Reporting an IP address

Question

This morning while checking /var/log/secure to troubleshoot an issue with my Centos VPS, I found that there has been too many SSH bruteforce attempts from 54.93.174.60 for the past couple of days. I blocked the IP immediately and a quick google search on the IP 54.93.174.60 said there are quite a few who has complaints against this IP. Is there a common public place were I can report such IP addresses with proof where the ISPs check periodically and take the necessary if any of the IP addresses reported belong to them?

Is http://www.abuseipdb.com a respected project? I found this website while googling the mentioned IP address.

Dec 2 05:20:45 server sshd[32461]: Failed password for invalid user Florissant from

54.93.174.60 port 56169 ssh2
Dec  2 05:20:45 server sshd[32462]: Received disconnect from 54.93.174.60: 3: com.jcraft.jsch.JSchException: Auth fail
Dec  2 05:21:14 server sshd[32463]: Invalid user fluffy from 54.93.174.60
Dec  2 05:21:14 server sshd[32463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ec2-54-93-174-60.eu-central-1.compute.amazonaws.com
Dec  2 05:21:17 server sshd[32463]: Failed password for invalid user fluffy from 54.93.174.60 port 56412 ssh2
Dec  2 05:21:17 server sshd[32465]: Received disconnect from 54.93.174.60: 3: com.jcraft.jsch.JSchException: Auth fail
Dec  2 05:21:28 server sshd[32467]: Invalid user Flushing from 54.93.174.60
Dec  2 05:21:29 server sshd[32467]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=ec2-54-93-174-60.eu-central-1.compute.amazonaws.com

Disclaimer : I am not related to the website www.abuseipdb.com in any ways. I found this website while googling about the IP address mentioned in the post.

Answer 1

There isn't one list for this. There are numerous, all with their own goals, policies for listing and delisting.

About this specific list: I'm involved in abuse at ISP's for quite a number of years I've never heard of it. Looking at their website there are a few thing that makes me not want to use it:

• there's no clear, documented listing policy. It looks like everyone can fill in the form and then it's listed so any IP can end up on that list, possibly without any verification or proof. The number of complaints required to make it to this list isn't specified, so it may very well be that even one complaint is enough. The lack of a documented listing policy is bad for IP owners, but also for users of the list, because they may just as well be blocking IPs which aren't causing problems but which were added for (for them) wrong reasons to the list.
• there's no delisting policy. Combined with the first argument that's a bad thing, because one of your IPs may be listed wrongly. Also, if there was abuse, once you fixed the abuse problem and you want to use the IP again you have no possibilty to have the IP removed again.
• In addition to not having a delisting policy, it's impossible to conctact to ask information about a listing. So if one of your IPs listed you have a heard time to trace this complaint back to a user and actually fix the problem.
• their contact address is [email protected], which makes me think they may have some other motives than the good of the internet with running this database.

For an ISP I'd never consider using a list which doesn't have clear criteria on listing and delisting.

For the IP you mentioned it may be more useful to contact the owner of the IP block, Amazon, using their abuse contact page. They may actually take action on the machine running these SSH scans. Then again, personally I'd just install fail2ban and/or a firewall on my machine and move along, SSH scans are part of the internet nowadays, unfortunately.