Worth reporting abuse on a new VPS?

[ManxStef]

Just wondering if it's worth reporting some suspicious activity to the JaguarPC guys and, if so, who to?

Basically, I've just bought a VPS in the last couple of days, stripped it out and hardened it. (I got Plesk free, but decided to remove it due to too much cruft and the inability to run alongside Postfix, which I'm much more familiar with.)

The only thing running at the moment is SSH (different port & key-only) and Apache2, Bind's not been set up yet and there's no DNS or nameservers pointing to it anywhere, it's only known as an IP address, yet I've already had someone scanning for insecure PHPMyAdmin installs! It's the only hit I've had in the Apache logs that's not been my own testing.

This leads me to believe that either it was just a script kiddie scan based on a randomly-generated IP which happened to be my server or, and probably more likely, that someone's deliberately targeting the JaguarPC IP netblock in the hope of catching insecure installs before they're properly set up and secured.

The latter would be arguably be worth chasing up by JaguarPC themselves; the suspect in question's ISP is Affinity Internet, Inc in Fort Lauderdale, Florida. I can publish their IP address if anyone else would like to check their logs for similar activity, though I'd prefer to send it via PM for the moment until Jag have responded.

Or should I just ignore it, recognise that stuff like this happens frequently, and not bother wasting my time?

[Vin DSL]

Absolutely,report it!

This is just the type of thing 'they' love to hear about.

Maybe they can find their 'Phantom HD Killer' - the one that's causing VPS to go 'read only'...

[Spathiphyllum]

If you think it's local, then absolutely report it to Jag as Vin suggests.

But even if it isn't, I'd still report suspicious scans, scans which you know are from scripts. Find out who owns the IP (via netblock records through a DNS report) and report the scan to the abuse@registrarXYZ.com address at the hosting registrar. I usually just include by default the pertinent snippet of the scan log and ask them, politely, to review the IP under their control. Most registrars are pretty receptive to TOS violations since they want to avoid being known as a source that condones dubious accounts.

[ManxStef]

Thanks for the replies, gents, I've reported it. Not sure they'll do anything about it, but hey

[JPC-Masood]

Welcome to world wide Internet. You should receive a lot more scanning. Go with this:

BFD rules for Jag servers