How to Find Abuse Contact Information
The RIPE NCC often receives inquiries from people dealing with a network abuse case, such as spamming, hacking or phishing. The RIPE NCC is not responsible for network abuse. It is one of five Regional Internet Registries that allocates blocks of IP addresses to Internet Service Providers and other organisations, but has no involvement in how these addresses are used. However, the RIPE NCC has two tools available that may be able to help you find the correct contact information to report network abuse: the RIPE Database Abuse Finder and the RIPEstat Abuse Contact Finder. You can learn more about network abuse and how to use these tools below.
Please note that the following information is about finding contacts for network abuse. For other types of abuse, such as the violation of RIPE Policies or incorrect information in the RIPE Database, see the section below on other types of abuse.
The RIPE NCC is not responsible for spamming or hacking. The RIPE NCC never sends unsolicited emails, including spam and phishing emails, and the RIPE NCC network is never used to facilitate the sending of spam or any other kind of network abuse.
The RIPE NCC often receives questions about spamming and hacking because the victim searches for information about the IP address responsible for the attack and discovers it has been allocated by the RIPE NCC.
The way in which an individual IP address is used, however, is not under the RIPE NCC's control. The RIPE NCC is one of the five Regional Internet Registries (RIRs) that allocate large blocks of IP addresses to Local Internet Registries (LIRs), mostly Internet Service Providers. The RIPE NCC allocates blocks of IP addresses to LIRs within Europe, the Middle East and parts of Central Asia. How these LIRs then assign these IP addresses, either to other Internet Service Providers (ISPs), to End Users or within their own networks, is beyond the RIPE NCC's mandate.
However, if you suspect that the spam, hacking or network abuse originates from the following IP blocks, please contact us at ncc [at] ripe [dot] net as soon as possible. These ranges are used by the RIPE NCC.
220.127.116.11 - 18.104.22.168
If the IP address falls outside these ranges, we are unable to investigate the matter ourselves. However, you can try to find abuse contact information yourself using one of the tools described below.
Please note that the RIPE NCC's tools cannot provide contact information for IP addresses allocated outside of its service region.
You can also learn more about abuse and what you can do about it in the FAQs.
IP addresses that were allocated or assigned within the RIPE NCC's service region and are registered in the RIPE Database may or may not have an abuse contact associated with them. Before 2013, the decision about whether to include an abuse contact was left up to the resource holder once the resources had been allocated or assigned by the RIPE NCC.
Beginning in 2013, the RIPE NCC started implementing a new policy to improve abuse contacts in the RIPE Database. This new policy mandates the inclusion of an "abuse-c:" attribute for all new, and eventually all existing, resources registered in the RIPE Database. Abuse contacts found in the "abuse-c:" attribute are deemed to be the correct contacts for reporting abuse. Find out more about the implementation of the new policy or read the full RIPE Document, "Abuse Contact Management in the RIPE Database". Interent number resource holders can also watch a video tutorial that explains how to set up abuse contact information in the RIPE Database.
As the new policy is implemented and an "abuse-c:" attribute is created for more and more resources in the RIPE Database, the RIPE NCC's two abuse tools will return contacts found in these "abuse-c:" attributes more and more often. Eventually, only contacts found in "abuse-c:" attributes will be returned. Until the policy has been fully implemented, however, the tools will continue to search for potential abuse contacts in other fields if no "abuse-c:" attribute yet exists for the queried IP address.
Although the RIPE NCC cannot investigate abuse cases that originate outside of its own IP blocks (stated above), the RIPE NCC does have several tools that may be helpful in finding abuse contact information for a particular IP address, so that you can report the abuse to the appropriate person.
You will obtain the best results if you know the specific IP address causing the abuse (as opposed to an IP prefix/range or Autonomous System Number). You can learn more about how to identify the IP address responsible for the abuse in the .
Both of the RIPE NCC's anti-abuse tools rely on data contained in the RIPE Database.
Users who are familiar with the and how to query it can use the Abuse Finder tool to find potential abuse contacts associated with the spamming IP address. If the address doesn't contain an "abuse-c:" attribute, the Abuse Finder will display other objects in the RIPE Database that appear to contain abuse-related remarks. Users can then query the RIPE Database manually for these other objects, such as maintainers and administrative or technical contacts.
Learn more about how to use theDatabase and the Abuse Finder in .
Users not already familiar with the RIPE Database may wish to use RIPEstat's Abuse Contact Finder to search for abuse contacts.
The Abuse Contact Finder retrieves contact information associated with a specific IP address, and rates the contact found on a scale from one to five stars depending on how likely it is to be helpful in reporting abuse.
Contacts contained in the "abuse-c:" attribute give a five-star rating. If no "abuse-c:" attribute exists for the queried IP address, RIPEstat will automatically search related objects for potential abuse contacts. Contacts found in fields other than the "abuse-c:" attribute return a lower rating, from one to four stars, depending on where it was found and how likely it is to be the correct contact.
If you are successful in finding an abuse contact for the IP address, you can report the abuse to the relevant contact. However, please keep in mind that the email address(es) listed may be for contact people at an ISP providing Internet services, and they may not be aware that somebody is using their network in this way. They will require details of the abuse so they can investigate it further.
In case of spam or phishing, forward a copy of the spam/phishing email, including the full header. In case of hacking, include as much relevant information as possible to make it easier for the ISP to locate and deal with the abuser:
- Explain the situation and why you think it's an abuse case
IP address responsible for the abuse
Date and time (including time zone) the abuse took place
- Log file of the attack generated by your firewall, if possible
The RIPE community has an Anti-Abuse Working Group that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group .
The RIPE NCC can investigate reports about non-network abuse cases regarding:
- Internet number resource registrations
- Violation of RIPE Policies or RIPE NCC Procedures
- Provision of untruthful information to the RIPE NCC
- Bankruptcy, liquidation or insolvency
- Incorrect contact information in the RIPE Database
- Damage to the name, trademarks or intellectual property of the RIPE NCC