Knowledge base article, Prefixx, Inc. Last reviewed: [date of publication]
This article explains how to report abuse originating from IPv4 address space leased or transferred through Prefixx, what happens after a report is received, and what a Prefixx customer must do on receiving one. A report does not need to come from a Prefixx customer.
How to report abuse
Send the report by email to [email protected]. Reports sent to that address are recorded by the Prefixx Abuse Desk and matched to the holder of the address space concerned.
Reports in Abuse Reporting Format (ARF, RFC 5965) and Extended Abuse Reporting Format (X-ARF) are read automatically. Reports in plain text are accepted as well.
What to include
A report can be acted on only to the extent that it identifies the activity and the address involved. Include:
- the IP address or addresses involved;
- the date and time of each event, with the time zone;
- the type of abuse (see the list below);
- any domains, URLs and email addresses involved;
- evidence, such as log excerpts or the complete headers of the email concerned.
Evidence may be placed in the body of the email or attached to it. Attachments are stored with the report and may be forwarded to the holder of the address space. Do not attach material depicting child sexual abuse: report it by address and URL only, and report the material itself to the National Center for Missing & Exploited Children or the competent authority. Attachments received with such a report are not stored.
A report without an identifiable address or evidence may not allow Prefixx to take action.
Common types of abuse
The Abuse Desk records each report under one of the following types.
- Spam: unsolicited bulk email sent from, or advertising, the address space.
- Phishing: messages or websites that imitate a trusted party to obtain credentials, payment data or personal information.
- Malware or command and control: distribution of malicious software, or servers that control compromised systems.
- DDoS: traffic from the address space intended to make a service unavailable.
- Port scanning: systematic probing of other networks for open ports or services.
- Brute force: repeated automated attempts to guess credentials on another system.
- Copyright: content made available without the permission of the rights holder.
- Fraud: schemes intended to obtain money or property by deception.
- Child sexual abuse material: any distribution of such material. Also report it to the competent national authorities.
- Route hijack: announcement of the address space from an autonomous system that is not authorized for it.
- Sanctions: use of the address space by, or for the benefit of, a sanctioned person or jurisdiction.
- Other: any abuse that does not fit the types above.
For illegal material of any kind, also contact the competent law enforcement authorities.
Legal orders
Court orders, subpoenas and requests from law enforcement authorities are not handled by the Abuse Desk. Send them to [email protected].
What happens after you report
- The report is recorded and the sender receives an automatic acknowledgement with a reference in the form ABU-YYMMDD-XXXX. The acknowledgement confirms receipt; it is not a decision on the report.
- The Abuse Desk identifies the holder of the address space and forwards the report to that holder.
- Prefixx informs the sender of the outcome, or of the status of the matter, within 72 hours of receipt.
To add information, reply to the acknowledgement and keep the reference in the subject line. The reply is added to the same report.
Reports of critical abuse, as defined in Section 6.2 of the Acceptable Use Policy, are handled first. In those cases Prefixx may suspend the announcement authorizations for the address space (including any Letter of Authorization and route objects) immediately, upon written notice to the holder, as permitted by Section 19 of the Service Agreement.
What to do if you receive an abuse report
A Prefixx customer who receives an abuse report from the Abuse Desk must:
- acknowledge the report within 24 hours by replying to the Abuse Desk with the reference in the subject line;
- within 72 hours, resolve the matter or inform the Abuse Desk of the measures taken; and
- keep the abuse contact in the registry records for the address space current.
If a report is not acknowledged or resolved within these times, Prefixx may take the steps set out in Section 6 of the Acceptable Use Policy.
How quickly abuse is handled
- Every report is acknowledged automatically on receipt.
- The sender is informed of the outcome or status within 72 hours.
- The holder of the address space must acknowledge within 24 hours, or sooner where the handling time below is shorter, and resolve the matter or report the measures taken within the handling time for its type:
| Type of abuse | Handling time |
|---|---|
| Critical abuse, as defined in Section 6.2 of the Acceptable Use Policy | 12 hours |
| DDoS and phishing | 24 hours |
| All other types | 72 hours |
- Critical abuse is acted on immediately and may lead to measures under Section 6 of the Acceptable Use Policy without waiting for the handling time to expire.