On this page
In a 2022 Ask HN thread, a developer asked whether it was worth emailing the whois abuse contacts of the addresses probing their web server, most of them at Microsoft, Amazon and Google. Where those reports land is something we can measure: our IP Abuse Contact database has an abuse contact for every routed IPv4 address. On 2026-10-08, the 3,127,821,712 routed addresses reported to 221,383 mailboxes.
Where reports land
| Mailboxes, largest first | Share of routed IPv4 they take reports for |
|---|---|
| 1 | 6.1% |
| 5 | 22.5% |
| 10 | 36.7% |
| 20 | 48.8% |
| 100 | 67.7% |
| 1,000 | 82.0% |
| 10,000 | 90.8% |
By organization, the largest is the US Department of Defense, whose two registration mailboxes take reports for 9.4% of routed IPv4. Then come AWS with 5.7%, China Telecom 3.6%, AT&T 3.2%, Verizon Business 2.9%, Microsoft 2.6%, Comcast 2.2%, and China Unicom and Charter with 2.0% each.
A report to one of these is one of a great many, so make it one a desk can act on without reading prose: the address, the time with its time zone, and the log lines that show what happened.
A third of it inherits its contact
31.5% of routed IPv4 has no abuse contact in its own record. Its contact comes from a larger block above it, usually the ISP or hosting provider that assigned it, and a report about a hosting customer's address then goes to the provider, which has to pass it on.
IP Abuse Contact's network column shows when that happens. It's the block whose record named the contact, so it's larger than the range when the range inherited it. Customer blocks that do name a contact of their own are often on the operator's own RWHOIS server rather than in registry whois, which is what IP RWHOIS collects.
National registries
9.8% of routed IPv4 names a national registry's mailbox as its abuse contact, in Japan, Korea, China, Taiwan and a few other countries, where the national registry keeps its members' records. Japan's takes reports for 3.8% and Korea's for 3.4%. A report there reaches the registry rather than the network itself, so the network announcing the address, which BGP Route gives, is the other place to look.
Small networks
13,783 mailboxes at free webmail providers, Gmail, Yahoo, Outlook, QQ, 163 and the like, take reports for 0.64% of routed IPv4. They average about 1,450 addresses each: small networks, where a report goes straight to whoever runs them.
Sending reports at scale
Look each address up in a local copy instead of querying whois one address at a time, and group what you send by mailbox, so each desk gets one message listing all of its addresses. Check the network column before you write: when it's larger than the range, your report goes to the provider above the address, not to whoever runs it.
How we measured
We took IP Abuse Contact as built on 2026-10-08 and the IPv4 prefixes announced in the global routing table that day, merged the routed prefixes, and counted each abuse range's routed addresses toward its mailbox. Each contact comes from registry records and operators' RWHOIS servers: the most specific record that names one. The ranking counts operators' and national registries' mailboxes.
IP Abuse Contact is a gzipped CSV and MMDB download, and its docs list the columns. To license it, see pricing or talk to us.
