# Report Method, Safety Measures and Legal Approach

_Behan Beti Bachao · India Grid_  
_Example report ID:_ `BBB-IW-20261027T110400IST-b28ff8a3`  
_Example SHA-256:_ `ef85b57bbe452dd8353f0c592c6046499fc0360d023bc11985ca611f08327691`

---

## In simple words — how we work

We do **not** break into or scan other people's servers the way attackers do.  
Like the police, we read **public informant lists (threat feeds)**, **our own trap (honeypot)** and **our own sensor logs** to spot a wave.  
Every warning starts as a **DRAFT** — nothing is sent without an officer's approval.

---

## Safety measures (customers / citizens)

1. For banking, post, tax and UPI use only the **official app** or the **genuine government/bank domain** (e.g. `.gov.in`, the bank's official `.com`/`.sbi`).
2. **Do not click links** in SMS, WhatsApp or email — especially KYC, PAN update, refund or "your account will be closed" messages.
3. **Never share OTP, MPIN, password or CVV** on a call or message. Banks and departments never ask for them.
4. If in doubt, ask through in-app help or the official helpline; do not call back the number in the message.
5. Do not install unknown apps or "security update" APKs on your phone.

---

## How to deal with it (SOC / officer response steps)

| Step | Action | What to do |
|------|--------|------------|
| 1 | **Block IOCs** | Block the IPs / hostnames / fake domains in the report on firewall, proxy, mail gateway and EDR. |
| 2 | **Alert customers** | Short SMS / in-app message: "Do not click links; log in only through the official app." |
| 3 | **Takedown** | Complain to the fake domain's registrar / hosting; brand trademark enforcement. |
| 4 | **CERT-In / 1930** | If needed, CERT-In intimation and a cybercrime.gov.in / 1930 draft — **only after officer approval**. |
| 5 | **Cloud abuse** | If the IOC is a cloud host such as `*.amazonaws.com`, use that cloud's **Abuse** form (e.g. AWS Abuse). Remember: the cloud company itself is not the attacker. |
| 6 | **Internal check** | Search your own logs for connections to the same IOC / malware telemetry; isolate infected endpoints. |
| 7 | **Keep the seal** | Attach the report ID, SHA-256 and evidence folder reference to the case file. |

---

## Special note on Amazon / AWS cloud IOCs

**Amazon the company is not the attacker.**  
A hostname like `ec2-….amazonaws.com` is usually the **real address** of a rented or compromised VM on AWS that criminals use as a C2 (remote control) server — for example a QakBot C2 on the public Feodo list.

Do not believe either wrong idea:  
**(a)** Amazon Inc. is attacking banks — **wrong**.  
**(b)** It is only a fake name with no real host — **wrong** (a real VM may exist on the cloud).

Correct steps: block-list the IOC + AWS Abuse report + share malware IOCs with the endpoint team.

---

## Legal, regular method

### What we do
- Re-download **public threat lists** (the HTTP status is recorded).
- Seal every raw feed with **SHA-256** so any officer can re-check later.
- Where needed, a **DNS A-record lookup only** for sample domains (no HTTP scanning of the site).
- Match against **our own** honeypot / sensor logs (which we hold lawfully).
- Outside-only checks on the officer's **watchlist** (when a list is provided).
- Output: plain language + technical proof + **DRAFT_NOT_SENT** warnings.

### What we do not do
- Scan, fuzz, log in to or exploit third-party servers without permission.
- Auto-email CERT-In / banks / registrars without officer approval.
- Claim "attack on India" from guesswork without a source.
- Call a report "proof" without a hash and source URL.

### Verification (answer to anyone who says "fake scanning")
1. Open the **source URL** written in the report and download the same feed again.
2. Match the raw file hash from `sha256sum` with the SHA in the report.
3. `grep` a sample IP/domain in the feed — it must be found.
4. Show the report ID + full report SHA-256 in the case.
5. Limitations are written in the report too (global feeds, one sensor, etc.) — never hidden.

---

## Short block for the site

```
Why our report is correct
• Public lists re-downloaded + SHA-256 seal
• Where possible, two independent lists cross-matched
• Cross-checked with our sensor logs
• No scanning of third-party servers without permission
• All warnings DRAFT_NOT_SENT — the bot sends nothing
• Report ID and SHA-256 printed in every brief

Safety / response
• Block IOCs · customer SMS · domain takedown · CERT-In draft (after approval)
• Cloud IOC → Abuse form — cloud company ≠ attacker
```

---

## Technical reference

| Item | Value |
|------|-------|
| Report ID (example) | `BBB-IW-20261027T110400IST-b28ff8a3` |
| Report SHA-256 | `ef85b57bbe452dd8353f0c592c6046499fc0360d023bc11985ca611f08327691` |
| Verification | "Why our report is correct" section in every brief |

_End — Behan Beti Bachao_