# IP abuse contacts: 20 mailboxes cover 48.8% of IPv4

We mapped the abuse contact of every routed IPv4 address: 221,383 mailboxes, 20 of which take reports for 48.8% of it, and 31.5% inherited from a parent block.

In a 2022 [Ask HN thread](https://news.ycombinator.com/item?id=33214281), a developer asked whether it was worth emailing the whois abuse contacts of the addresses probing their web server, most of them at Microsoft, Amazon and Google. Where those reports land is something we can measure: our [IP Abuse Contact](https://internetdata.io/databases/ip-abuse-contact) database has an abuse contact for every routed IPv4 address. On 2026-10-08, the 3,127,821,712 routed addresses reported to 221,383 mailboxes.

## Where reports land

| Mailboxes, largest first | Share of routed IPv4 they take reports for |
|---|---|
| 1 | 6.1% |
| 5 | 22.5% |
| 10 | 36.7% |
| 20 | 48.8% |
| 100 | 67.7% |
| 1,000 | 82.0% |
| 10,000 | 90.8% |

By organization, the largest is the US Department of Defense, whose two registration mailboxes take reports for 9.4% of routed IPv4. Then come AWS with 5.7%, China Telecom 3.6%, AT&T 3.2%, Verizon Business 2.9%, Microsoft 2.6%, Comcast 2.2%, and China Unicom and Charter with 2.0% each.

A report to one of these is one of a great many, so make it one a desk can act on without reading prose: the address, the time with its time zone, and the log lines that show what happened.

## A third of it inherits its contact

31.5% of routed IPv4 has no abuse contact in its own record. Its contact comes from a larger block above it, usually the ISP or hosting provider that assigned it, and a report about a hosting customer's address then goes to the provider, which has to pass it on.

IP Abuse Contact's `network` column shows when that happens. It's the block whose record named the contact, so it's larger than the range when the range inherited it. Customer blocks that do name a contact of their own are often on the operator's own RWHOIS server rather than in registry whois, which is what [IP RWHOIS](https://internetdata.io/databases/ip-rwhois) collects.

## National registries

9.8% of routed IPv4 names a national registry's mailbox as its abuse contact, in Japan, Korea, China, Taiwan and a few other countries, where the national registry keeps its members' records. Japan's takes reports for 3.8% and Korea's for 3.4%. A report there reaches the registry rather than the network itself, so the network announcing the address, which [BGP Route](https://internetdata.io/databases/bgp-route) gives, is the other place to look.

## Small networks

13,783 mailboxes at free webmail providers, Gmail, Yahoo, Outlook, QQ, 163 and the like, take reports for 0.64% of routed IPv4. They average about 1,450 addresses each: small networks, where a report goes straight to whoever runs them.

## Sending reports at scale

Look each address up in a local copy instead of querying whois one address at a time, and group what you send by mailbox, so each desk gets one message listing all of its addresses. Check the `network` column before you write: when it's larger than the range, your report goes to the provider above the address, not to whoever runs it.

## How we measured

We took IP Abuse Contact as built on 2026-10-08 and the IPv4 prefixes announced in the global routing table that day, merged the routed prefixes, and counted each abuse range's routed addresses toward its mailbox. Each contact comes from registry records and operators' RWHOIS servers: the most specific record that names one. The ranking counts operators' and national registries' mailboxes.

IP Abuse Contact is a gzipped CSV and MMDB download, and [its docs](https://docs.internetdata.io/database/ip-abuse-contact) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).