A few weeks ago I reported a small botnet which is coming from the network of a big Internet provider.
They asked me for more details which I provided. But the attack is going for weeks already and from our side it looks like they haven't done any action to stop it.
Because traffic follows very specific patterns, we managed to split and block most of it with fail2ban, but still every day we are adding new IPS to block - so far we have banned around 1700 IPS.
I expect them to inform their customers about being part of the botnet and also stop the bad traffic hitting our servers. Is it a reasonable expectation?
How long does it usually take for bigger internet providers to perform any actions against botnet?
How to successfully report DoS attack incoming from Big ISP?
I would like also to hear how in reality such requests are processed by bigger ISPs. From my current experience (it's not the first time) looks like abuse reports are to great extend ignored.