PORTSCANNING/SUSPECTED HACKING

Portscanning and Hacking
Version 1.0 - 07/02/03

If you have been portscanned or if any attempt has been made to gain access to your system without your permission from an IP address within our range, then please contact us. We will investigate the matter and if the complaint is justified, we will take appropriate action to ensure there is no repeat of the incident.

Q. What do we consider 'appropriate action'?
A. This depends on why you were portscanned or hacked:

If it appears that the system the attack came from has been compromised itself, i.e. with a virus or worm, then we will disconnect that system from the network. At the same time, we will contact the owner of the system and inform them of the situation. The responsibility of the system owner is then to remove the program(s) that is/are carrying out the attacks, once this has been completed to our satisfaction, we will reconnect the system to the Internet. No further action will be taken, although we will inform the system owner about protecting against such situations in the future.

If we can find no evidence that the system has been compromised in any way, we will contact the system owner and request that they respond to the complaint within 7 days. If we do not receive a satisfactory response within 7 days, the system will be disconnected until we do receive a satisfactory response. If we, or the complainant, are not happy with the response from the system owners, we will issue a written warning pointing out our AUP and that portscanning or hacking attempts places them in breach of their contract.

If we receive a second justified complaint against a company or individual and it is evident that the attack was not a result of a compromised system, then we will terminate their account for breach of contract.

Q. What evidence do I need to send you?
A. You should e-mail abuse@caladan.net with a full description of what has taken place, giving as much information as you can, particularly the time(s) the attack occurred, the source IP address the attack came from, the destination (your) IP address, and which ports or services were scanned or attacked. If you detected the attack, then presumably there is some form of firewall or attack detection software running on your system, so a copy of the relevant part of the logs from this software showing details of the attack will also be required.

Please Note: We will endeavour to respond to any complaint within one working day. All complaints must be e-mailed to abuse@caladan.net

We cannot guarantee a quick response to e-mails concerning complaints sent to any other address than the one specified above.