You are here: Home > Get Support > Spam, Hacking and Phishing

How to Find Abuse Contact Information

Two ways to find abuse contact information:

  1. RIPE Database query
    - How to Find Abuse Contacts in the RIPE Database
  2. RIPEstat's Abuse Contact Finder
    - How to use RIPEstat's Abuse Contact Finder

You've probably ended up here because you were spammed or hacked, you searched for information about the IP address responsible, and you discovered it was allocated by the RIPE NCC.

The RIPE NCC is one of five Regional Internet Registries (RIRs) that allocates blocks of IP addresses to Internet service providers (ISPs) and other organisations, but has no involvement in how these addresses are used. This page contains information on how we can help you and how you can help yourself.

Further Information

What the RIPE NCC Can and Can't Do

Please note that the following information is about finding contacts for network abuse. For other types of abuse, such as the violation of RIPE Policies or incorrect information in the RIPE Database, see the section below on other types of abuse.

The RIPE NCC is not responsible for spamming or hacking. The RIPE NCC never sends unsolicited emails, including spam and phishing emails, and the RIPE NCC network is never used to facilitate the sending of spam or any other kind of network abuse.

The way in which an individual IP address is used is not under the RIPE NCC's control. As an RIR, the RIPE NCC allocates blocks of IP addresses to Local Internet Registries (LIRs) in Europe, the Middle East and parts of Central Asia. How these LIRs then assign these IP addresses, either to other ISPs, to End Users or within their own networks, is beyond the RIPE NCC's mandate.

However, if you suspect that the spam, hacking or network abuse originates from the following IP blocks, please contact us as soon as possible. These ranges are used by the RIPE NCC:

193.0.0.0 - 193.0.31.255
193.30.30.0/23
93.175.144/20
84.205.64/19
2001:7fb::/32
2001:7fd::/32
2001:67c:e0::/48
2001:67c:2888::/47
2001:67c:2900::/43
2001:67c:2e8::/48
2001:67c:64::/48

If the IP address falls outside these ranges, we are unable to investigate the matter ourselves. However, you can try to find abuse contact information yourself using RIPEstat's Abuse Contact Finder described below.

Please note that the RIPE NCC's tools cannot provide contact information for IP addresses allocated outside of its service region.

How to Find Abuse Contacts in the RIPE Database

  1. Go to the RIPE Database Query page or click in the box above to search for an IP address or ASN.
  2. Type in the IP address you wish to investigate.
  3. Check the results returned in the yellow box. Here you will see the abuse contact information. Example:

All IP addresses that were allocated or assigned within the RIPE NCC's service region and are registered in the RIPE Database must have an abuse contact associated with them.

RIPEstat's Abuse Contact Finder

RIPEstat is an information service for Internet-related data and the Open Data platform for the RIPE NCC. As such, it is a helpful tool in handling abuse.

How to find abuse contacts using RIPEstat:

1. Go to RIPEstat
2. Enter the IP address causing the abuse:

3. Click on the "Anti Abuse" tab to see the "Abuse Contact Finder" widget:

Additional information that can be helpful:

Reporting Abuse

If you are successful in finding an abuse contact for the IP address, you can report the abuse to the relevant contact. However, please keep in mind that the email address(es) listed may be for contact people at an ISP providing Internet services, and they may not be aware that somebody is using their network in this way. They will require details of the abuse so they can investigate it further.

In case of spam or phishing, forward a copy of the spam/phishing email, including the full header. In case of hacking, include as much relevant information as possible to make it easier for the ISP to locate and deal with the abuser:

  • Explain the situation and why you think it's an abuse case
  • Include the IP address responsible for the abuse
  • Provide the date and time (including time zone) the abuse took place
  • Add the log file of the attack generated by your firewall, if possible

Anti-Abuse Working Group

The RIPE community has an Anti-Abuse Working Group that discusses topics relating to Internet abuse and ways to prevent it. If you are interested in abuse topics, you may want to join the Anti-Abuse Working Group mailing list.

Reporting Other Complaints

The RIPE NCC can investigate reports about non-network abuse cases regarding:

  • Internet number resource registrations
    • Violation of RIPE Policies or RIPE NCC Procedures
    • Provision of untruthful information to the RIPE NCC
    • Bankruptcy, liquidation or insolvency
    • Incorrect contact information in the RIPE Database
  • Damage to the name, trademarks or intellectual property of the RIPE NCC

For more information about reporting these types of abuse, please see the RIPE NCC Reporting Procedure.