subnethistory.

How to report IP abuse and actually get a response

4 min read ·

Somewhere an address is attacking your server, spamming your users, or scraping your site, and the internet's answer is a mailbox: every block of address space has a published abuse contact whose job is to hear about it. Most reports sent there die unread anyway, because they go to the wrong mailbox, arrive without the evidence an operator can act on, or land at a contact that answers nothing. Here is the version that works, and what to do when it does not.

An abuse report with dated evidence arriving at the block's abuse mailbox, and an acknowledgement coming back logs, dates, one incident abuse-c for the block
The whole system in one picture: a report carrying dated evidence, aimed at the mailbox registered for the block, and the acknowledgement that follows when both halves are right.

Abuse contacts are registered per block, and the commonest failure is reporting to the wrong level of the registration hierarchy: mailing a national ISP about a customer's assigned range, or a customer about their provider's whole allocation. Look the address up, read which block actually contains it, and take the abuse contact from that record; where a smaller assignment has its own contact, that one is closer to the machine and usually faster. Two checks before sending: that the network is not a VPN or proxy exit, where the operator can rarely identify the user and your report becomes a blocking decision instead, and that the address is not spoofed or reserved space, where there is nobody to write to at all.

Write a report an operator can act on

The person reading an abuse mailbox handles volume, and acts on the reports that need no follow-up questions. That means one incident per report, and four things in it:

  • The address and the exact timestamps, with timezone. On consumer networks the address may map to a different subscriber every day, or to the same one for months, and behind carrier NAT it maps to many subscribers at once, so the port numbers matter too. Without precise times, the operator cannot find their customer even when they want to.
  • Raw evidence, inline. Log lines, mail headers, packet excerpts, unedited. A prose summary of logs is not evidence; the logs are.
  • What the traffic did, in one plain sentence: brute-forcing SSH, sending spam to these recipients, scraping at this rate.
  • What you want: usually that they investigate and stop it. Not identification of the user, which they will not give you and the law would not let them.

Skip threats, legal bluster and twenty-address omnibus reports. The operator is not the attacker; they are the attacker's landlord, and the report that treats them as a colleague gets read.

What to expect back

A serious operator acknowledges, investigates, and acts on their customer, throttling, cleaning, or terminating, though privacy usually means you see the effect rather than a case report. Before any of that, the desk is deciding whether the address is even theirs and whether your message can be acted on as sent, which is why a report missing a time zone or its raw lines comes back with a question instead of an outcome. Silence for a few days is normal at big ISPs; permanent silence is data. Expect nothing beyond the stopping: no user identity, no confirmation of who it was, and usually no details of what they did. The measure of success is that the traffic ends.

When the contact is dead or hostile

Some abuse contacts bounce, some auto-acknowledge into a void, and some networks simply do not care; an unreachable abuse contact is itself a fact worth knowing about a network, and one this site records when it finds it. When the registered contact fails, escalate along the money: the network's upstream providers, visible in any lookup, have abuse teams and contractual leverage, and hosting resellers sit under providers who do answer. In parallel, report where it also counts: blocklist operators for spam sources, and the relevant platform for phishing or malware. A network that ignores its abuse mailbox tends to end up answering to blocklists instead, which is the system's slow but real enforcement.

Reporting at scale

If you run infrastructure, reporting stops being an occasional letter and becomes plumbing: automated, formatted consistently, and aimed by lookup rather than by hand. The same rules survive the automation, the right block's contact, precise times, raw evidence, one incident per message, and a lookup step in the pipeline keeps reports aimed at the level of the hierarchy that can act. The history matters at scale too: an address that has been flagged for months across a whole block justifies blocking the range and telling the upstream, where a first offence from clean space justifies a polite report and patience. The record tells you which letter to write.

Look up any address on the front page to get the abuse contact for its actual block, the network above it for escalation, and the dated history that says whether you are reporting a first offence or a career. Every fact names its source.