[anti-abuse-wg] Question about spam to abuse inbox

Cynthia

We’ve had to block some services from our abuse mailbox as they were sending us an insane volume of low quality reports.

I’m not sure what the cut off point would be, but we’ve tried to engage with some of these services in the past and they never reply so they’re basically spammers as far as we’re concerned and dealing with their useless reports was a waste of our resources.

I know quite a few companies now use specific forms for handling reports of different types of reports and have moved away from email almost entirely, which makes a lot of sense.

Regards

Michele


--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
https://www.blacknight.com/
https://blacknight.blog/
Intl. +353 (0) 59  9183072
Direct Dial: +353 (0)59 9183090
Personal blog: https://michele.blog/
Some thoughts: https://ceo.hosting/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,R93 X265,Ireland  Company No.: 370845

From: anti-abuse-wg <anti-abuse-wg-bounces at ripe.net> on behalf of Cynthia Revström via anti-abuse-wg <anti-abuse-wg at ripe.net>
Date: Thursday, 18 February 2021 at 12:40
To: anti-abuse-wg at ripe.net <anti-abuse-wg at ripe.net>
Subject: [anti-abuse-wg] Question about spam to abuse inbox
Hi aa-wg,

For some context, today and yesterday I have been receiving spam in the form of fake abuse notices to my abuse contact email address.

Is there a generally accepted standard for when it's okay to block an address or a prefix from emailing your abuse contact?

I consider being able to contact the abuse email address of a network a rather important function, so I prefer not to block it.
But also as I have more relaxed spam filters for the abuse contact to make sure nothing gets lost, it feels like blocking the address/prefix is my only option other than manually filtering through these emails (10 so far in total, today and yesterday).

So back to the question, is there a generally accepted point at which blocking an address/prefix is fine?

Thanks,
-Cynthia
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/anti-abuse-wg/attachments/20210218/e0d38a26/attachment.html>