Re: Strawman abuse report format proposal

On Monday 27 September 2004 21:34, Suresh Ramasubramanian wrote:

> ... and there's the case of stuff like the humongous reports that Dave
> Rand generates (or used to generate?).
>
> Those reports do have their uses.

Few people report spam in aggregate.  I'm not even certain Dave Rand does
anymore.  In any case, I was limiting myself to the issue of a single report,
involving a single spam, which due to a known spammer tactic could
potentially generate a massive report.  This is an edge case, but it's a
known edge case (there's at least one Russian spam operation engaged in this,
hawking "OEM" CDs, and the usual range of perscription medications).

Aggregate "Dave Randed" reports are a seperate issue, and not one I'm certain
needs to be dealt with.  I will, of course defer to the chair if he feels
differently.

Another area the strawman proposal doesn't take in is email addresses.  In
cases of 419 spam, and where the remove-link is an email address, the format
needs an appropriate tag.  I'd suppose that Steve had this in mind, but
simply didn't present an example.  Places where the email address is an
important abused resource are:

1) In 419 spam where the email address is real.
2) In any spam where the remove link is an email address.
3) Where a valid email address is the contact for a spam-advertized domain.

Example:

To: [email protected]

outblaze EMAIL [email protected]

Blah, blah, blah concerning where address was used.

Abused resources include, but aren't limited to:

domains
IP addresses
URLs
Nameservers
email addresses

IP addresses can be spam-origin, or part of a URL (absent a domain), or the IP
that a domain resolves to.

I find the tag "SPAM" to be ambiguous, and somewhat emotion-laden, and would
prefer a more neutral tag with a more exact meaning (SOURCE or ORIGIN,
perhaps?).

--
"Stick a wick in a can of Spam, light it, and the room will glow for hours
with the sweet smell of pressed pig parts..."
                                          --Palm Beach Post, Sept 12, 2004