2

I have a private web server that gets attacked a lot (brute forces, nmap scans). I would like to compile a list of the IP addresses that were trying to hack my server and publish them on my website. Is this legal? I realize that the IP address could belong to a botnet (so the owner of the IP address is unwillingly knows that it's comprised).

Improve this question
4
  • 1
    There are many of them available publicly(google.es/search?q=list+of+botnet+ip+addresses), some provided by business and organizations whose product is precisely maintaining accurate lists so their clients can filter those systems out(spamhaus.org/bcl)
    – SJuan76
    Mar 27, 2017 at 19:35
  • Publishing this information online is usually a bad idea, but not for a legal reason. Hackers want you to tell others about them, because it gives them something to point at and say "see we're good at our job" - some even use it as a sort of profile for getting hired. Including information that's too specific just gives them what they likely want from you: publicity.
    – animuson ♦
    Mar 28, 2017 at 14:01
  • Borg, speaking through the words of others is a kind of con-trick, don't you think?
    – Mozibur Ullah
    Jun 25, 2017 at 6:10
  • Borg, are you a con-trick?
    – Mozibur Ullah
    Jun 25, 2017 at 6:13

2 Answers 2

Reset to default
2

In general, you can publish anything unless an exception to the First Amendment applies.

The only exception that could plausibly be relevant is that you could be improperly defaming someone else's reputation.

If you have a good faith believe that these IP addresses were used to hack your server, this would almost surely be a matter of public concern (why else publish) and would involve a statement that was not false or made with reckless disregard for its truth or falsity.

To avoid inadvertently tarnishing someone else's reputation, you might consider including a notice that recognizes that the IP addresses could belong to a botnet and was not controlled by the legitimate owner of the IP addresses together with your "page of shame".

Improve this answer
2
  • By operating a website, there is a lot of specific law that comes into play around privacy polices, etc, and the First Amendment is probably not broad enough to protect you if you are violating one of the specific internet privacy laws. I can't give a specific privacy-law based answer, but the CIPP website may have some answers or at least some terms to start looking up: iapp.org/certify/cipp
    – David
    Mar 27, 2017 at 3:37
  • It is hard for me to see a privacy protection angle in this scenario, but perhaps there is one, or more facts might reveal one.
    – ohwilleke
    Mar 27, 2017 at 3:39
0

Think about your website like it's your own country and the "Terms of Service" and your "Privacy Policy" like the bill of rights of the country. You can set any terms you like and anyone who visits the website can either agree to terms or leave. If one of the terms is that any malicious activity will allow you to publish any connection information. Then you are clear to do what you wish with the information of any malicious connections.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .