Port Scans? Not worth the time.
Port Scans? Not worth the time.
1.2.3.4 - - [15/Oct/2022:08:36:42 +0000] "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" 404 370 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
2.3.4.5 - - [15/Oct/2022:13:03:22 +0000] "GET /admin/controller/extension/extension/ HTTP/1.1" 404 370 "binance.com" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"
3.4.5.6 - - [15/Oct/2022:05:41:00 +0000] "GET /1index.php HTTP/1.1" 404 370 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"My service happens to be fronted by nginx, so over time I accumulate config to match these and drop connections and drop from the logs entirely:
location /wp-admin {
access_log off;
log_not_found off;
return 444;
}
(444 is a nonstandard error code that tells nginx to just close the connection, don't respond at all; if you want to be more mischievous you could return 301 "https://nsa.gov")Log analyser tools will exclude them from reports.
It's only worth reporting abuse if there's something the ISP might do about it. Report a hacked server hosting malware etc. Don't bother for this.
Scanners gonna scan, etc.
If you send an abuse report for these and it's processed, the user is going to tell the ISP, yeah, I'm running a vulnerability scan as a public service, and the scans are going to continue.
You can put rules like someone said or you can ignore it.
Most types of scanning also violate the terms of service for almost all ISPs so even if the owner does claim it's a public service there's a decent chance they'll be shut off. If the scanner is brute-forcing or trying to exploit known vulnerabilities, for example.
I know a lot of people will find this to be wishful thinking. I've run security for some fairly large businesses and reported more than my share of compromised hosts. Obviously we don't report every scanner because it's time consuming and the cost/benefit isn't there, but the percentage of companies that respond is far more than zero.
I would say though, that you're less likely to get a response from a Whois contact for the IP than from a domain contact or a contact listed on the primary website of the domain owner. Whois contacts get so much spam they often go un-monitored.