My web site was under an SQL injection attack for a while. After it was noticed, I closed the problem places and the attacks have failed.
Examining the logs I find about 46 unique IPs have been trying to run SQL injection attacks consisting of more than 500 GET/POST requests over a couple of weeks (highest one was 147816 requests).
After the loopholes were closed the number of requests dropped right down (to a handful a day - probably just probing).
My question is, is there any point trying to report these guys? They are probably from some compromised machine somewhere, so maybe not.
Related: Is there a way to report IP addresses scanning for Exploits?
However this isn't a scan - the volume implies they knew it was a success.
I can imagine a couple of scenarios:
- These addresses are actually the attacker, in which case they may be able to "assist the police with their enquiries".
- These addresses are from some innocent victim, in which case they would probably be pleased to be told their machine is infected.
Assuming the answer is "yes, report it", the next question is "to whom?". If I have to spend an hour filling in a lengthy form, per address, it won't really be worth it.
Countries involved
(edited to add)
I am in Australia.
The most prolific attacker is in Montreal, Canada.
Others are:
- Bromley, UK (near London)
- Glattfelden, Switzerland
- Amsterdam, The Netherlands
It's hard to see one police jurisdiction getting interested in this, unless they have a special department to handle world-wide attacks.
botnet
that carry out distributed attack. You may use info from netcraft.com to check ISP that own the netblock and report to correspondence entity. But nothing is guarantee. If this end up to end user infected user computer (that use random IP), little can be done.