Abuse Desks

Wed Apr 29 05:13:38 UTC 2020

On Tue, Apr 28, 2020 at 08:45:12PM -0700, Dan Hollis wrote:
> On Tue, 28 Apr 2020, Matt Corallo via NANOG wrote:
> > Please don't use this kind of crap to send automated "we received 3 login attempts on our SSH box..waaaaaaaaa" emails.
> > This is why folks don't have abuse contacts that are responsive to real issues anymore.

> Thats what SBL is for.

Do you recommend that we use a DNS blacklist to check every SSH and
HTTPS connection attempt, about whether it should be filtered or not?

Ultimately if there is scanning happening from an IP address delegated
to someone, isn't their abuse@ responsible for handling the complaints?
What are "real" issues?

We have scanning happening on ssh, https, SIP, SMTP submission ports
everyday. fail2ban does a good job blocking many of these, but
ultimately should the scanning problem be ignored?  Is nobody ultimately
responsible to stop these hosts from scanning?

		Mukund