Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is anyone aware of a web service that allows people to publish ip addresses as having run vulnerability scanning tools to determine the signature of the target?

I would like to have a scheduled job that runs periodically during off hours to analyze traffic and report suspicious traffic to authorities. I am guessing the best I can do would be my hosting provider.

Walter

share|improve this question

3 Answers 3

up vote 0 down vote accepted

This host can be anywhere in the world. There isn't a central authority that you can contact for these cases, unfortunately. The best way is to contact the hosts ISP and report an abuse.

The way to find what is the abuse address for a certain IP is to use whois. There is a whois utility on Linux and on MacOS X. If you don't have this on your machine, try a whois website:

Example query:

http://whois.domaintools.com/80.218.148.10

Notice how the whois entry shows very clearly what is the ABUSE e-mail address. This is not always so clear, but it's often there. If not, you can try using abuse@ISP, where ISP is the domain.

After you get this address, send a very polite and informative e-mail to this address. Add all data that you have - what was the attack you received, includ the log entries and relevant date/time. Mention the source IP and the destination IP (the one on your side).

Last but not least, a good resource for abuse reports is this website:

http://www.abuse.net/

This is not the please where you will fill your complain, but they will help you find where to send your abuse report, and how do to it effectively.

Good luck, Yves

share|improve this answer
    
You made a good point. I am familiar with whois, so I can use a Java library / wrapper to get that information and send out a notification email in the off hours. I will also check into the other websites you mentioned, they seem worthwhile. –  Walter White Nov 10 '09 at 13:19

The only one that I'm aware of is dshield

share|improve this answer

Since a lot of zombie computers will be the ones doing the scanning and since their IP addresses will likely be dynamic, I can't see anyone really being enthusiastic about blocking IP addresses for those systems. You could try and do some sort of lookup to determine the ISP and send them the information but again, I doubt they'd do anything about it - though some like Comcast might.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.