Reporting abuse if you are a JANET user

First think, then react

It doesn't help anybody if your report is itself an instance of abuse.

• Don't be too ready to use a button marked "report abuse" (or "this is spam").
  It results in real work for a lot of people, and you must do your bit by checking that you are sure you mean what is implied by pressing the button.
• Don't send it to the wrong place.
  In particular when an e-mail message has been delivered to a JANET address it is very rarely useful to complain to JANET CSIRT or (for instance) to allow SpamCop to do so. The Computer Services or similar department in your own organisation should be able to explain what is going on.
• Don't be offensive or threatening.

Who should report abuse to JANET CSIRT?

We suggest that end users in a JANET organisation should first speak to the IT support or network staff there, as they may be able to relate apparent abuse to some local issue and report on action already taken.
It is then normally appropriate for IT support or network staff to approach JANET CSIRT. Often the designated JANET security contact will be in a position to do that; in any case we will normally send them a copy of our acknowledgment and correspondence.

What to include in your report

Please include as much as possible of the following:

• source IP address in JANET or elsewhere;
• destination IP address or addresses in JANET;
• destination TCP or UDP port (unless it is obvious, eg for Web or e-mail abuse);
• date and time when the abuse started and finished (include the timezone and check whether your system clock was accurate at the time);
• number of events (packets, addresses scanned, mail messages, connection attempts etc);
• brief statement of the problem;
• any original log or trace information (for e-mail abuse include the complete message header);
• any other information you think may be helpful.

Often a good sample of log information or a complete e-mail message header is all that is needed.

It is easiest for us if your e-mail report is in plain text without HTML or attachments.

Where to send your report

Normally please send e-mail to JANET CSIRT at irt@csirt.ja.net.
For other ways to contact JANET CSIRT see Contacting JANET CSIRT.

What happens next

JANET CSIRT will examine your report and send you an acknowledgment with a ticket number of the form [JANET CSIRT#987654] in the message Subject: and in the body of the message.
If you need to reply or to send us any update, please leave the ticket reference unchanged in the Subject:.

If it appears that another JANET organisation should take action to stop the abuse you report, we will work with them as necessary.

If the abuse appears to originate outside JANET, we will work with other teams and service providers around the world and try to resolve the problem at its source.

Normally we will not report to you on the progress of that work, but if the abuse continues or you are uncertain what is going on you are welcome to write to us again, preferably using the ticket number we sent earlier.
We may also suggest steps you can take to reduce the impact of the abuse on your own network.