Running some servers I noticed increased SSH Brute Force Login Attempts over the years. fail2ban is a great tool which massively slows them down and can email the abuse-mailbox/OrgAbuseEmail of the network admin's IP range by querying the RIPE Database automatically.
The login attempts mostly stem from networks of companies I would trust to be at least interested in fighting abuse (not some bullet-proof servers in overseas).
- Are Brute Force Login Attempts considered abuse at all?
- As I am not a hosting provider for arbitrary customers but merely a server admin, I have no clue whether I would simply disregard/drop those automated email as a hosting provider or whether I would take action. Personally, I never received any complaint, so I really don't know.
- Can I trust the data on RIPE? Can automated email to the abuse contact be abused itself, if enabled?