Quarantining infected hosts (Was: FBI tells the public to call their ISP for help)

Sean Donelan sean at donelan.com
Mon Jun 18 15:16:56 UTC 2007

On Mon, 18 Jun 2007, Suresh Ramasubramanian wrote:
> On 6/18/07, Jeroen Massar <jeroen at unfix.org> wrote:
>> Of course, though 25 is (afaik ;) the most abused one that will annoy a
>> lot of other folks with spam, phishings and virus distribution, though
>> the latter seems to have come to a near halt from what I see.
> Read these and weep, then -
> http://darkwing.uoregon.edu/~joe/port25.pdf
> http://darkwing.uoregon.edu/~joe/zombies.pdf
> As Joe says (and I agree), trying to fix infected hosts on your
> network by blocking port 25 is like treating lung cancer with cough
> syrup.

The great thing about opinions is everyone has one.

See also


Or how about


The best answer is probably paying for a strong ISP abuse team.  But for 
whatever reasons, some ISPs prefer to invest in other areas.

More information about the NANOG mailing list