- Why is the number of incoming network abuse & spam reports increasing?
- How can I handle thousands of incoming abuse reports per day?
- How can I protect my network from being overtaken by malware?
- How can I protect the Internet from the zombie users in my network?
- How can I protect the users in my network from the Internet?
- abusix sheds light into your Network Abuse Department!
Abuse Contact DB
Abuse Contact DB is a proxy database service for people who want to report network abuse directly to network owners, without getting lost in the whois databases or get rate-limited by whois servers. It is an easy-to-handle mechanism that allows you to look up abuse contact email addresses from which abusive content was sent by searching for an IP address.
Where do you get the data from?
We query the information stored in the whois record for the range in question. Where possible the Abuse Contact Database will return an address which is declared as abuse contact, as a failover a technical contact may be returned.
We use only the biggest by RIRs (ARIN, RIPE, LACNIC, APNIC, AFRINIC) allocated ranges and the abuse contact addresses. If you believe there is a problem with the data or something is going wrong, please let us know so we can update it in time.
With the new interface the available ARIN and APNIC abuse contact information may be considered complete.
As easy to use as a DNS-Query
The database is DNS driven. This means that you can send requests to the DNS server in the same way you would do with a RBL or any other DNS based list.
To obtain the abuse contact for IP 220.127.116.11 query abuse-contacts.abusix.org with the reverse IP:
# host -t TXT 18.104.22.168.abuse-contacts.abusix.org
The response contains the abuse contact in the TXT record:
22.214.171.124.abuse-contacts.abusix.org descriptive text "firstname.lastname@example.org"
Multiple results are comma-separated in one TXT record:
126.96.36.199.abuse-contacts.abusix.org descriptive text "email@example.com,firstname.lastname@example.org"
To obtain only the information whether there is at least one abuse contact available for IP 188.8.131.52 query abuse-contacts.abusix.org for the A record:
host -t A 184.108.40.206.abuse-contacts.abusix.org
If there is at least one abuse contact available the query returns 127.0.0.1:
220.127.116.11.abuse-contacts.abusix.org has address 127.0.0.1
If you do not get any result, the range or IP does not exist or the responsible network owner didn't declare an abuse contact yet.
IPv6 Queries (currently fully implemented for ARIN & APNIC only)
The Abuse Contact Database also offers queries for IPv6 addresses.
To obtain the abuse contact for an IPv6 address query abuse-contacts.abusix.org like this:
Reverse the IPv6 address, see this Wikipedia article.
Perform the DNS lookup for 2001:4800:4860::8844 like this:
# host -t TXT 18.104.22.168.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6.8.4.0.0.8.4.22.214.171.124.abuse-contacts.abusix.org
The response will provide you with the abuse contact in the TXT record:
126.96.36.199.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6.8.4.0.0.8.4.188.8.131.52.abuse-contacts.abusix.org descriptive text "email@example.com"
Command-Line Tool querycontacts
A python-based command-line tool called querycontacts is available which offers some convenience.
- Installation: Download or install with...
# pip install querycontacts
- Perform your queries:
# querycontacts 184.108.40.206
# querycontacts -6 2001:4800:4860::8844
The Abusix Contact DB offers different subzones pointing to the abuse contacts of different RIRs:
abuse-contacts.abusix.org -> All
arin.abuse-contacts.abusix.org -> ARIN
afrinic.abuse-contacts.abusix.org -> AfriNIC
lacnic.abuse-contacts.abusix.org -> LACNIC
apnic.abuse-contacts.abusix.org -> APNIC
ripencc.abuse-contacts.abusix.org -> RIPENCC
What does this service cost me?
It is for free! You can use the data to start reporting abusive behavior globally. If you use the information, we just want you to put this small reference into every single message, outlining that you have used the Abuse Contact DB:
The recipient address of this report was provided
by the Abuse Contact DB by abusix.com.
abusix.com does not maintain the content of the database.
All information which we pass out, derives from the RIR
databases and is processed for ease of use.
If you want to change or report non working abuse contacts
please contact the appropriate RIR.
If you have any further question, contact abusix.com directly via
Information about the Abuse Contact Database can be found here:
abusix.com is neither responsible nor liable for
the content or accuracy of this message.
THIS DNS QUERY SERVICE IS PROVIDED "AS IS" AND "FREE" (AND MAY BE CANCELLED OR CHANGED BY THE PROVIDER AT ANY TIME), WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE PROVIDERS OF THIS SERVICE BE LIABLE FOR ANY COMPENSATION, CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SERVICE.
Go to spamfeed.me to visit the worlds' first cloud restaurant serving customized realtime spam datafeeds.
blackhole.mx is the Galactic Spam Reporting Center from abusix.
Help reporting spam by using the Thunderbird Addon and join the Global Reporting community!