Dear Max The RIPE NCC will very soon deploy the "abuse-c:" attribute. So over the next few months the quality of abuse contact data will improve considerably. This will allow the Abuse Finder tool to return more accurate results. Because of the historical ways of defining abuse contacts, it is a documented feature that the current Abuse Finder tool sometimes extends too far and pulls in some email addresses that don't relate to the resource being searched. The "abuse-mailbox:" was allowed in many different object types, without any software constraints, or even any guidelines, on where to put it in relation to a resource. This left it open to interpretation of each resource maintainer where the best place was to put it. So the Abuse Finder tool had to find a balance between not searching out far enough and searching out too far from the resource. With such a vague definition of where to put the abuse contacts it is inevitable that some results will be wrong until the "abuse-c:" starts to take effect. Regards Denis Walker Business Analyst RIPE NCC Database Group On 05/03/2013 11:52, Max Tulyev wrote:
Hello!
Recently our company started to receive a lot of strange complaints relating to network we don't operate or route. I fount these complaints was sent to points of contact got by RIPE abuse finder.
This is the fresh sample of it:
IP: 31.133.58.219
Output of RIPE abuse finder:
https://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&primary-key=31.133.58.219
{ "abuse-resources":{ "service":"abuse-finder", "link":{ "xlink:type":"locator", "xlink:href":"http://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&primary-key=31.133.58.219"}
, "parameters":{ "primary-key":{ "value":"31.133.58.219"} , "sources":{ "source":{ "name":"RIPE", "id":"ripe"} } } , "irt-objects":null, "abuse-mailbox-attributes":{ "attribute":{ "name":"abuse-mailbox", "value":"support@netassist.ua"} } , "objects-with-abuse-related-remarks":null} }
whois -B 31.133.58.219 % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Information related to '31.133.32.0 - 31.133.63.255'
inetnum: 31.133.32.0 - 31.133.63.255 netname: DIDAN descr: FOP Trubnikov Valeriy Muhaylovich country: UA org: ORG-FTVM1-RIPE admin-c: TA3197-RIPE tech-c: TA3197-RIPE status: ASSIGNED PI mnt-by: RIPE-NCC-END-MNT mnt-lower: RIPE-NCC-END-MNT mnt-by: TRUBNIKOV-MNT mnt-routes: TRUBNIKOV-MNT mnt-domains: TRUBNIKOV-MNT changed: hostmaster@ripe.net 20110415 changed: hostmaster@ripe.net 20110415 source: RIPE
organisation: ORG-FTVM1-RIPE org-name: FOP Trubnikov Valeriy Muhaylovich org-type: other address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182 admin-c: TV1866-RIPE tech-c: TA3197-RIPE e-mail: core@didan.org mnt-ref: TRUBNIKOV-MNT mnt-by: TRUBNIKOV-MNT changed: core@didan.org 20110414 source: RIPE
person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core@didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE
% Information related to '31.133.48.0/20AS52091'
route: 31.133.48.0/20 descr: FOP Trubnikov Valeriy Muhaylovich origin: AS52091 mnt-by: TRUBNIKOV-MNT changed: core@didan.org 20110423 source: RIPE
% Information related to 'AS52091'
aut-num: AS52091 as-name: TRUBNIKOV-AS descr: FOP Trubnikov Valeriy Muhaylovich org: ORG-FTVM1-RIPE import: from AS47694 accept ANY export: to AS47694 announce AS52091 import: from AS21189 accept ANY export: to AS21189 announce AS52091 admin-c: TA3197-RIPE tech-c: TA3197-RIPE mnt-by: RIPE-NCC-END-MNT mnt-by: TRUBNIKOV-MNT mnt-routes: TRUBNIKOV-MNT changed: hostmaster@ripe.net 20110415 source: RIPE
organisation: ORG-FTVM1-RIPE org-name: FOP Trubnikov Valeriy Muhaylovich org-type: other address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182 admin-c: TV1866-RIPE tech-c: TA3197-RIPE e-mail: core@didan.org mnt-ref: TRUBNIKOV-MNT mnt-by: TRUBNIKOV-MNT changed: core@didan.org 20110414 source: RIPE
person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core@didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE
whois -B TRUBNIKOV-MNT % This is the RIPE Database query service. % The objects are in RPSL format. % % The RIPE Database is subject to Terms and Conditions. % See http://www.ripe.net/db/support/db-terms-conditions.pdf
% Information related to 'TRUBNIKOV-MNT'
mntner: TRUBNIKOV-MNT descr: FOP Trubnikov Valeriy Muhaylovich admin-c: TA3197-RIPE upd-to: core@didan.org auth: MD5-PW # Filtered mnt-by: TRUBNIKOV-MNT referral-by: TRUBNIKOV-MNT changed: core@didan.org 20110418 source: RIPE # Filtered
person: Trubnikov Andrey address: 86156, Ukraine, Makiyivka, Zeleniy, 60/182, phone: +380623277657 nic-hdl: TA3197-RIPE changed: core@didan.org 20110331 mnt-by: TRUBNIKOV-MNT source: RIPE
Is it a bug or a feature, and why?