I'm talking about side projects that are little more than forums to 9 figure/year eCommerce companies I find big providers to be more of a problem with comment, review, etc. spam.
Whether they spend a large amount of money mitigating it or not, the fact that the quality of Tor [proportional to traffic] is not substantially worse compared to a VPN provider on those networks in my experience doesn't fill me with confidence that your solution would actually work.
> But that's why the big networks have outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean.
Any suggestions on how to get them to actually respond within a reasonable amount of time and with a substantial response (rather than a brush off) to things like people testing out credit cards to place fraudulent orders via their IP Space / VPNs?
Some VPNs do fight abuse. Others are basically like Tor: they ignore it. The best thing you can do in those cases is indeed just block their IP space. Cross-checking the global routing tables can be a good way to enumerate their IP space. Sorry.
A) Provide VPNs themselves to the general public. [e.g. Their web proxies]
B) Provide infrastructure used by VPN providers.
So yes, I was including those two.
Microsoft provides infrastructure to VPN providers as well via Azure, so they also qualify.
Facebook would not.
Other providers that qualify:
Every hosting company that provides dedicated or VPS. [e.g. Linode, OVH, Hetzner]
I just don't bother publicly calling people out on what appears to be a systemic problem. A problem that, frankly, Tor is no worse than any of the other actors.
To me, the odd behavior is the fact CF seems to treat them as bad actors despite the fact they are an insubstantial portion of the problem.
It may not seem like it when you're receiving abuse from those networks anyway, but it'd be much, much worse if they weren't doing the work at all.
So to me, I don't understand why people complain about Tor when the real problem is the fact the larger networks simply take too damned long and throw far, far greater problems at people.
To me, the idea of blocking/throttling Tor more heavily than any other provider seems patently absurd for that reason.
I understand other people may have different experiences but that doesn't create a great deal of sympathy from me when a simple white list option takes 4-5 years.
Can you point out how VPNs fight abuse?
Others do keep logs and use them. Guess what? They're not pointless. Lots of people don't require absolute anonymity against everyone - they just want to get over a particular firewall or shield their IP address from one particular network. But they don't include the VPN provider (or host country) in their threat model.
If you're talking about email spam, then Tor blocks SMTP outbound, and big webmail services all treat send attempts from Tor with suspicion, so yeah you'd not see much direct SMTP spam from them.
And yes, Tor tends to already be blocked by any reasonable abuse filter, whereas the big networks are too-big-to-block, so that's where spammers focus their efforts. But that's why the big networks have full time outbound abuse teams (what I used to work on) and do spend significant sums of money on trying to keep their networks clean.
You can argue that they're not doing enough, but when it comes to stuff like that, there is always more that can be done.