Abuse Report: Spam. Anyone else seen this from Vultr?

Off-Topic
1

Has anyone else using Vultr received questionable abuse reports recently?

I have had two so far today, both against separate FreePBX 16 systems. One alleging Poshmark phishing emails, and the other Etsy. Both came with automated warnings about potentially suspending the servers.

I spent a good part of this morning investigating the first PBX and submitted a fairly extensive investigation report to Vultr, detailing everything I had checked and asking for more evidence to support the allegation.

Before receiving any response to my report, another complaint arrived against a different PBX, roughly 13 hours after the first.

I have just finished carrying out the same investigation on that machine, with the same results. Neither server operates a public mail relay, both send routine notifications through external SMTP relays on port 587, and neither complainant’s email address appears anywhere in the available mail logs. I have also checked processes, scheduled tasks, web activity and network connections, with nothing suspicious identified. As a precaution, I have blocked port 25 on both systems.

What’s strange is the timing of the second report. It arrived at 15:55 UTC, but the alleged abuse was timestamped 21:23 UTC on the same day (today). It’s now 16:30 UTC. Apparently, our server managed to send phishing emails more than five hours into the future!

I have raised this with Vultr in a separate ticket and asked how they have attributed these emails to our IP addresses.

I’m not suggesting the logs prove the systems aren’t compromised, but two unrelated allegations against separate PBXs on the same day, with no supporting evidence that I can find, seems rather odd.

These are production phone systems, so the threat of suspension based on questionable reports from an automated abuse mailbox isn’t particularly reassuring.

It’s extremely frustrating because you can’t simply ignore these warnings. I get the impression the abuse process is completely automated, which is a pretty bad system considering the severity of the threat to suspend. If I respond quickly, Vultr should too.

I appreciate that Vultr have to take abuse seriously, but surely there needs to be some accountability on the reporting side too. Otherwise, what’s stopping someone from deliberately targeting innocent providers with fake complaints?

As a partner, I know I can escalate this with them, but I thought I’d see what you guys have to say first.

Thanks,
Kieran

2

I just investigated a Poshmark one this morning. It had no basis in reality.

3

Thanks Andrew. It seems like someone has figured out how to communicate with providers by way of abuse reports and cause massive disruption. It has certainly wasted my day today and I don’t have time for this. Else, it’s a genuine compromise and someone is then covering their tracks. I can’t find any reason whatsoever to even begin suggesting it’s genuine, but Vultr’s automated systems might not see it that way. It’s the first time I’ve ever received such a report.

4

Unfortunately, until Vultr figures it out you should still respond to any reports you receive. They will consider a non-answer actionable.

5

Just received from Vultr:

Hello,

We’re aware of an increase in unsolicited abuse-report tickets being generated and sent to customers today. Our teams are actively investigating, and the reports appear to be associated with a broader spam campaign rather than legitimate abuse activity.

For now, you can disregard the suspicious reports associated with this issue while we continue our investigation. We’re also reviewing measures to prevent additional unnecessary tickets and notifications.

We apologize for the confusion and inconvenience. We’ll share further updates as more information becomes available.

–Vultr Trust & Safety–

6

And that’s why I posted here. Thank you, I can stop stressing now.