[anti-abuse-wg] Sources of Abuse Contact Info For Abuse Handlers

Hi,

We certainly agree on the facts :)

>> A domain may expire in a year and then be recycled - registered by
>> someone else, usually a domainer.
>> 
>> On the other hand if someone takes the trouble to get a prefix, an
>> ASN, transit / peering and such I dare say he won’t give up the
>> prefix all that easily (barring accidents such as going out of
>> business)
>> 
>> The bar is much higher because
>> 
>> 1. Far fewer prefixes than domains, by orders of magnitude
>> 
> 
> +1 higher costs than for a domain :) Very simple

Yes, but I'd argue that if a domain really expires after one year, that
means that the information is updated at the time of (re-)registration.
The data for a prefix, while staying potentially longer the same, might
more easily be forgotten.

So the relative volatility of domains makes that data is corrected more
often than for prefixes. But in absence of hard data is is speculation
any way.

Obviously, I'm assuming that you actually query the authoritative whois
server and not try to keep copies.

>> 2. A single prefix can have thousands of domains hosted on it -
>> sort of aggregating things very conveniently, abuse handling wise.

Playing devil's advocate I'd argue that this means that domain name
contacts are the more accurate information, because less aggregated.

Convenience (and possibly efficiency) makes number-based investigations
the better choice. And yet, this does not allow to conclude anything
about the data accuracy in time.

best,
Gilles


>> —srs
>> 
>>> On 17-Nov-2015, at 7:09 PM, Gilles Massen
>>> <gilles.massen at restena.lu> wrote:
>>> 
>>> - under point 4 it says implicitly that name-based whois is
>>> quicker outdated than number-based whois. Is there any hard data
>>> to back that statement up?
>> 
>> 
> 
> 
>