Is it pointless to report hosting Abuse? I do not believe it to be a waste of time. I regularly make reports for my personal systems for two types of abuse. 1

Is it pointless to report hosting Abuse? I do not believe it to be a waste of time. I regularly make reports for my personal systems for two types of abuse. 1. Email: phishing/spam 2. Text: a) political spam b) banking fraud Positive instances. Results vary by the abuse@ owner. In cases where there is a successful take-down or escalation, I typically receive a positive response within 24 hours. Gandi.net and AWS are examples of an abuse@ that responds quickly. These types of escalations take ~5 minutes of my time when the data includes a screenshot of the activity/logs + whois details. Some instances take longer. I have an ongoing escalation with Microsoft that started at abuse@microsoft, was redirected to junk@o365, and has now been redirected to abuse@azure. I assume Microsoft is just a massive org and there are inefficiencies. While somewhat arduous, I have received a response ~24 hours from Microsoft staff, and they have been helpful in forwarding the requests. Some instances may be successful and have no response. I have never received a response from SendGrid (small number of escalations); however, the group associated with the activity appears to have been kicked off SendGrid or moved to Microsoft services. This is the same group I am escalating to Microsoft. Some instances are not successful. For text message spam, I have found that bandwidth.com (owner of the source phone number) will only forward the complaint to their downstream customer w/o identifying the customer. Similar to what you have described. My bandwidth.com experience includes cases of what I would consider excessive abuse. Note that the downstream customer for bandwidth.com may not be the consumer of the phone number, rather a reseller of the phone numbers (if I understand their responses correctly) I have never received a response from godaddy for any type of escalation. I do not recall a single escalation to godaddy ever resulting in a takedown. reported by hundreds of others on sites like AbuseIPDB, etc. A report to a blacklist is not equivalent to a report to an abuse@ address. A few of my opinions/experiences working at the ecosystem / platform level: - IP addresses for abuse may be highly ephemeral. Professionally, I've run into many occurrences of AWS Lambda (and other serverless) IP's being marked as malicious. This is not limited to Lambda, but it provides a good example, as the owner of a serverless function often has no control over their public IP addresses. - Data quality can be a major problem with crowdsourced abuse lists. Especially when it comes to evidence, last_seen timestamps, and classifications. This can be an impairment to monitoring these lists as a provider. In summary, I've been able to do take-downs on banking fraud that took me less than five minutes. I have also had some failures and these can be frustrating. I don't mind doing the escalations, and in total I spend less than 20 minutes a week on this. I do hope that you continue to try. Further details to the above anecdotes are linked in my profile. *edit for formatting.