From jerome.bouat at wanadoo.fr Mon Dec 8 16:53:38 2008 From: jerome.bouat at wanadoo.fr (=?ISO-8859-1?Q?J=E9r=F4me_Bouat?=) Date: Mon, 08 Dec 2008 16:53:38 +0100 Subject: [anti-abuse-wg] Thunderbird automatic SPAM reporting to ISP Message-ID: <493D4302.4050803@wanadoo.fr> Hello, I would like to develop a SPAM fighting extension of the Thunderbird email client. On the contrary of existing plugins, this new plugin would allow each end-user to report SPAM directly to the right ISP instead of delegating it to a centralized service. This solution distributes the cost between all the spam reporters. For that, I need to know which ISP hosts a given IP. Of course, I can write a wrapper of the http://www.db.ripe.net/whois portal. However I'm searching a more efficient way. For example, we could use a compressed database file on ripe.net (or on bittorrent network) and local caching on each email client. I would like to discuss this with the list and provide the most efficient solution for everyone. Thanks for your advise. Regards. From fredrik at resilans.se Tue Dec 9 10:12:32 2008 From: fredrik at resilans.se (Fredrik Widell) Date: Tue, 9 Dec 2008 10:12:32 +0100 (CET) Subject: [anti-abuse-wg] Thunderbird automatic SPAM reporting to ISP In-Reply-To: <493D4302.4050803@wanadoo.fr> References: <493D4302.4050803@wanadoo.fr> Message-ID: On Mon, 8 Dec 2008, J?r?me Bouat wrote: > Hello, > > I would like to develop a SPAM fighting extension of the Thunderbird email > client. > > On the contrary of existing plugins, this new plugin would allow each > end-user to report SPAM directly to the right ISP instead of delegating it to > a centralized service. This solution distributes the cost between all the > spam reporters. > > For that, I need to know which ISP hosts a given IP. > > Of course, I can write a wrapper of the http://www.db.ripe.net/whois portal. > However I'm searching a more efficient way. For example, we could use a > compressed database file on ripe.net (or on bittorrent network) and local > caching on each email client. > > I would like to discuss this with the list and provide the most efficient > solution for everyone. Actually, you can not rely on the ripedb to give you the right ISP for an ip-address. The only correct way to get the right ISP is to look in the bgp-table, which origin-AS the ip-adress has, and then do a lookup on that AS-number to get the correct recipients of the spam-report. > > Thanks for your advise. > > Regards. > > > -- Mvh Fredrik Widell Resilans AB http://www.resilans.se/ mail: info at resilans.se , fredrik at resilans.se phone: +46 8 688 11 82