2

Would a question about attackers IP address be on topic?

I think it relates to risk management, but the link is weak. Specifically I am interested in asking:

How do I most accuratly resolve an attacker's IP address to a country, and with what certainty do I know the country assignment to be correct.

| |
1

I think it relates more to incident response than risk management. And the answer for "with what certainty" will probably be with the same amount of certainty that you're sure the IP you have is actually the attacker's IP.

| |
  • 1
    Incident response isn't listed as a relevent topic on the FAQ, should we add it? – this.josh Jul 14 '11 at 19:26
  • @this.josh - I suggest starting up a separate Meta thread on that, or posting it in chat. – Iszi Jul 14 '11 at 19:29
  • I agree with @Iszi. Anyway there's already a tag for that. – AviD♦ Jul 15 '11 at 6:48
0

Sure, but you'd want to clarify why you think this knowledge would be helpful for you from a security standpoint, rather than possibly sending you on a wild goose chase. And perhaps combine it or pair it with a question on what you can do in terms of incident response for some useful selection of countries.

| |
  • 1
    Good point. What comes to mind is 1) if the attacker is in the country I'm in, can I present convincing evidence to the authorities to take my case seriously 2) If the attacker is in a country with which my government cooperates can I convince someone to make contact with that country 3) If the attacker is in some country I know is not worth persuing. I can use the country to make decisions about how to proceed. If I can't create convincing evidence that it's not worth persuing. – this.josh Jul 18 '11 at 6:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .