#12 (amavis-ng) notify based on whois info

closed
Hilko Bengen
None
5
2003-01-22
2002-12-06
Jefferson Cowart
No

I realize that this is probably a long shot and low on any
priority list but would it be possible to add an option to
also send any virus notifications to an adress that is
pulled out of the ip-whois database based on the first
recieved header in the virus infected message. For
instance whenever i recieve a message with a virus i run
a whois on the ip adress of the server in the first
recieved record. I then forward the e-mail to that contact
and abuse@domain.tld. Examing the whois data it
appears that some records have a "OrgAbuseEmail".
This sounds like it would be the right address to send it
to. If that one doesn't exist i would think
the "TechEmail" would be the right one. Thanks for the
great program.

Discussion

  • Rainer Link
    Rainer Link
    2003-01-03

    • assigned_to: nobody --> bengen
     
  • Hilko Bengen
    Hilko Bengen
    2003-01-22

    • status: open --> closed
     
  • Hilko Bengen
    Hilko Bengen
    2003-01-22

    Logged In: YES
    user_id=58184

    I think I am not going to implement this because from my
    experience abuse contact personnel seem to ignore (or treat
    with lower priority) messages that were sent to them
    automatically. Moreover, if not implemented properly,
    automatically generated messages from such a module would
    annoy many unsuspecting admins and cause a bad reputation
    for the AMaViS project. Think SpamCop... ;-)

    If you like, you certainly can implement your idea as a
    AMAVIS::Notify module.

    -Hilko