LILinuxBender·Sep 6, 2022
In my experience, reporting this is a waste of time. The nodes doing the actual spamming and crawling sites for exploits are far removed from the IP addresses you see in your access logs and in your email headers. The actual abusive nodes are talking to multiple rings of compromised command-and-control hosts a.k.a. C&C hosts. Those hidden command-and-control hosts then control compromised hosts that you are seeing in email headers and access logs. For every one node taken offline there will be a myriad of compromised nodes in their available pool to take over. Blocking nodes is an endless game of whack-a-mole. The people your VPS provider gave your contact info to are likely also victims of bots and would have no idea how to fix the problem. VPS providers are also not going to disable all the compromised VM's as many of those peopl
Read the rest
e will not take responsibility and will instead get upset with the VPS provider and move to a different provider and this has financial ramifications.
Most VPS providers don't have the technical resources to track down the command-and-control nodes. This requires a higher level of visibility they do not have. The folks that have this level of visibility will not likely assist with bot noise unless the bots are also being used to steal government secrets or embarrass government officials or attack public infrastructure. There are ways to trick some of the bots into attacking public infrastructure but I would not want to be caught up in that legal quagmire as I am easy to find and bot owners are not.
In summary, the best one can do is either configure systems to discard the noise in web logs and block low reputation IP addresses in their mail servers or if one feels the desire to do something, create tarpits/honeypots for the bots to get stuck in. Tarpits have very little impact on bots but if one wanted to feel like they were doing something it's a start. For example, I have numerous nodes that accept email for all the popular domains. Spam bots think they are relaying thousands of emails through my nodes per day but that is a tiny fraction of a tiny fraction of the spam that people will receive. I am not even making a tiny dent in the problem.
As a side note, there are ways to block some of these bots if you control your web and email servers but that is another topic all together and if too many people implemented such techniques then the bot developers would evolve around it. Apologies if this sounds defeatist. Some use blocklists [1][2] to reduce the noise on their web servers and RBL/RSL [3][4][5] servers to reduce the noise on their mail servers but this has limited efficacy and I think it just takes up memory by increasing the routing table or takes up CPU by making large ipset lists for iptables.
[1] - https://github.com/firehol/blocklist-ipsets
[2] - https://github.com/StevenBlack/hosts
[3] - https://www.uceprotect.net/en/index.php?m=6&s=0
[4] - https://www.spamcop.net/fom-serve/cache/291.html
[5] - https://www.spamhaus.org/zen/