[anti-abuse-wg] Hold time for abused address space - DNSChanger IP's reallocated

Tobias Knecht wrote:
> Hi everybody,

Hi,

as a blocklist operator, we simply drop every record
for an allocation, if the abuse email address
changes.

Its kind of fuzzy, but works, new records will
appear quick enough from an allocation, if
its still the same abuser, only with a new abuse
email address.
And no records will appear, if its a real
re-allocation hardly used so far.

Other operators might use other fields, but
the method is the same, keep track of the
fields you are interested in and drop
your records, reputation history or spam
count or whatever for this allocation,
if it changes.

You dont even have to store the real information,
you can simply store a hash value :o)


Kind regards, Frank

>
>> When nothing else works, blocking a range is what remains. Yes,
>> blocking could be made better, for example some feedback from
>> registries when a block has been reallocated might be of value. This
>> info could be announced in by RIPE et.al. so blocklist operators may
>> pick up this info.
>
> This is a great idea and an option that has been discussed at other
> institutions already. I will put this on my list for future discussion
> and I bet this would really help a lot if blacklists are willed to use
> the offered information.
>
> Thanks,
>
> Tobias
>


-- 

Mit freundlichen Gruessen,
--
PHADE Software - PowerWeb                       http://www.powerweb.de
Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
Schinkelstrasse 17                                fon: +49 33200 52920
14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
======================================================================