Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?

From your experience what is the best way to report an international cyber crime? is it worth reporting at all?

share|improve this question
add comment

1 Answer

up vote 15 down vote accepted

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address.

You can use http://whois.domaintools.com/ to do a whois lookup to get the address.

Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the problems on their server by someone sending the hosting company an "abuse" notification email. So it definitely can make a difference.

Note that the IP address you track down is almost never the attacker himself but rather a hacked server or computer that he's using as a relay. So keep that in mind. You're not alerting the authorities on the whereabouts of a miscreant; you're notifying someone that his computer has been compromised.

EDIT TO ADD

You give the information you have to the appropriate authority, and then you're done. That it. As a rule, hosting companies will not share personal information of their clients unless you are local law enforcement with the appropriate warrant or court order. It's their liability if they do otherwise.

Don't expect a follow-up report from them, don't expect names or arrests or anything more than an acknowledgement that they heard you -- sometimes not even that. These companies often deal with dozens of these reports a week or more. Their abuse team will deal with it, and they appreciate your assistance as they want to keep their network clean, and your report will probably trigger several days worth of activity. But they have a clear-cut policy that they follow to the letter for liability reasons, and it intentionally doesn't include reporting back the original reporter. Nothing against you specifically.

Also, remember that though you found the hacker, It's almost certainly not his account on the server.

share|improve this answer
    
I have contact the company and they agree that the attack was lunched from their server. They have blocked that account. I want to report this issue to authorities (police) but the hosting company did not share the personal information of the guy who lunched the attack from their servers. In this case I have to report the hosting company. will the authorities do anything? Im not sure... and thats why Im thinking if it is worth my time to report this case. :S –  HEX Sep 3 '12 at 15:30
5  
Report it to the authorities in your country as a criminal complaint, then leave it at that. It's all you can do. Even if you report it to the German authorities they will almost certainly do nothing because you're outside the country, and it's quite possible that the law wouldn't pursue the company in any case as the laws are such that it would be difficult to prove fault. –  GdD Sep 3 '12 at 15:51
    
@HEX Edited for followup –  tylerl Sep 3 '12 at 16:57
    
@tylerl You have to clarify that you are talking about experienced and high skilled computer hackers. Skids (script kiddies) are a whole different story. –  NlightNFotis Sep 23 '12 at 20:43
    
@NlightNFotis I'm talking specifically about the datacenters, irrespective of the level of skill of the attacker. You have to deal with the DC because they're your point-of-contact for the server. Then they take it from there. Maybe they'll catch him, maybe they won't. But it's not your fight. Sure, you play an important role, but you play your part and then you move on. –  tylerl Sep 24 '12 at 5:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.