What contact is used for abuse forwarding?

You’re not setting up these contacts with Cloudflare, but with the IP registry where you IP addresses are allocated / assigned from.

To take on example, the European IP registry RIPE - https://ripe.net has their website pointed to the IPv4 address 193.0.6.139 and the IPv6 address 2001:67C:2E8:22::C100:68B:

RIPE Whois: 193.0.6.139

RIPE Whois: 2001:67C:2E8:22::C100:68B

As you see when you search for these addresses, they are assigned to RIPE’s own organisation object, ORG-RIEN1-RIPE.

In addition, the organisation object ORG-RIEN1-RIPE has the “abuse-c” field that links to “OPS4-RIPE”.

When you are looking in to the “OPS4-RIPE” role, you will see that one has a field called “abuse-mailbox”, which is linking directly to an email address, in this case, “[email protected]”.

So, if RIPE happened to use Cloudflare, and Cloudflare should forward an abuse report for content that Cloudflare sees behind the above IP addresses, that would be done to “[email protected]”.

The other IP registries, such as e.g. ARIN (American Registry for Internet Numbers), APNIC (Asia Pacific Network Information Centre), and others, have similar ways of assigning abuse contact email addresses to IP addresses / subnets.

However, if the IP addresses are not allocated directly to you from the IP registry, but to e.g. a hosting provider, that is lending them out to you, you would need to contact that specific hosting provider, in order to have them re-assign / SWIP the IP address(es) to you, so that they appear with the details of your company (including your abuse email address).

3 Likes