[db-wg] RIPE abuse finder

Dear Max

The RIPE NCC will very soon deploy the "abuse-c:" attribute. So over the 
next few months the quality of abuse contact data will improve 
considerably. This will allow the Abuse Finder tool to return more 
accurate results.

Because of the historical ways of defining abuse contacts, it is a 
documented feature that the current Abuse Finder tool sometimes extends 
too far and pulls in some email addresses that don't relate to the 
resource being searched.

The "abuse-mailbox:" was allowed in many different object types, without 
any software constraints, or even any guidelines, on where to put it in 
relation to a resource. This left it open to interpretation of each 
resource maintainer where the best place was to put it. So the Abuse 
Finder tool had to find a balance between not searching out far enough 
and searching out too far from the resource. With such a vague 
definition of where to put the abuse contacts it is inevitable that some 
results will be wrong until the "abuse-c:" starts to take effect.

Regards
Denis Walker
Business Analyst
RIPE NCC Database Group


On 05/03/2013 11:52, Max Tulyev wrote:
> Hello!
>
> Recently our company started to receive a lot of strange complaints
> relating to network we don't operate or route. I fount these complaints
> was sent to points of contact got by RIPE abuse finder.
>
> This is the fresh sample of it:
>
> IP: 31.133.58.219
>
> Output of RIPE abuse finder:
>
> https://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&primary-key=31.133.58.219
>
>
> {
>          "abuse-resources":{
>          "service":"abuse-finder",
>          "link":{
>          "xlink:type":"locator",
> "xlink:href":"http://apps.db.ripe.net/whois/use-cases/abuse-finder.json?source=ripe&primary-key=31.133.58.219"}
>
>          ,
>          "parameters":{
>          "primary-key":{
>          "value":"31.133.58.219"}
>          ,
>          "sources":{
>          "source":{
>          "name":"RIPE",
>          "id":"ripe"}
>          }
>          }
>          ,
>          "irt-objects":null,
>          "abuse-mailbox-attributes":{
>          "attribute":{
>          "name":"abuse-mailbox",
>          "value":"support at netassist.ua"}
>          }
>          ,
>          "objects-with-abuse-related-remarks":null}
>          }
>
> whois -B 31.133.58.219
> % This is the RIPE Database query service.
> % The objects are in RPSL format.
> %
> % The RIPE Database is subject to Terms and Conditions.
> % See http://www.ripe.net/db/support/db-terms-conditions.pdf
>
> % Information related to '31.133.32.0 - 31.133.63.255'
>
> inetnum:        31.133.32.0 - 31.133.63.255
> netname:        DIDAN
> descr:          FOP Trubnikov Valeriy Muhaylovich
> country:        UA
> org:            ORG-FTVM1-RIPE
> admin-c:        TA3197-RIPE
> tech-c:         TA3197-RIPE
> status:         ASSIGNED PI
> mnt-by:         RIPE-NCC-END-MNT
> mnt-lower:      RIPE-NCC-END-MNT
> mnt-by:         TRUBNIKOV-MNT
> mnt-routes:     TRUBNIKOV-MNT
> mnt-domains:    TRUBNIKOV-MNT
> changed:        hostmaster at ripe.net 20110415
> changed:        hostmaster at ripe.net 20110415
> source:         RIPE
>
> organisation:   ORG-FTVM1-RIPE
> org-name:       FOP Trubnikov Valeriy Muhaylovich
> org-type:       other
> address:        86156, Ukraine, Makiyivka, Zeleniy, 60/182
> admin-c:        TV1866-RIPE
> tech-c:         TA3197-RIPE
> e-mail:         core at didan.org
> mnt-ref:        TRUBNIKOV-MNT
> mnt-by:         TRUBNIKOV-MNT
> changed:        core at didan.org 20110414
> source:         RIPE
>
> person:         Trubnikov Andrey
> address:        86156, Ukraine, Makiyivka, Zeleniy, 60/182,
> phone:          +380623277657
> nic-hdl:        TA3197-RIPE
> changed:        core at didan.org 20110331
> mnt-by:         TRUBNIKOV-MNT
> source:         RIPE
>
> % Information related to '31.133.48.0/20AS52091'
>
> route:          31.133.48.0/20
> descr:          FOP Trubnikov Valeriy Muhaylovich
> origin:         AS52091
> mnt-by:         TRUBNIKOV-MNT
> changed:        core at didan.org 20110423
> source:         RIPE
>
> % Information related to 'AS52091'
>
> aut-num:        AS52091
> as-name:        TRUBNIKOV-AS
> descr:          FOP Trubnikov Valeriy Muhaylovich
> org:            ORG-FTVM1-RIPE
> import:         from AS47694 accept ANY
> export:         to AS47694 announce AS52091
> import:         from AS21189 accept ANY
> export:         to AS21189 announce AS52091
> admin-c:        TA3197-RIPE
> tech-c:         TA3197-RIPE
> mnt-by:         RIPE-NCC-END-MNT
> mnt-by:         TRUBNIKOV-MNT
> mnt-routes:     TRUBNIKOV-MNT
> changed:        hostmaster at ripe.net 20110415
> source:         RIPE
>
> organisation:   ORG-FTVM1-RIPE
> org-name:       FOP Trubnikov Valeriy Muhaylovich
> org-type:       other
> address:        86156, Ukraine, Makiyivka, Zeleniy, 60/182
> admin-c:        TV1866-RIPE
> tech-c:         TA3197-RIPE
> e-mail:         core at didan.org
> mnt-ref:        TRUBNIKOV-MNT
> mnt-by:         TRUBNIKOV-MNT
> changed:        core at didan.org 20110414
> source:         RIPE
>
> person:         Trubnikov Andrey
> address:        86156, Ukraine, Makiyivka, Zeleniy, 60/182,
> phone:          +380623277657
> nic-hdl:        TA3197-RIPE
> changed:        core at didan.org 20110331
> mnt-by:         TRUBNIKOV-MNT
> source:         RIPE
>
> whois -B TRUBNIKOV-MNT
> % This is the RIPE Database query service.
> % The objects are in RPSL format.
> %
> % The RIPE Database is subject to Terms and Conditions.
> % See http://www.ripe.net/db/support/db-terms-conditions.pdf
>
> % Information related to 'TRUBNIKOV-MNT'
>
> mntner:         TRUBNIKOV-MNT
> descr:          FOP Trubnikov Valeriy Muhaylovich
> admin-c:        TA3197-RIPE
> upd-to:         core at didan.org
> auth:           MD5-PW # Filtered
> mnt-by:         TRUBNIKOV-MNT
> referral-by:    TRUBNIKOV-MNT
> changed:        core at didan.org 20110418
> source:         RIPE # Filtered
>
> person:         Trubnikov Andrey
> address:        86156, Ukraine, Makiyivka, Zeleniy, 60/182,
> phone:          +380623277657
> nic-hdl:        TA3197-RIPE
> changed:        core at didan.org 20110331
> mnt-by:         TRUBNIKOV-MNT
> source:         RIPE
>
> Is it a bug or a feature, and why?
>
>
>