Been processing abuse tickets for six years now. The ticket said "this IP is hosting a phishing site." The ticket said "your customer is running a stresser." The ticket said "unauthorized cryptocurrency mining." You know what else the ticket said, three weeks before the provider vanished? Nothing. Radio silence. NOC stopped responding to abuse at all.
So here's the idea. We maintain a quiet watch. Not doxxing, not drama. Just signals. Sudden abuse desk slowdown. Ticket auto-responses changing. WHOIS updates stalling. Subtle stuff. I've called three dead pools before they announced it. The ticket said "we're investigating" for eleven days straight. Then poof.
Who's in? Need people with different vantage points. NOC staff, resellers, abuse handlers, even customers watching their dashboard get stale.
Ground rules: no public accusations. Private aggregation only. When confidence hits threshold, we quietly warn our own networks to diversify. That's it.
