Reporting Network Abuse

How do I report network abuse?

If you believe that your systems are being misused or attacked in some way by another system directly connected to our network, please notify MCNC through an email to MCNC will follow up in an appropriate manner. Complaints should include as much specific detail as possible, including:

  • Source and destination system names
  • IP addresses
  • Related emails with full headers
  • Related system logs with time stamps indicating time zone

If it appears that the attack originates on a non-NCREN network, we will be happy to assist you in determining the source of the attack and finding contact information to register complaints.
In the event of evidence of illegal activity such as threatening emails or posts, or fraud involving monetary transactions, please contact the appropriate law enforcement agency directly.

What do I do if my systems are accused of network abuse?

From time to time, MCNC receives complaints about network abuse that may appear to originate from your IP address range. When that occurs, we will forward the complaint to the contact we have listed for you for network abuse and/or technical issues. Please treat the complaint seriously and include MCNC in correspondence with the complainant regarding the outcome of your investigation, and any mitigating action taken. Often attackers use spoofed IP addresses, so the complaint may not require anything more than a review.
Your review should include:

  • Firewall, intrusion protection, mail server and other related logs
  • DHCP assignment logs for source addresses that are network assigned
  • Review of network filters to detect the likelihood that this could occur from your network