send them reports that will only fill our mail queue to bounce back. I can understand them and respect that others like to work things different and we do not send them reports anymore. On the other end, a mandatory abuse field will clean up everything in RIPEs database, remove the unparseble remarks, will help the abuse teams to receive reports only to ONE address, because sender can be educated, abuse tools can be simplified and integrated in webpages easily aso ... A mandatory abuse field has that much advantages for everybody who likes to work against abuse, that I cannot understand, why people, that do not want the same for there own reasons are against it. Let us optimize our procedures and if you do not want to participate, well set the email address to whatever or ignore every incoming mail ... Well, there is one reasons I can think of: Those people are not concerned, that they have to do something against abuse coming from there OWN resources, it must be the people that are causing the abuse problem in the first place, its there business, and so they are worried, that others find easier and better methods in preventing abuse. So, my personal summary is: --- Anybody, who is against a mandatory abuse field, is a professional spammer, abuser, maintains a bot net or sells open proxies or other services used for abusing others. They are criminals to my opinion. But thats only my impression ... --- Kind regards, Frank -- PHADE Software - PowerWeb http://www.powerweb.de Inh. Dipl.-Inform. Frank Gadegast mailto:frank@powerweb.de Schinkelstrasse 17 fon: +49 33200 52920 14558 Nuthetal OT Rehbruecke, Germany fax: +49 33200 52921 ======================================================================

11 41

Re: [anti-abuse-wg] the mandatory abuse field
by None 03 Aug '12

03 Aug '12

1 0

Re: [anti-abuse-wg] the mandatory abuse field
by Jørgen Hovland 02 Aug '12

02 Aug '12

2 1

2011-06 Proposal comment
by Davide Migliavacca 02 Aug '12

02 Aug '12

Dear all, being a newcomer in this group I took some time to review the proposal and go through list archives for previous discussions on the 2011-06 policy proposal. I believe this proposal goes in the right direction to solve long-standing issues with RIPE resources whois data usability for abuse report routing, and I would love see the proposal move forward and become policy allowing the implementation phases to start. Thanks to all WG members for their work so far. Kind regards, Davide Migliavacca CTO, ContactLab ------------------- Milano, IT Tel +39 02 2831181 Fax +39 02 70030269 www.contactlab.com

1 0

Manual vs automated reports
by Luis Muñoz 01 Aug '12

01 Aug '12

Hi there, I've been quickly going through the archives to try to catch up in the discussion after reading the current document. It struck me as odd that the role objects will have a single abuse-mailbox object which should be used to receive both automatic and manual reports. I'm aware of this (related) exchange (from the archives): From Tobias Knecht > > Is it for high volume automated report dissemination (trap or sensor initiated > > identification of "activity")? > > > For this to work it needs automated handling on the receiving side and it should > > be clearly opt-in, so that the receiving entity can prepare for proper processing. > > Disagree from my experience in the anti-abuse industry. First of all > reporting must be easy and receiving reports must be easy as well. [...] > > Second, if you do not want to receive reports from one party, block them > or directly delete them. That is best practice and widely adopted and > really not complicated to do. [...] While this matches my experience -- and I'm sure this will also match with the experience of anybody who has had to handle a large volume anti-abuse operation -- I remember there were times where I wished there was an easier way. The automated reports tend to vastly outnumber the manual reports, which also mix with the loads of spam that are (purposely?) pointed at the abuse contacts. This complicates the task of sifting through the mail flow to direct the complaints into their proper bins for processing. There's also the case of those that don't care about abuse originating from their resources. Those are likely to simply devnull their abuse complaint flow just as they have been doing up until now. I believe that having an optional "auto-abuse-mailbox" object (that is mandatory to use when present) dealing only with automated reports, could help anti-abuse operators (both in the report sending and receiving sides). The automated, high volume generators can decide not to waste resources with entities that do not have the right objects setup (ie, if there's not an auto-abuse-mailbox, do not generate the report) and the entities that are not prepared to deal with automated reports, could signal that to the community by not defining an auto-abuse-mailbox. Note that I still support the notion of a mandatory abuse-mailbox where manual complaints can be sent. At least that takes a way a lot of (guess)work out of figuring out where to send the complaint. Best regards -lem

17 50