How to Find Abuse Contact Information
The RIPE NCC often receives inquiries from people dealing with a network abuse case, such as spamming, hacking or phishing. The RIPE NCC is not responsible for network abuse. It is one of five Regional Internet Registries that allocates blocks of IP addresses to Internet Service Providers and other organisations, but has no involvement in how these addresses are used. However, the RIPE NCC has a tool available that may be able to help you find the correct contact information to report network abuse: RIPEstat's Abuse Contact Finder. You can learn more about network abuse and how to use this tool below.
Please note that the following information is about finding contacts for network abuse. For other types of abuse, such as the violation of RIPE Policies or incorrect information in the RIPE Database, see the section below on other types of abuse.
The RIPE NCC is not responsible for spamming or hacking. The RIPE NCC never sends unsolicited emails, including spam and phishing emails, and the RIPE NCC network is never used to facilitate the sending of spam or any other kind of network abuse.
The RIPE NCC often receives questions about spamming and hacking because the victim searches for information about the IP address responsible for the attack and discovers it has been allocated by the RIPE NCC.
The way in which an individual IP address is used, however, is not under the RIPE NCC's control. The RIPE NCC is one of the five Regional Internet Registries (RIRs) that allocate large blocks of IP addresses to Local Internet Registries (LIRs), mostly Internet Service Providers. The RIPE NCC allocates blocks of IP addresses to LIRs within Europe, the Middle East and parts of Central Asia. How these LIRs then assign these IP addresses, either to other Internet Service Providers (ISPs), to End Users or within their own networks, is beyond the RIPE NCC's mandate.
However, if you suspect that the spam, hacking or network abuse originates from the following IP blocks, please contact us at ncc [at] ripe [dot] net as soon as possible. These ranges are used by the RIPE NCC.
220.127.116.11 - 18.104.22.168
If the IP address falls outside these ranges, we are unable to investigate the matter ourselves. However, you can try to find abuse contact information yourself using RIPEstat's Abuse Contact Finder described below.
Please note that the RIPE NCC's tools cannot provide contact information for IP addresses allocated outside of its service region.
You can also learn more about abuse and what you can do about it in the FAQs.
IP addresses that were allocated or assigned within the RIPE NCC's service region and are registered in the RIPE Database may or may not have an abuse contact associated with them. Before 2013, the decision about whether to include an abuse contact was left up to the resource holder once the resources had been allocated or assigned by the RIPE NCC.
Beginning in 2013, the RIPE NCC started implementing a new policy to improve abuse contacts in the RIPE Database. This new policy mandates the inclusion of an "abuse-c:" attribute for all new and existing resources registered in the RIPE Database. Abuse contacts found in the "abuse-c:" attribute are deemed to be the correct contacts for reporting abuse. Find out more about the implementation of the new policy or read the full RIPE Document, "Abuse Contact Management in the RIPE Database".
Although the RIPE NCC cannot investigate abuse cases that originate outside of its own IP blocks (stated above), the RIPE NCC does have a tool that may be helpful in finding abuse contact information for a particular IP address, so that you can report the abuse to the appropriate person.
You will obtain the best results if you know the specific IP address causing the abuse (as opposed to an IP prefix/range or Autonomous System Number). You can learn more about how to identify the IP address responsible for the abuse in the .
RIPEstat is a tool that returns all available information about an IP address and other Internet number resources. The Abuse Contact Finder retrieves contact information associated with a specific IP address, if it is contained in the RIPE Database.
If a dedicated abuse contact exists in the "abuse-c:" attribute for the queried resource, it will be displayed. If no "abuse-c:" attribute exists for the queried IP address, RIPEstat will automatically search related objects for potential abuse contacts.
If you are successful in finding an abuse contact for the IP address, you can report the abuse to the relevant contact. However, please keep in mind that the email address(es) listed may be for contact people at an ISP providing Internet services, and they may not be aware that somebody is using their network in this way. They will require details of the abuse so they can investigate it further.
In case of spam or phishing, forward a copy of the spam/phishing email, including the full header. In case of hacking, include as much relevant information as possible to make it easier for the ISP to locate and deal with the abuser:
- Explain the situation and why you think it's an abuse case
- IP address responsible for the abuse
- Date and time (including time zone) the abuse took place
- Log file of the attack generated by your firewall, if possible
The RIPE community has an Anti-Abuse Working Group that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group .
The RIPE NCC can investigate reports about non-network abuse cases regarding:
- Internet number resource registrations
- Violation of RIPE Policies or RIPE NCC Procedures
- Provision of untruthful information to the RIPE NCC
- Bankruptcy, liquidation or insolvency
- Incorrect contact information in the RIPE Database
- Damage to the name, trademarks or intellectual property of the RIPE NCC