<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 10pt; color: #000000'>Centralized logging and run the analysis on the aggregate. You're more likely to catch them that way. No, it isn't guaranteed, but it's easier.<br><br><div><span name="x"></span><br><br>-----<br>Mike Hammett<br>Intelligent Computing Solutions<br>http://www.ics-il.com<br><br>Midwest-IX<br>http://www.midwest-ix.com<span name="x"></span><br></div><br><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"Hal Murray" <hgm+nanog@ip-64-139-1-69.sjc.megapath.net><br><b>To: </b>nanog@nanog.org<br><b>Cc: </b>"Hal Murray" <hgm+nanog@ip-64-139-1-69.sjc.megapath.net><br><b>Sent: </b>Thursday, April 30, 2020 2:59:43 AM<br><b>Subject: </b>Re: Abuse Desks<br><br><br>Mike Hammett said:<br>> IMO, the answer is balance.<br>> - Handful of SSH connection attempts against a server. Nobody got in,<br>> security hardening did it's job. I don't think that is worth reporting. -<br>> Constant brute force SSH attempts from a given source over an extended period<br>> of time, or a clear pattern of probing, yes, report that. <br><br>The bad guys have already gamed that system. If you have a zillion bots, you <br>can have each bot try a different name/password on a large batch of IP <br>Addresses. A victim only sees one try from each bot.<br><br>The daily logwatch reports that land in my mailbox are full of ssh attempts<br>that end with ": 1 Time".<br><br>-----------<br><br>Matt Corallo said:<br>> I'm open to ideas on what to do here, but the abuse system as it exists today<br>> is clearly broken for me, and its clearly broken for AWS/GCP/Azure/OVH/etc -<br>> have you ever tried emailing their registered abuse contacts? I have, the<br>> problem doesn't go away and there are no responses. <br><br>> especially given most of the real crap out there comes from hosting providers<br>> like the above who don't have the bandwidth to respond.<br><br>"don't have the bandwidth" is an interesting term. Is that because the <br>problem is really hard and it would take a lot of bandwidth/money/whatever, or <br>because they choose not to spend money on it and the rest of the net is <br>letting them get away with it?<br><br>----------<br><br>Tom Beecher said:<br>> Abuse departments should be properly handling LEGITIMATE abuse complaints.<br>> Not crufty background noise traffic that is never going away. <br><br>Agreed. But the abuse desk is the only place where somebody can find the <br>signal in the noise, and with the current pattern, much of the signal is <br>trying to hide in the noise. The abuse desk will only see the signal if <br>people actually send in abuse reports and the abuse desk actually looks at <br>them.<br><br>----------<br><br>Laszlo Hanyecz said:<br>> A lot of this other stuff is just people abusing the abuse contacts to get<br>> someone else taken offline. Phishing websites fall into this category -<br>> it's not network abuse, it's just content someone doesn't like, and one way<br>> to get it taken down is to threaten the network that carries the traffic for<br>> it.<br><br>I don't report phishing websites unless somebody spams me with the URL.<br><br><br>-- <br>These are my opinions. I hate spam.<br><br><br><br></div><br></div></body></html>