Abuse Report Generator

Fill in what happened and get a short, factual abuse report that an abuse desk can act on: the source, times in UTC, what was seen and your evidence.

  • Free
  • No Sign-Up
  • Runs in Your Browser

Your Report

Subject: Abuse report: login brute-forcing from <source IP>

Hello,

The address <source IP>, which is on your network, made repeated failed login attempts against our service, which is consistent with a password brute-force attack.

Source IP:      <source IP>
Target:         <our IP or host name>
Type:           Brute Force
First seen:     <date and time, UTC>
Last seen:      <date and time, UTC>

All times are in UTC.

Please investigate and stop this activity. A reply confirming you have received this report would be appreciated.

Regards,
<your name and organisation>

How to Use

How to use the Abuse Report Generator

  1. 01

    Pick what happened

    Port scan, brute force, flood, spam, phishing or something else.

  2. 02

    Add the details

    The source IP, your target, the times and a few log lines.

  3. 03

    Send it

    Copy the report and send it to the abuse contact for the source IP's network.

Security & Abuse

About the Abuse Report Generator

What makes an abuse desk act

Abuse teams handle hundreds of reports a day; most get closed because they cannot be matched to a customer. The reports that get acted on name one source IP, give exact times with a time zone (UTC is best), say what happened in one sentence and include a few lines of raw log. That is what this generator produces.

Keep it factual and short. Threats, all-caps and attachments full of unrelated logs slow it down.

Finding the right address

Look up the source IP's network with the ASN lookup, then find its abuse contact in WHOIS (the abuse-mailbox or OrgAbuseEmail field). Many networks also accept reports through a web form or the X-ARF format. Reporting to the hosting company rather than the upstream carrier gets the fastest response.

On the receiving end

Hosting providers receive these reports about their own customers. Frabs builds the same kind of evidence automatically when one of your VMs misbehaves, so you can answer a complaint with exactly what happened and when.

Report Types

SSH and Login Brute ForcePort ScanDDoS and FloodsSpamPhishingWeb Attacks

What it can't tell you

  • Nothing is sent from this page. You copy the report and send it yourself.
  • Nothing you type leaves your browser.

Frequently asked questions

Where do I send an abuse report?
To the abuse contact of the network that owns the source IP. Find the network with an ASN lookup, then the abuse address in its WHOIS record.
Is it worth reporting port scans?
Single scans are background noise and rarely acted on. Persistent scans, brute-force attempts, floods and spam are worth reporting, especially with logs.
Should I include logs?
Yes, a few relevant lines with timestamps. Remove anything about your own users that the other network does not need.

Free Tools

More tools

All Tools
IP & ASN LookupWhich network owns an IP: ASN, name, prefix, country and registry.IP Reputation CheckerCheck an IP against spam blocklists and threat feeds at once.Reverse DNS LookupPTR record for an IP, and whether it is forward-confirmed.Firewall Rule GeneratorGenerate iptables, nftables and UFW rules for common server set-ups.

Receiving abuse reports about your VMs?

Frabs stops the abuse before the report is written, and gives you the evidence when one arrives.

Start Free TrialTry the Demo