XARF
The New Format Of Reporting Network Abuse
To stop attacks or take down illegal content, informing the owner or maintainer of the source is the only way to mitigate issues and therefore is an essential part of the internet infrastructure.
Trusted by
What is XARF?
Initially started as an open, community-driven effort, XARF is now the industry standard for sharing network abuse reports. Other than ARF, XARF is independent of the underlying transport medium as it’s just a simple JSON document that can be used in multiple channels.
When to use XARF?
XARF can be used to report different sorts of abuse, e.g.
- Spam
- Phishing attacks
- Hosted malware
- Illegal content
- Copyright issues
- DDOS attacks
What to do next?
First of all, XARF is a legitimate way of reporting abuse.
- Validate it against the schema.
- Read or parse the report.
- Handle the abuse.
- Inform the reporter that you took care of the report.
For more information, read the documentation.
- Create a report by modifying an example or writing one from scratch.
- Use the schema to validate your report.
- Lookup the responsible network owner (eg. with our service ContactDB) and send them the report.
- The network owner will now be informed about the threat within their network and hopefully remediates it.
Note: If you are using XARF for the first time, please take a look at our GitHub repository to check for examples.
XARF is a community effort. Be part of it!
How can I participate in XARF?
- Start using XARF
- Join our GitHub community
- Propose new threat types
- Discuss proposals
FAQs
All supported abuse types can be found in the samples directory on GitHub.
While ARF is only meant to report spam via email, XARF is independent of the underlying transport as it’s just a simple JSON document that you can be used in multiple channels.
XARF is more versatile as you can also build APIs and don’t need to use email/SMTP as the underlying tech.
XARF can already be used to report different abuse events into your own Abuse Management Platform like your AbuseHQ instance (internal reporting).
In future, Abusix will offer a central reporting service within our Abusix Portal which will send reports automatically to the correct recipient.
Everyone, but usually, this will be users who automate the generation and sending of the report. In future, everyone who experiences abuse should be able to report abuse through our Abusix Portal, where an XARF report will be generated and send to the correct recipients.
No, XARF does not detect abuse. You have to detect abuse within your network, gather evidence, and then use a XARF to package it up and finally send it to the correct recipient.
If you want to participate in XARF, you are more than welcome to. You can request new report types here.
How to make the most of XARF
With our abuse management platform AbuseHQ, you'll be able to level up your internal abuse report handling in an automated way. Let's talk to our team, to see how we can help you ramp it up!
Get a Demo