We Got Yelled At by Amazon So You Didn’t Have To

Summary: GreyNoise runs a global sensor network of thousands of honeypots across more than seventy countries, and on an average day more than 600,000 different IPs complete hundreds of millions of sessions, about half of them attacks. Occasionally an attacker compromises one of these sensors and briefly uses it for scanning or malware deployment, which triggers an AWS Abuse Report asking the company to shut it down and remediate.
Bottom line: The company's own decoys get popped often enough that AWS abuse notices are a routine operational event - a reminder that a deliberately vulnerable sensor fleet generating hundreds of millions of sessions a day still cannot guarantee it catches every compromise before the cloud provider does.

Read the original at GreyNoise Blog ↗