<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hello All,<div><br></div><div>Total noob here. So please let me know how I can do better.</div><div><br></div><div>I would like to re-introduce the following Policy Proposal from 2003 to hold abuse POCs accountable. </div><div><a href="https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/">https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/</a></div><div><br></div><div><br></div><div>Back story:</div><div>I am an independent consultant often relying on cloud computing to provide services to my customers (which costs me usage money). Lately my server instances have been hammered by vulnerability scanners searching (mostly) for Wordpress and other vulnerabilities. Lately it appears that over 90% of these scans are from IP segments with Microsoft as the registered POC. I use to receive a lot from other segments but using OSSEC we have been monitoring and reporting these instances, and for the most part we have managed to take down a lot of it, save the ones coming from Microsoft. </div><div><br></div><div>Today I discovered that one IP address (belonging to Microsoft) has been scanning our networks for over a month, despite having reported every instance to <a href="mailto:abuse@microsoft.com">abuse@microsoft.com</a>.</div><div><br></div><div>In general when I send an email to an abuse POC, I receive a response, acknowledging the issue, some even issue a ticket number, and usually within 24 to 48 there is a followup email notifying me of the takedown (or if not a valid complaint why not a takedown). Many of the abuse POCs I've reached out to so far, have done so. AWS, Digital Ocean, and many others all do it. </div><div><br></div><div>Yet with Microsoft, Google, and a few others behemoths, I never get a response, which I was OK with, until I realized that for over a month (despite reporting it to <a href="mailto:abuse@microsoft.com">abuse@microsoft.com</a>) a single IP address (172.190.142.176) has been slamming the server, looking for Wordpress vulnerabilities. I will be more than happy to post here those notices, to say the least, I now have a real good shot at the Spamhaus leader board :)</div><div><br></div><div>I reached out to almost every POC I could find on the segments own by Microsoft to enquire why I'm still being scanned by this one host, including their NOC, and even legal, and I have had no response. </div><div><br></div><div>In my correspondence with Mr. Curran (see below), who was kind enough to let me know this was actually not an adopted policy, I quickly realized what the problem is. Accountability. ARIN's current policy lacks any accountability for nefarious behavior by a manager of an IP segment. It has plenty about administrative stuff, save the most important, accountability for abuse. </div><div><br></div><div>The above policy would rectify this issue, and would align the few bad actors with those who (being good netizens) do the right thing and take abusive behavior on their network seriously. I guess they (unlike Microsoft) don't have to fluff up usage for investors. </div><div><br></div><div>I believe this single policy change, where everyone is required to address abuses coming from their managed segments, would make a big difference in companies like Microsoft taking security seriously and not simply allowing script kiddies to abuse their servers (which I imagine help Microsoft bolster usage for the investors). </div><div><br></div><div>I can't imagine that AWS is doing this, open tickets in response to complaints, and following up, if this, at some point, wasn't the way it was meant to be. AWS doesn't do anything for no reason. They may very well have had lawsuits that forced them to do the right thing, is that what's going to take here? It shouldn't. </div><div><br></div><div>I look forward to everyone's questions, comments, and concerns, and any input you all have on how I can turn this document/link Ito a formal policy request, dotting all the i's and crossing all the t's. </div><div><br></div><div>Thanks again,</div><div>Shawn Bakhtiar</div><div><br></div><div><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">Shawn Bakhtiar <shashaness@gmail.com><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;"><b>Re: OSSEC Alert - Level 10 - Multiple web server 400 error codes from same source ip.</b><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">August 27, 2025 at 11:15:59 AM MST<br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>To: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">John Curran <jcurran@arin.net><br></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;"><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);"><b>Cc: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;">"usleainfo@microsoft.com" <usleainfo@microsoft.com>, Michael Abejuela <mabejuela@arin.net><br></span></div><br><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Thank you for your prompt response to my inquiry Mr. Curran,<div><br></div><div>And thank you for the clarification, I was wondering why the only reference I could find to such a common sense policy would be from two decades ago. </div><div><br></div><div>It is very sad (and quite disappointing to say the least), That ARIN "Established in December 1997,... a nonprofit, member-based organization that supports the operation and growth of the Internet," has little to no policy that defines what abuse is in a ~14000 word document that defines all but; despite this clearly causing harm under the CFAA.</div><div><br></div><div>With all due respect, you sir are being complacent, as are those in Microsoft, who do not care about this issue. The fact that the aforementioned policy is NOT part of the final policy is a clear indication of what you and your members truly care about, and it is neither growth (other than those of the few) and it is certainly not about maintaining an health environment on the Internet. </div><div><br></div><div>The fact that may companies, as mentioned before, choose to do the right thing, despite the lack of policy (following the procedures outlined in the 2003 draft policy, see link below), says more about ARIN than any bad actor, abusing the internet. I have navigated the ARIN database and I assure you (as evident by the email bounces I have received in the past), the information is neither accurate nor reliable.</div><div><br></div><div>Please do better. A 60 hour a week workhorse like me should not have to reaching out to you, or any other policy maker, or spend the time making this kind of policy update request, given how common sense and decent the proposed policy is. </div><div><br></div><div>This is costing me (and many like me) money, we are literally having servers using up resources that cost money in responding to a server that should have been downed in 24 hours (had Microsoft, the party responsible for the IP address, done it's job, like so many others already do) and (apparently) ARIN and its members could care less, even though in 2003 there was a clear policy that addressed it. Very curious to find out how that was stricken out. </div><div><br></div><div>I will take the time to offer this policy change updated though the mailing list you provided, but shame on you and ARIN for putting the burden of Microsoft nefarious behavior on me. That I have to take time while the conglomerate get to act with impunity, that this policy is not already included, and that I have yet to hear one word from anyone at Microsoft, despite my many inquires to half a dozen POCs listed on IP segments they "supposedly" manage, says everything I need to know about the state of the ARIN and the internet today. </div><div><br></div><div>Please sir, you are the president, please preside, and doing the right thing, you could easily push this policy update through (you know, I know, they know, it's the right thing to do). </div><div><br></div><div>I would suggest (I will do this via the builtin board as well) that the following propose policy changes be adpoted/renewed by ARIN:</div><div><a href="https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/">https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/</a></div><div><br></div><div>Again, I truly appreciate the prompt response,</div><div>Regards,</div><div>Shawn Bakhtiar</div><div>(310) 208-3000</div><div><br></div><div><div><blockquote type="cite"><div>On Aug 27, 2025, at 9:23 AM, John Curran <jcurran@arin.net> wrote:</div><br class="Apple-interchange-newline"><div>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Mr Bakhtiar –
<div><br>
</div>
<div>You reference a draft policy that was never adopted in the form shown below. Per the community-developed policy that was adopted, ARIN requires organizations to have public Abuse contacts, but there are no specific requirements for response time to abuse
complaints. </div>
<div><br>
</div>
<div>Relevant section from ARIN’s Number Resource Policy Manual - <<a href="https://www.arin.net/participate/policy/nrpm/">https://www.arin.net/participate/policy/nrpm/</a>></div>
<div><br>
</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div><i><b>"3.8.3 Point of Contact Record Creation</b></i></div>
<div><i><b>An organization must register designated Points of Contact to manage its organization and resource registration records to include Administrative, Technical, NOC and Abuse contacts. These Points of Contact shall be representatives of the organization
and any information provided to ARIN shall be that contact’s associated organizational information and not personal data.</b></i></div>
<div><i><b><br>
</b></i></div>
<div><i><b>Point of Contact registration records will generally be visible in the public Whois."</b></i></div>
</blockquote>
<div><br>
</div>
<div>I would recommend that you raise the issue of abusive network traffic directly with Microsoft (or with your upstream ISP as appropriate.) </div>
<div><br>
</div>
<div>Changes to ARIN’s policies may be made via submission of a policy proposal via ARIN’s Policy Devcelopment Process - more details available here - <a href="https://www.arin.net/participate/policy/pdp/">https://www.arin.net/participate/policy/pdp/</a></div>
<div><br>
</div>
<div>Thanks,</div>
<div>/John</div>
<div><br>
</div>
<div>
<div>John Curran</div>
<div>President and CEO</div>
<div>American Registry for Internet Numbers</div>
</div>
<div><br>
</div>
<div>
<div><br>
<blockquote type="cite">
<div>On Aug 27, 2025, at 11:56 AM, Shawn Bakhtiar <shashaness@gmail.com> wrote:</div>
<div>
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div><br>
</div>
<div>ARIN has been clear about it's abuse policy which it formulated as early as 2003, as evident in the following draft recommendations:</div>
<div><a href="https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/">https://www.arin.net/vault/participate/policy/drafts/2003/2003_1/</a></div>
<div><br>
</div>
<div>Which clearly states:</div>
<div><br>
</div>
<div>"</div>
<div>
<div>
<ol class="MailOutline">
<li>With the exception of sudden events of large call volume, shall staff adequately to have live humans answer calls to the listed abuse contact phone number during the hours indicated in the contact record.</li><li><b>Shall have a human being read and respond to abuse complaints received by email within 48 hours of receipt (for complaints received Sun-Thu), and, within 96 hours for complaints received Fri-Sat.</b></li><li><b>Shall be capable of taking action or immediately contacting a person capable of taking action to stop any reported abuse which is in violation</b> of any of the following:</li><li>Shall take appropriate action to stop abuse identified in the previous item as soon after receiving the complaint as practicable.</li><li>Shall respond to the complaint as soon as practicable with information on what actions are being taken to stop the abuse.</li></ol>
</div>
</div>
<div>"</div>
</div>
</div>
</blockquote>
<div>
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div><br></div></div></div></blockquote></div><br></div></body></html>