Re: Survey on IP Address Abuse Reporting Practices and Managements

["Li, Weitong via NANOG" <nanog () lists nanog org>]

Dear NANOG,

Thank you for the replies — both the substantive critiques and the pointed ones. Jamie and Sergey were right that the 
original note should have identified the researchers, the institution, the advisor, and the IRB tracking number, and I 
apologize for that omission.

For the record:

- Researchers: myself (Weitong Li, Postdoctoral Researcher, weitongli () vt edu) and my advisor, Prof. Taejoong (Tijay) 
Chung (tijay () cs vt edu), Department of Computer Science, Virginia Tech.

- Ethics review: the study, including the two surveys, has been reviewed by the Virginia Tech Human Research Protection 
Program and determined to be Not Human Subjects Research (IRB tracking number IRB-26-064). No personally identifiable 
information is collected, and the organization/ASN field is explicitly optional. Questions about participant rights can 
go to irb () vt edu.

On the substance: Izaac suggested that running a script over WHOIS is enough to show that abuse contacts are broken. I 
agree that measurement is where this work starts, and the surveys are in fact a small complement to a larger 
measurement study — distributed honeypot observations plus a randomized controlled reporting experiment across several 
thousand reports — that attempts exactly the kind of systematic evaluation a one-shot script cannot provide: how 
effectiveness varies by recipient choice, by registry, by infrastructure type (ISP / hosting / leasing / BYOIP), and by 
follow-up strategy.

What measurement cannot see is the operator-side reasoning: how abuse desks triage reports, which evidence they 
actually find useful, and why a structured abuse-c field sometimes loses to a free-text note — or to a well-placed 
trolling address. Randy, thanks for the live demo; AR52766-RIPE is a memorable case in point and sits squarely inside 
what we are trying to characterize, namely the gap between what registry records look like and what they do in 
practice. The surveys exist to capture that operator-side reasoning, not to substitute for measurement.

The surveys are now reopened with updated consent information at the top of each form:

- Abuse report senders:
https://forms.gle/oDAa8ZDnwsGZiNFT6

- Abuse report recipients / abuse contacts:
https://forms.gle/TPKjjwXFuhuX8GV7A

One more note, and an apology: if you already submitted a response before the surveys were paused, thank you, and I am 
sorry to have to ask this — those earlier responses fell outside the updated consent terms and will not be used in our 
analysis. If you are willing to submit again under the updated consent, it would be genuinely appreciated, and if you 
prefer not to, I completely understand.

If there are questions, we should consider adding, framings we should adjust, or sharp operational cases we ought to 
cover, I would be glad to hear from the list, on or off.

Thanks again,
Weitong Li
Virginia Tech

weitongli () vt edu

________________________________
From: Li, Weitong via NANOG <nanog () lists nanog org>
Sent: Wednesday, April 22, 2026 4:23 PM
To: nanog () lists nanog org <nanog () lists nanog org>
Cc: Li, Weitong <weitongli () vt edu>
Subject: Survey on IP Address Abuse Reporting Practices and Managements

Dear NANOG community members,
We are researchers from Virginia Tech. We are studying the management of Abuse contacts in WHOIS records for IP address 
and how abuse contacts are managed and how abuse reports are handled in practice, from both the sender side and the 
recipient side.
To better understand the operational reality of abuse reporting, we invite you to participate in our surveys:
For abuse report senders: 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fforms.gle%2FoDAa8ZDnwsGZiNFT6&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862721897585%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=YMzV5vbvpljNuqQ0r7Hu3ezyGWWCD%2FWVmQGsuy0RBHc%3D&reserved=0<https://forms.gle/oDAa8ZDnwsGZiNFT6>
For abuse report recipients / abuse contacts: 
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fforms.gle%2FTPKjjwXFuhuX8GV7A&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862721965020%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=8fAbyFls3JqiLBJ04MNL24rpJGgm6Gx38gQgGFR3gqo%3D&reserved=0<https://forms.gle/TPKjjwXFuhuX8GV7A>
Privacy & Data Usage: We are committed to protecting participants’ data. Survey responses will be handled carefully, 
and any reporting of results will not reveal personally identifiable information.
Thank you for your time and for supporting this research!
Best,
Weitong
_______________________________________________
NANOG mailing list
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2F26FSBQWIG7WGMEKEZCVJE5R566BMME7O%2F&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862722028081%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QpGMtkbCYOwiJ5z16o5ks2SydMPE%2BzRLlVHt6QKb3zA%3D&reserved=0<https://lists.nanog.org/archives/list/nanog
 () lists nanog org/message/26FSBQWIG7WGMEKEZCVJE5R566BMME7O/>
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XQGSSGDJXXEHX37CX7COHVHIV6TIOKMU/