9 ms·

I saw this behaviour from MS/Azure IP space about 3 weeks ago; there were so many requests that some dynamic pages started to get slower because of it, so I gav

I saw this behaviour from MS/Azure IP space about 3 weeks ago; there were so many requests that some dynamic pages started to get slower because of it, so I gave in and added Cloudflare in front. It stopped minutes later as per the logs on my servers. Cloudflare blocked 10000s of visits in short timespans. Not sure how to really handle this well without something like cloudflare ; I would block like OP but I cannot risk that for paying b2b clients. We had no complaints at all by the way.

efitz 4y ago
Former AWS security here. Cloud operators are EXTREMELY interested in maintaining the reputation of their IP address space; I promise you that abuse complaints are taken very seriously, investigated and acted on.
- nicolaslem 4y ago
  My only experience with reporting spam sent from SES was a reply a few days later asking me about "additional information" that were all in my original message.
- SeripisChad 4y ago
  My dealings with Microsoft have been along the lines of we don't care, we don't investigate, we simply turn off reported accounts and play wack-a-mole. Our team was complaining from a decent sized Microsoft (a smaller state government, spending millions with Microsoft annually) and got that shoulder shrug of a response.
  - LilBytes 4y ago
    Same here. AWS has acted upon similar reports in the past, Azure may have but the lack of comms and delays in seeing any action (if any) hasn't inspired confidence.
    - red-iron-pine 4y ago
      This is generally speaking the only good thing I have to say about GCP -- they communicate a lot. Don't love all of the other stuff, but I can trust them to get back to me.
  - Aperocky 4y ago
    [flagged]
    - cheeze 4y ago
      I'm sorry, but how does moving to Linux and open source help when someone gets 'attacked' by Microsoft IP space? I like Linux as much as the next guy but I can't help but feel this isn't a very... useful suggestion.
      - Aperocky 4y ago
        The immediate comment being replied to complains about Microsoft's lack of responsiveness in general, and not the problem this article is alluding to.
        FredPret 4y ago
        This is MS as a cloud operator not a software vendor
        saagarjha 4y ago
        Using Linux does not prevent you from getting traffic from Microsoft's IP space.
  - c3534l 4y ago
    From your own admission, they block accounts known to be abusive. I don't know how that's compatible with "don't care" and "don't investigate" - neither of which sounds like something Microsoft would plausibly tell you. What are you basing this impression on?
    - yardstick 4y ago
      Microsoft blocking accounts that are the source of abuse reports doesn’t necessarily mean Microsoft has investigated for themselves the validity of those abuse reports. At least that’s how I interpret what the op was saying. I would hope they did investigate too otherwise it’s too easy to DoS a valid customer with fake complaints.
      - efitz 4y ago
        For a lot of reasons, cloud providers will never tell you how they investigated or what they found out. Telling you only has downside - either they give away information about tools & techniques, or they leak PII of other customers, or you engage them in a protracted discussion which will suck time away from addressing other abuse complaints, etc. So you will never get detail. That doesn't mean that they didn't do anything, it just means that there is no upside for them to sharing details with you.
- wil421 4y ago
  The past year I upgraded my firewall and exposed a plex port. My new firewall gives me notifications and automatically blocks connections to the plex server based on common signatures it knows about. None of my plex users complain or have issues. A couple provides I sent abuse complaints to based on whois lookups responded with automated emails requesting the info in X-ARF format. It’s hard to get some cloud providers to respond to a random residential user. A couple IPs were repeated “scans” by supposed security researchers with IPs out of Hawaii and France.
  - radicaldreamer 4y ago
    Intelligence agencies
    - wil421 4y ago
      Great, you've made me revisit my list of IPs and accidentally type one in my address bar. Whois says it's Palo Alto IP 205.210.31.169 and they hit me back within 60 seconds on port 60001. It is annoying they are trying to scan for vulns, but I will likely block all the ranges I can find. If I find the sketchy Hawaii and French IPs I will post something. Edit: Here you go: https://academyforinternetresearch.org https://academyforinternetresearch.org IP Location United States United States Honolulu Academy Of Internet Research Limited Liability Company ASN United States AS400161 (registered Oct 22, 2021) Whois Server whois.arin.net IP Address 104.156.155.3 NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL
      - 4y ago

efitz 4y ago

Former AWS security here. Cloud operators are EXTREMELY interested in maintaining the reputation of their IP address space; I promise you that abuse complaints are taken very seriously, investigated and acted on.

nicolaslem 4y ago
My only experience with reporting spam sent from SES was a reply a few days later asking me about "additional information" that were all in my original message.
SeripisChad 4y ago
My dealings with Microsoft have been along the lines of we don't care, we don't investigate, we simply turn off reported accounts and play wack-a-mole. Our team was complaining from a decent sized Microsoft (a smaller state government, spending millions with Microsoft annually) and got that shoulder shrug of a response.
- LilBytes 4y ago
  Same here. AWS has acted upon similar reports in the past, Azure may have but the lack of comms and delays in seeing any action (if any) hasn't inspired confidence.
  - red-iron-pine 4y ago
    This is generally speaking the only good thing I have to say about GCP -- they communicate a lot. Don't love all of the other stuff, but I can trust them to get back to me.
- Aperocky 4y ago
  [flagged]
  - cheeze 4y ago
    I'm sorry, but how does moving to Linux and open source help when someone gets 'attacked' by Microsoft IP space? I like Linux as much as the next guy but I can't help but feel this isn't a very... useful suggestion.
    - Aperocky 4y ago
      The immediate comment being replied to complains about Microsoft's lack of responsiveness in general, and not the problem this article is alluding to.
      - FredPret 4y ago
        This is MS as a cloud operator not a software vendor
      - saagarjha 4y ago
        Using Linux does not prevent you from getting traffic from Microsoft's IP space.
- c3534l 4y ago
  From your own admission, they block accounts known to be abusive. I don't know how that's compatible with "don't care" and "don't investigate" - neither of which sounds like something Microsoft would plausibly tell you. What are you basing this impression on?
  - yardstick 4y ago
    Microsoft blocking accounts that are the source of abuse reports doesn’t necessarily mean Microsoft has investigated for themselves the validity of those abuse reports. At least that’s how I interpret what the op was saying. I would hope they did investigate too otherwise it’s too easy to DoS a valid customer with fake complaints.
    - efitz 4y ago
      For a lot of reasons, cloud providers will never tell you how they investigated or what they found out. Telling you only has downside - either they give away information about tools & techniques, or they leak PII of other customers, or you engage them in a protracted discussion which will suck time away from addressing other abuse complaints, etc. So you will never get detail. That doesn't mean that they didn't do anything, it just means that there is no upside for them to sharing details with you.
wil421 4y ago
The past year I upgraded my firewall and exposed a plex port. My new firewall gives me notifications and automatically blocks connections to the plex server based on common signatures it knows about. None of my plex users complain or have issues. A couple provides I sent abuse complaints to based on whois lookups responded with automated emails requesting the info in X-ARF format. It’s hard to get some cloud providers to respond to a random residential user. A couple IPs were repeated “scans” by supposed security researchers with IPs out of Hawaii and France.
- radicaldreamer 4y ago
  Intelligence agencies
  - wil421 4y ago
    Great, you've made me revisit my list of IPs and accidentally type one in my address bar. Whois says it's Palo Alto IP 205.210.31.169 and they hit me back within 60 seconds on port 60001. It is annoying they are trying to scan for vulns, but I will likely block all the ranges I can find. If I find the sketchy Hawaii and French IPs I will post something. Edit: Here you go: https://academyforinternetresearch.org https://academyforinternetresearch.org IP Location United States United States Honolulu Academy Of Internet Research Limited Liability Company ASN United States AS400161 (registered Oct 22, 2021) Whois Server whois.arin.net IP Address 104.156.155.3 NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL
    - 4y ago