<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr">
<div dir="ltr" style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<meta content="text/html; charset=Windows-1252" data-ogsc="" style="">
</div>
<div data-ogsc="" style="">
<div>
<div style="direction:ltr">RiskIQ reports phish URLs for large brands </div>
<div><br>
</div>
<div style="direction:ltr">The life cycle of a typical phish campaign is in hours but I guess people can live with 24. If you handle the complaint only after two business days, that�s closing the barn door after the horse has bolted and crossed a state line.</div>
</div>
<div><br>
</div>
<div class="ms-outlook-ios-signature">
<div style="direction:ltr">--srs</div>
</div>
</div>
<hr tabindex="-1" style="display: inline-block; width: 98%;" data-ogsc="">
<div id="divRplyFwdMsg" dir="ltr" data-ogsc="" style=""><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;" data-ogsc=""><b>From:</b> NANOG <nanog-bounces@nanog.org> on behalf of Tom Beecher <beecher@beecher.cc><br>
<b>Sent:</b> Tuesday, April 14, 2020 12:11:18 AM<br>
<b>To:</b> Kushal R. <kushal.r@h4g.co><br>
<b>Cc:</b> Nanog <nanog@nanog.org>; Rich Kulawiec <rsk@gsp.org><br>
<b>Subject:</b> Re: Constant Abuse Reports / Borderline Spamming from RiskIQ</font>
<div> </div>
</div>
<div data-ogsc="" style="">
<div dir="ltr">I would agree that Twitter is not a primary place for abuse reporting.
<div><br>
</div>
<div>If they are reporting things via your correct abuse channel and you are indeed handling them within 48 business hours, then I would also agree this much extra spray and pray is excessive. However RiskIQ is known to be pretty responsible, so if they are
doing this they likely feel like they are NOT getting appropriate responses from you and are resorting to scorched earth. Have you attempted to reach out to them and make sure they have the proper direct channel for abuse reporting? </div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, Apr 13, 2020 at 1:45 PM Kushal R. <<a href="mailto:kushal.r@h4g.co" data-ogsc="" style="">kushal.r@h4g.co</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div>
<div id="x_gmail-m_-8042583123750240336edo-message">
<div></div>
All abuse reports that we receive are dealt within 48 business hours. As far as that tweet is concerned, it�s pending for 16 days because they have been blocked from sending us any emails due to the sheer amount of emails they started sending and then our live
support chats.</div>
<div id="x_gmail-m_-8042583123750240336edo-message"><br>
</div>
<div id="x_gmail-m_-8042583123750240336edo-message">We send our abuse reports to, but we don�t spam them to every publicly available email address for an organisation, it isn�t difficult to lookup the Abuse POC for an IP or network and just because you do not
get a response in 24 hours does not mean you forward the same report to 10 other email addresses. Similarly twitter isn�t a place to report abuse either. </div>
<div id="x_gmail-m_-8042583123750240336edo-meta"></div>
<div id="x_gmail-m_-8042583123750240336edo-original">
<div><br>
<br>
<blockquote type="cite" style="margin:1ex 0px 0px; height:min-content; border-left:1px solid rgb(204,204,204); padding-left:0.5ex">
<div>On Apr 13, 2020 at 9:37 PM, <<a href="mailto:rsk@gsp.org" target="_blank" data-ogsc="" style="">Rich Kulawiec</a>> wrote:<br>
<br>
</div>
<div>
<pre> On Mon, Apr 13, 2020 at 07:55:37PM +0530, Kushal R. wrote: > We understand these reports and deal with them as per our policies and timelines but this constant spamming by them from various channels is not appreciated. Quoting from: <a href="https://twitter.com/RiskIQ_IRT/status/1249696689985740800" target="_blank" data-ogsc="" style="">https://twitter.com/RiskIQ_IRT/status/1249696689985740800</a> which is dated 9:15 AM 4/13/2020: 5 #phishing URLs on admin12.find-textbook[.]com were reported to @Host4Geeks (Walnut, CA) from as far back as 16 days ago, and they are all STILL active 16 days is unacceptable. If you can't do better than that -- MUCH better -- then shut down your entire operation today as it's unworthy of being any part of the Internet community. ---rsk </pre>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>