mainIPQ BDB filter - Support: sr #110246, abuserdap

 
 

sr #110246: abuserdap

Submitter:  Alessandro Vesely <ale2003>
Submitted:  Mon 08 Jun 2020 05:45:28 PM UTC
   
 
Category:  Documentation Priority:  5 - Normal
Severity:  3 - Normal Status:  In Progress
Privacy:  Public Assigned to:  ale2003
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 08 Jun 2020 05:45:28 PM UTC, original submission:  

abuserdap(1)                          ipqbdb                          abuserdap(1)

NAME
       abuserdap - query rdap servers for abuse addresses

SYNOPSIS
       abuserdap [_option_...] server-or-file-or-IP

DESCRIPTION
       This utility is does not depend on the rest of ipqbdb except for the
       circumstance that it may be useful to send complaints to the relevant abuse
       team.  Complaints per IP can be gathered from log files using a script like
       ibd-report.  Except for legitimate users mistyping their passwords and few
       other cases, cougt IP addresses relate to hosts infected by some kind of
       malware.  Abuse teams can forward complaints to the relevant admins, who
       can in turn clean their hosts.

       The utility outputs zero or more email addresses, and possibly the source
       URL.  It reads the JSON data and looks for "email" elements in a jCard, if
       it has a "type" property and it is not "abuse" the address is discarded.
       It also checks that the relevant "role" array contains the string "abuse".
       Finally, abuserdap outputs a line containing all the abuse email addresses
       found, separated by commas.  If requested, a second line of output contains
       the source URL.

       The server-or-file-or-IP argument can be any of an URL, a file, or an IP
       address, tried in that order.  The URL query format is described by RFC 7842.

OPTIONS
       One-char options can be grouped.

       -h, --help
           Output a short help and exit.  For convenience, the URLs of known RDAP
           servers are also displayed.

       -l  Use syslog (LOG_DAEMON) instead of stderr.  Errors encountered while
           parsing the parameters are written to stderr anyway.

       -m  Increase the max number of redirections.  It defaults to 3 and is
           incremented for each repetition of this option.  3 should be enough for
           bootstrap to redirect to a RIR, and that to redirect to a national
           registry such as, e.g., rdap.registro.br.

       -s  Display the source URL.  The utility follows an HTTP redirect code
           once.  The output URL can be the followed location or the initial
           server-or-file argument.

       -v  For increased log verbosity, possibly repeated.

       -x file
           Exclude the addresses found in file.  This option must be followed by
           an argument consisting of a path to a readable text file.  Lines in the
           file that start with a hash ("#") are comments.  The other lines are
           searched for each address found, using strstr(3).  If the search
           succeeds, the address is discarded

       --version
           Print version number and exit.

EXIT STATUS
       The exit status is 0, 1 for bad arguments, or 2 for runtime errors.

EXAMPLE
       Display the abuse team address for a given IP address 192.0.2.3:


          abuserdap http://rdap.arin.net/bootstrap/ip/192.0.2.3


       Get abuse addresses and source server query URL in a bash script:


          readarray -t <<< "$(abuserdap -x bounce.list -vs \
             http://rdap.arin.net/bootstrap/ip/192.0.2.3 2>>rdap_errlog)"
          address=${MAPFILE[0]}
          source=${MAPFILE[1]}
          if [ -n "$address" ]; then
             # send complaint to the abuse team...
          fi


Alessandro Vesely <ale2003>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ale2003 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code