Do You Report Malicious Actors to Their Providers?
Asked by
CuriousCat42
Hey everyone! I'm curious if you take the time to report malicious actors to their hosting or SaaS providers. I often find this comes into play when we're dealing with incidents like successful phishing attacks. This includes reporting mail servers, web hosting used for attacks, registrar abuse addresses, and services involved in denial-of-service attacks. What's your approach?
Answers
I generally only report enough to mitigate the threat. If a phishing email comes through, I focus on getting the links taken down or the email addresses suspended. Better to strike where it hurts!
Reply to this answer
I do report them, but honestly, the response rate is pretty poor. Still, it’s better than doing nothing.
Reply to this answer
I always report. Although responses can be lacking, one successful takedown can disrupt an ongoing campaign. I've automated my reports to save time during active incidents.
Reply to this answer
It really depends. Sometimes I'll look into it if I’m bored or if the ASN name catches my interest; it can be fun to dig around.
Reply to this answer
I consider it case by case. If there's an attempt to spoof our business domain, like a similar-looking domain name, I report that without hesitation.
Reply to this answer
I usually report them, especially if they're beyond Cloudflare because they tend to take action. It's not always guaranteed, but it’s worth a shot.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions