Network Abuse
Indexing & reporting

All network abuse on the network is automatically indexed in a central database. Aggregated reports per IP-address are emailed at least one a day to the originating networks's abuse contact in X-ARF format. If the number of incidents form a subnet is too high, the subnet will be added to the firewall automatically.

Learn more


The system analyses logfiles from several applications to detect abuse and add it to the database.


The system searched the abuse-contect for the offending IP-address sends an X-ARF email. If the email is handled by a ticketing system, the ticket-ID will be detected and linked to our report. New reports will be added to the same ticket.


When too much abuse from a subnet is detected, a firewall rule for blocking traffic from the subnet will be created and activated automatically. The rule will be removed a few days after the abuse has stopped.

If you don't report abuse incidents, the administrators of the offending network don't know about the problem and the problems will continue.

Frequently Asked Questions.

Is your software Open Source? Can we get a copy of it?
Unfortunately, it isnt. The software is very system specific and i do not have much time for support and new features. I don't think it's a good idea to start an Open Source project if you don't maintain it. But fee free to copy my idea and write your own Open Source software (a reference or some credits for the idea would be nice).
How do you find the abuse contacts for the offening IP-address?
In the past, we used AbuseIX's data for all reports, but unfortunately, they're missing contacts for losts of ipaddresses and sometimes list the wrong contact address. So I started to add corrections to my own database, which is now the primary source for contact information.
We would like to add your next report to same ticket in our support system.
When you send a reply to the report, please leave our report-ID (including the square brackets) in the subject and add yours (also between square brackets). The system will detect your ticket-ID and add it to our next report.
Stop sending your annoying emails!
If you stop the abuse from your network, the emails will stop automatically.
What about X-ARF? Which software can i use to automatically handle these messages?
I don't have a full list of applications, but is a nice tool for taking care of network abuse, including X-ARF support.
You should contact our customer, listed in the IP-range's WHOIS
As an ISP, you probably have rules about abuse in your terms and conditions. I suppose you want to know about your customer's misbehaviour, so you can warn them or quit their services? Or is facilitating abuse your core business?
We're not portscanning, we're a research project indexing the use of software
Stop it right now! Your project is a high security risk. If somebody gets access to your database, he has a ready to use list of exploitable machines when an bug is found. Beside, compare it to this: your checking the frontdoor of every building on the world if they locked the door. Your not breaking in, but you keep a list of all addresses with unlocked doors.
We would like to invite you as a speaker about your experience with network abuse and reporting it.
Great! Please use the contact form to get in touch.

Contact Us

Get in touch

If you have any questions about the software, managing abuse in your network or anything else, please do not hesitate to use the contact form. Normally your question will be answered in 24 hours.