I'm having a hard time to figure out the abuse e-mail address for IPs from
Japan. Any query I perform at the WHOIS, for any IP, from any autonomoyus
system I get the same e-mail addresses:
These e-mail addresses belong to JPNIC, not the autonomous system itself.
So any messages sent to these e-mail addresses will not reach the offending
NOC/SOC so I can report vulnerabilities and DDoS attacks.
What am I missing and how should I report security issues to autonomous
systems from this region? Has anyone here any experience on this?
ktk@ktk:~$ whois -h whois.nic.ad.jp 59.106.13.181
[ JPNIC database provides information regarding IP address and ASN. Its use
]
[ is restricted to network administration purposes. For further
information, ]
[ use 'whois -h whois.nic.ad.jp help'. To only display English output,
]
[ add '/e' at the end of command, e.g. 'whois -h whois.nic.ad.jp xxx/e'.
]
Network Information:
a. [Network Number] 59.106.12.0-59.106.27.255
b. [Network Name] SAKURA-NET
g. [Organization] SAKURA Internet Inc.
m. [Administrative Contact] KT749JP
n. [Technical Contact] KW419JP
p. [Nameserver] ns1.dns.ne.jp
p. [Nameserver] ns2.dns.ne.jp
[Assigned Date] 2004/11/24
[Return Date]
[Last Update] 2004/11/24 18:41:02(JST)
Since they don't have an abuse contact and there's not much additional useful contact information in their peeringdb entry, your next best bet would be to reach out to the admin and technical contacts listed in their whois record, or try the abuse contacts for one or more of their
upstreams.
Thank you for your assistance. I'm used to query AS entries for LACNIC
region and their WHOIS spit out righ away all contacts. I didn't realise I
had to make a secondary query for the Technical Contact ID to only then see
the e-mail address.
No e-mail addresses of the abuse team or NOC or SOC.
% whois 59.106.13.181 | grep support
remarks: Email address for spam or abuse complaints : support@sakura.ad.jp
That's not a special whois client but is in the text returned by APNIC.
note that whois.nic.ad.jp does not, unlike RIPE whois, automatically also include person objects referenced in an inetnum object, so you will have to query for those separately, as another poster pointed out.
Thank you for your assistance. I'm used to query AS entries for LACNIC
region and their WHOIS spit out righ away all contacts. I didn't realise I
had to make a secondary query for the Technical Contact ID to only then see
the e-mail address.
If you do write to Japanese network contacts, expect a very polite
response saying that they can't deal with your report because they're
too scared to open attachments.