5 ms·
I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on
by stephengillie 8y ago
I suggested something similar while working at an AWS competitor - automated RBL searching. A huge number of our public IPs were used by spammers or phishers on the free tier. They would use a public IP until it was blocked, then release that and get another from the pool.
As a cloud host, it's embarrassing to have to explain to your customers that their shiny new IP is on an RBL because it was last used to steal passwords.
- chatmasta 8y agoDid this company have an automated process for dealing with abuse tickets? Usually you’ll get at least one abuse ticket before an IP is added to RBL, right? It shouldn’t come as a surprise when your IP is added to the list after you’ve had X number of abuse complaints about the IP. Seems like a better (or at least, complementary) solution would be more proactive monitoring of the abuse@ email and prompt terminations of clients who generate too many complaints.
- stephengillie 8y agoWe didn't have an automated process - we manually investigated and shut down accounts. On the supply side, we had poor fraud detection, also manual, almost entirely one person. There was lots of room to automate things like this, but instead we had a robust internal Powershell library and numerous Slack bots. They embraced the "do things that don't scale" mantra a little too literally.
- wjoe 8y agoSadly, the more common practice seems to be adding the entire IP blocks of known server/cloud providers to blacklists.
- chatmasta 8y agoDefinitely true in my experience, which is funny because it renders the whole point of the RBL entirely moot. It’s certainly not a sustainable solution.
- deleted 8y ago[deleted]
- howard941 8y agoIt's comparable to using an RBL that excludes dynamic IP clients. The difference is one of culpability IMO, where the dynamic IP clients are likely to be innocents with compromised boxes but these cloud instance spammers are actively hostile (insofar as spammers are hostile)
- james-skemp 8y agoI think I experienced this. Received an email from campus IT that my phone was compromised. On further digging I would load up a game every once in a while on the campus wireless. That game used a popular/legit Chinese CDN to host something on their news page which was flagged. Easier to just use my wireless phone package instead of explaining my phone wasn't compromised.
- gowld 8y agoThen it's not a shiny new IP; it's a tarnished used IP that hasn't been refurbished.
- Qwertie 8y agoWhich is the only reality on ipv4