[anti-abuse-wg] Automatic IP -> abuse email address mapping

Olaf van der Spek wrote:
> Hi,
>
> I hope this is the right list for such a question.
> How does one map an IP address to an abuse email address in an automated
> way?
> I assume scripts exist, but I haven't found any. Does everyone roll
> their own?

There are no public script to my knowledge

This kind of automatic mapping is quite complicated and
mostly internal know-how of f.e. blacklists, that do
automatic reporting.

The steps to do it are something like this:

- first you need to identify, wich RIR is responsible for the
   IP/netblock, this is tricky, because there more RIRs like
   only RIPE, ARIN, LACNIC, AFRNINIC and APNIC, that actually
   hold the information you need (f.e. KRNIC and BRNIC aso) and because
   there are early registration networks, that usally do not
   belong to the RIR you would expect
- all whois interfaces at the RIRs are different, parsing is
   difficult, different options too and all have different regulations
   and fields with even dubled content
- then there are limits, how many whois queries you can do

We have a pearl-script doing all this with over
3000 lines of code, and this code has to be adjusted
nearly every month ...

It would be a dream, if this group could discuss
a standard whois output format for all RIRs.
And the final step could be a centralized whois, anybody
could ask for the abuse contact covering the data
of all RIRs.


Kind regards, Frank
Network Operation Center - PowerWeb
--
MOTD: "have you enabled SSL on a website or mailbox today ?"
--
PHADE Software - PowerWeb                       http://www.powerweb.de
Inh. Dipl.-Inform. Frank Gadegast             mailto:frank at powerweb.de
Schinkelstrasse 17                                fon: +49 33200 52920
14558 Nuthetal OT Rehbruecke, Germany             fax: +49 33200 52921
======================================================================





>
>
> --
> Olaf