bradleyjkemp / abwhose

The simplest way to find how to report abusive domains

[UPDATE] Prefer to use a web UI? You can now use phish.report for even easier phishing reporting

abwhose

The simplest way to find the correct place to report a domain for abuse.

$ abwhose phishing-mcphishface.com

Report abuse to domain registrar:
  Email:     [email protected]
Report abuse to host:
  HostPhish: Submit this form - https://wehostphish.biz/dev/null.php

Never again send an abuse report via email only to get a response days later saying:

Sorry, we only take abuse reports through this online form: https://reallyslow.com/new-report

Instead use abwhose and always send your abuse reports to the correct place the first time.

Installation

brew install bradleyjkemp/formulae/abwhose

Pre-filling abuse email reports

abwhose can automatically open your email client pre-filled with a template of your choice.

To use this feature just:

1. Create an email template file somewhere on your filesystem (see below for an example).
2. Set the environment variable ABWHOSE_MAILTO_TEMPLATE to the path to you template file.

An example template you could use is:

mailto:{{.recipient}}?subject=Phishing site: {{.domain}}&body=To whom it may concern,

Please take down this phishing site: {{.domain}}

Thanks

abwhose's Issues

Abuse address truncated

Hmmpf, what is going on here?

$ abwhose goconversion.com
Report abuse to domain registrar:
  GoDaddy:  Fill out abuse form https://supportcenter.godaddy.com/AbuseReport
Report abuse to host:
  Email:    abuse@a

$ whois goconversion.com |grep abuse
   Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Email: [email protected]



$ dig +short oconversion.com
74.124.197.221

$ dig +short oconversion.com  | xargs whois | grep abuse
OrgAbuseEmail:  [email protected]
OrgAbuseEmail:  [email protected]

Support reporting email addresses

This is a fairly similar problem: maintaining a list of email domain -> abuse contact (however there's no WHOIS data available so this would be purely manual).

Questions to answer:

• How to handle the two slightly different "types" of email domains and phishing domains?
• What information is needed in an email address report? You can just provide a URL for a phishing site but just providing an email address isn't going to work

couldn't find any abuse contact details for domain

Hi

abwhose outputs couldn't find any abuse contact details even when is shows a link to a form?

$ abwhose platefullofthings.com
Report abuse to domain registrar:
  Namecheap: Fill out abuse form https://support.namecheap.com/index.php?/Tickets/Submit
Report abuse to domain registrar:
  couldn't find any abuse contact details
Report abuse to host:
  Send email to [[email protected]]? [Y/n] n

PhishFeed contact page is empty

Hello,

I noticed that https://phish.report/contacts/PhishFeed is empty.

Handle multiple A records

$ abwhose platefullofthings.com
Report abuse to domain registrar:
  Namecheap: Fill out abuse form https://support.namecheap.com/index.php?/Tickets/Submit
Report abuse to domain registrar:
  couldn't find any abuse contact details
Report abuse to host:
  Send email to [[email protected]]? [Y/n] n

Only one host mail address is listed, however the domain has four A records pointing to different hosting providers.

$ dig +short platefullofthings.com
51.255.17.161
144.91.111.126
185.70.187.202
185.5.54.75

Report to phishing lists

Hello,
Would it be possible to add reporting to phishing lists using their APIs?