A method, computer program product and computer system maintain a list that includes identifiers of vehicles determined by the processor of a detective vehicle to have an innocent status. The processor selects, for each sub-period of a predefined time period, a target vehicle from a plurality of vehicles, where the detective vehicle communicates either directly or indirectly with each vehicle of the plurality and accepts communications from the plurality, where a portion of the plurality of vehicles and the detective vehicle are within a vehicle-to-vehicle communication range, and where vehicle-to-vehicle communication does not utilize infrastructure network connectivity. The processor obtains, over a vehicle-to-vehicle communication or a network connection, messages regarding a status of the target vehicle. The processor determines the status of the target vehicle, where the status is one of: malicious or innocent. The processor notifies the vehicles associated with the identifiers on the list of the determination.