How to Report IP Abuse to Amazon, Google Cloud Platform or Microsoft Azure ?

Problem: While performing Investigations, it has been observed that resources of major Cloud Service Providers are being used for Abusive or illegal Purposes. This article will let the users know how to reach AWS, GCP or Microsoft Azure to report IP abuse & deal with the Issue.

Report IP Abuse to AWS Console:

AWS Abuse teams available around the world to make are there to help you & all the customers keep the internet safe & abuse free. If you suspect that AWS environment is used for abusive purposes, the best method to contact the Amazon AWS Abuse team was using the online report Amazon EC2 Abuse Form.

https://aws.amazon.com/forms/report-abuse

When you click on the above link, it will give you a form to submit information. You have to fill up all the information regarding Reporter Information (About Yourself), Details of Reported Abused (IP Address, Date, Time, Time Zone, Type of Abuse, Log details, or any other Comments to Pass). Once you are fully agreed with the Terms & Conditions of AWS, you can click on Submit button to send the request.

Is it Safe for the Reporters?

Yes, your all Private Information will be kept secured in whole process. Once you submit your report to the AWS Service systems, then our associates will try to identify the specific EC2 Customer who are responsible for the abuse reported. The AWS associates will forward the information you have submitted without sharing your personal information. However, the customer can also respond to your thread indirectly via email communication using the response Web form which is quite similar to Abuse Report Form.

Report Suspected IP Abuse on GCP:

In present era, Google Cloud Platform, or GCP emerges as a very useful set of tools, that are helpful to grow your business including App Engine, Secure Storage, Compute Engine, Cloud SQL, & integrate all data analytics into single platform. In case if you suspect anyone of using Google Cloud Platform to intrusive attempts or use of vulgar or abusive content. Report the IPs or URLs here by Visiting this Official Link:

https://support.google.com/code/contact/cloud_platform_report

It will display you a report Submission Form & you have to provide all the information necessary. It will ask the users to enter abuse details like IP Addresses or URLs of involved parties. In case if your information of full HTTP Header requests then provide the same too. Make sure that you did not enter any sensitive information from the logs before submitting the final report. Once you done with all options, finally click on Submit button.

Submit IP Abuse Report to Microsoft Azure Platform:

Microsoft takes the abused content seriously & will look for all the reports that are submitted to its console. Microsoft Azure has a specialized team to protect the rights of rightful users & to investigate & immediate action on reports of abusive content. Users can also connect with Microsoft Azure Security Center which will help you to safeguard your workloads. The Microsoft have full right to protect its policies & if in case any of our customer is violating the terms, it will take appropriate action including suspending their services. Visit Microsoft Security Response Center for more Information.

https://msrc.microsoft.com/report/

Note: Microsoft Azure is a platform used by variety of customers to run their services & websites. So, it is not in the position of arbitrating between the parties to handle a dispute. It will investigate all the malicious & illegal content on its behalf on the basis of complaint you filed. As a part of this, Microsoft will notify the concerned parties about the issue & ask them to resolve them accordingly.

How do I Identify my Abuse Type when Submitting my IP Abuse Report?

The Most Common Type of Abuses are:

1. Spam (Emails, Forums & Other Websites)
2. Port Scanning
3. Denial of Services (DoS)
4. Excessive Web Crawling
5. Phishing Websites
6. Intrusion Attempt
7. Hosting Objectionable or copyrighted content
8. Malware
9. Credit Card Fraud
10. IRC Botnet Activity

Users can Identify the IP of the Message Sender by visiting Whois Lookup portals. Just Identify your sender IP Address as displayed with the help of a sample example.

Lookup the original Owner of the IP address to provide the information in your Abuse Report. One of the best & highly used Whois Lookup is https://www.whois.com/whois/

When you click on Search button, it will display all the information regarding the owner of the IP Address.

Important Things to Remember before Submitting Report:

Providing the date, time & time zone are really very important. Due to the frequent changes in the dynamic environment, it can may be possible that IP owners may be changed. Hence it becomes important to provide accurate date & time of intrusion.

Submit as much information as possible. The more information you submit, the easier it is for the abuse team to address the issue. Abuse team frequently communicate with reporters hence it is important to provide a correct email address that is monitored.