Monday we received their usual spam about our exit-node sending spam, and of course instead of implementing the TorDNSEL on their sites, they rather want us to block a whole /24 range.
Anyhow, one line caught our eyes:
"Tor: Please note as the abuse from Tor has gotten out of hand, we do not give free passes to abuse coming from Tor exits. See the leader board linked below for more details on the issue."
They also include a link to some fancy unresolved abuse ranking[1].
From that ranking we can see that they currently have 116 unresolved Tor abuse cases and at least 500 unresolved non-Tor cases. Assuming that 616 cases are enough we can try to calculate with 99% certainty, the true interval of the difference in Tor and non-Tor abuse.
We will use 500/616 = 0.812 as an estimate for all non-Tor abuse and we will use 116/616 = 0.188 as an estimate for all Tor abuse.
One can easily calculate that there is a difference of 62.3% between the 81.2% non-Tor and 18.8% Tor abuse cases.
However this percentage (62.3%) is just one impression of a sample. Imagine we would sample 100 hosters just like webiron and then see what their difference is. And we want to be 99% sure that our measured value is within the interval. The formula can be found here[2].
Then we would receive an interval from 0.51 to 0.73.
What this boils down to:
If we were to check 100 companies that send abuse reports like Webiron, in 99 cases we would find a difference between Tor and non-Tor abuse to range between 51% and 73%:
Two concrete examples:
Tor abuse could be as high as 24.5% (lower end of the interval -> 0.51 = 75.5 non-Tor - 24.5 Tor) or as low as 13.5% (higher end of the interval -> 0.73 = 0.865 Non-Tor - 0.135 Tor)
I think that having a tiny bit less than 1/4 of all abuse reports originating from Tor is a pretty great value and not "out of hand" at all.
P.S.: We are pretty sure that this calculation is correct, but don't take our word for it.
Also on a funny note: Their mx server blocks our mx server, so we can't even reply to their email, even though the Tor-exit runs on a different IP than the mx.
[1] https://www.webiron.com/abuse_web_leaderboard/ [2] http://www.kean.edu/~fosborne/bstat/06d2pop.html?ModPagespeed=noscript