Bizarre (.bz) abuse report - are we alone?

Mon Aug 27 02:35:54 UTC 2012

OK, we're pretty vigilant about policing abusers on our network.  This
just showed up from "no-reply at abuse.bz".  Please see my responses
inline.  Mail origin IP is from an ISP in the Netherlands.  Some
information redacted to protect the guilty.

Is this type of thing typical these days and we're just lucky so far and
behind the curve on the futility of trying to take action on reports of
network abuse?

-------- Original Message --------
Subject: Re: Illegal activity from 207.71.241.252
Date: Sun, 26 Aug 2012 19:13:39 -0700
From: Jay Hennigan <jay at west.net>
To: [redacted]
CC: [redacted]

Sent to RIPE WHOIS contacts for mail origin IP [redacted].

On 8/25/12 3:29 PM, no-reply at abuse.bz wrote:
> We have noticed illegal activity from [redacted] aimed at one of our servers.
> Please disable these brute force attempts, port scans and/or neighbour scanning technologies.

> If you are not sure how to, please use Google to find more information about the SPT/DPT (source/destination port).
> Alternatively, consult with your system administrator, forums, communities and any other sources of help.
> 
> PLEASE NOTE: We have replaced our own IP with 127.0.0.1 for privacy and security purposes.
> The destination IP address does not matter because you should solve your exploits properly instead of nullrouting our IP.
> With the exact time, IP address, source port and destination port you have plenty of information to address this issue.
> Our IP address is not mentioned anywhere and there are no DNS records pointed to it - hence we know your IP address is being abusive.

This report isn't particularly helpful.  In fact, it in itself is
somewhat abusive of our time.

First, I had to dig through the headers of the email to find a
(hopefully) deliverable address to which I could respond.

Second, these logs seem to be two attempts to visit a website within a
very short period of time.  Two tries each on TCP 80 and TCP 443.
Hardly what most reasonable people would call a brute force attempt,
port scan, etc.  No typical exploit ports, no brute force hammering,
just an attempt to connect to a web server, retried once for 80 and 443.

Do you think it would be reasonable for us to query our customer and ask
if someone there might have fat-fingered a web address on one of 70+
workstations yesterday, or that someone at any of tens of thousands of
nameservers worldwide has fat-fingered the A record of some random website?

This report appears to be robot-generated, and deliberately designed to
make it difficult for a human to reply, being sent from a write-only
mailbox.

By masking the destination IP of a web request, you make it rather
difficult to track it down in the event that it is indeed abusive in the
first place.

NOC personnel and resources are a finite resource.  You appear to be
robo-sending abuse reports that are:

1. Sent from a write-only mailbox
2. Containing logs deliberately modified to prevent tracking the abuse
3. Depicting activity that doesn't appear to be abusive

Already, abuse departments at ISPs are generally shorthanded.  This type
of thing is even more likely to cause legitimate reports to be ignored.

If you feel that this warrants further attention, please respond with a
message that is:

1. Sent by a human being.
2. Has a deliverable reply address.
3. Demonstrates activity that indeed constitutes abuse.
4. Contains logs of the abuse sufficient for us to take action against
our customer (such as the IP address being abused, or at least the subnet).

> Here are our raw firewall logs, limited to 100 lines with timezone Central European Time. There is also an timestamp since epoch (UNIX time).
> ==
> [2012-08-25 01:01:30 CET] [Timestamp: 1345849290] [11883637.767804] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=64182 DF PROTO=TCP SPT=56463 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
> [2012-08-25 01:01:31 CET] [Timestamp: 1345849292] [11883639.265682] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=44605 DF PROTO=TCP SPT=57003 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0
> [2012-08-25 01:01:38 CET] [Timestamp: 1345849299] [11883646.105990] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=39054 DF PROTO=TCP SPT=33537 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0
> [2012-08-25 01:01:38 CET] [Timestamp: 1345849299] [11883646.411775] Firewall: *TCP_IN Blocked* IN=eth0 OUT= SRC=[redacted] DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=58 ID=37931 DF PROTO=TCP SPT=33645 DPT=443 WINDOW=5840 RES=0x00 SYN URGP=0
> 

-- 
--
Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net
Impulse Internet Service  -  http://www.impulse.net/
Your local telephone and internet company - 805 884-6323 - WB6RDV