Re: Survey on IP Address Abuse Reporting Practices and Managements

[Tom Beecher via NANOG <nanog () lists nanog org>]

Weitong-

Thanks for the response. Few comments.

The entire industry can tell you that the signal to nose ratio of most
abuse reporting mailboxes is heavily skewed towards noise. If an operator
has an abuse email anywhere, it will be run over with complaints from users
who saw one of their IPs in a spam message header, or who saw something
logged in their home router/firewall logs and WANTS YOU TO MAKE THESE
ATTACKS STOP IMMEDIATELY. Many out there automate these 'reports'
themselves.  (Special hello the fine gentlemen who has my personal email on
the CC list of the more than 1 million spam complaints he's made to my
previous employer in the 15 years since I left that job. )

Every organization is different, but most of the time the abuse box becomes
a lost cause because of this stream of garbage. It becomes a time/money
sink to filter out the noise, so it becomes either totally ignored, or only
sporadically/half-heartedly checked.





On Thu, Apr 23, 2026 at 3:34 PM Li, Weitong via NANOG <nanog () lists nanog org>
wrote:

> Dear NANOG,
>
> Thank you for the replies — both the substantive critiques and the pointed
> ones. Jamie and Sergey were right that the original note should have
> identified the researchers, the institution, the advisor, and the IRB
> tracking number, and I apologize for that omission.
>
> For the record:
>
> - Researchers: myself (Weitong Li, Postdoctoral Researcher,
> weitongli () vt edu) and my advisor, Prof. Taejoong (Tijay) Chung (
> tijay () cs vt edu), Department of Computer Science, Virginia Tech.
>
> - Ethics review: the study, including the two surveys, has been reviewed
> by the Virginia Tech Human Research Protection Program and determined to be
> Not Human Subjects Research (IRB tracking number IRB-26-064). No personally
> identifiable information is collected, and the organization/ASN field is
> explicitly optional. Questions about participant rights can go to
> irb () vt edu.
>
> On the substance: Izaac suggested that running a script over WHOIS is
> enough to show that abuse contacts are broken. I agree that measurement is
> where this work starts, and the surveys are in fact a small complement to a
> larger measurement study — distributed honeypot observations plus a
> randomized controlled reporting experiment across several thousand reports
> — that attempts exactly the kind of systematic evaluation a one-shot script
> cannot provide: how effectiveness varies by recipient choice, by registry,
> by infrastructure type (ISP / hosting / leasing / BYOIP), and by follow-up
> strategy.
>
> What measurement cannot see is the operator-side reasoning: how abuse
> desks triage reports, which evidence they actually find useful, and why a
> structured abuse-c field sometimes loses to a free-text note — or to a
> well-placed trolling address. Randy, thanks for the live demo; AR52766-RIPE
> is a memorable case in point and sits squarely inside what we are trying to
> characterize, namely the gap between what registry records look like and
> what they do in practice. The surveys exist to capture that operator-side
> reasoning, not to substitute for measurement.
>
> The surveys are now reopened with updated consent information at the top
> of each form:
>
> - Abuse report senders:
> https://forms.gle/oDAa8ZDnwsGZiNFT6
>
> - Abuse report recipients / abuse contacts:
> https://forms.gle/TPKjjwXFuhuX8GV7A
>
> One more note, and an apology: if you already submitted a response before
> the surveys were paused, thank you, and I am sorry to have to ask this —
> those earlier responses fell outside the updated consent terms and will not
> be used in our analysis. If you are willing to submit again under the
> updated consent, it would be genuinely appreciated, and if you prefer not
> to, I completely understand.
>
> If there are questions, we should consider adding, framings we should
> adjust, or sharp operational cases we ought to cover, I would be glad to
> hear from the list, on or off.
>
> Thanks again,
> Weitong Li
> Virginia Tech
>
> weitongli () vt edu
>
> ________________________________
> From: Li, Weitong via NANOG <nanog () lists nanog org>
> Sent: Wednesday, April 22, 2026 4:23 PM
> To: nanog () lists nanog org <nanog () lists nanog org>
> Cc: Li, Weitong <weitongli () vt edu>
> Subject: Survey on IP Address Abuse Reporting Practices and Managements
>
> Dear NANOG community members,
> We are researchers from Virginia Tech. We are studying the management of
> Abuse contacts in WHOIS records for IP address and how abuse contacts are
> managed and how abuse reports are handled in practice, from both the sender
> side and the recipient side.
> To better understand the operational reality of abuse reporting, we invite
> you to participate in our surveys:
> For abuse report senders:
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fforms.gle%2FoDAa8ZDnwsGZiNFT6&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862721897585%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=YMzV5vbvpljNuqQ0r7Hu3ezyGWWCD%2FWVmQGsuy0RBHc%3D&reserved=0
> <https://forms.gle/oDAa8ZDnwsGZiNFT6>
> For abuse report recipients / abuse contacts:
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fforms.gle%2FTPKjjwXFuhuX8GV7A&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862721965020%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=8fAbyFls3JqiLBJ04MNL24rpJGgm6Gx38gQgGFR3gqo%3D&reserved=0
> <https://forms.gle/TPKjjwXFuhuX8GV7A>
> Privacy & Data Usage: We are committed to protecting participants’ data.
> Survey responses will be handled carefully, and any reporting of results
> will not reveal personally identifiable information.
> Thank you for your time and for supporting this research!
> Best,
> Weitong
> _______________________________________________
> NANOG mailing list
>
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2F26FSBQWIG7WGMEKEZCVJE5R566BMME7O%2F&data=05%7C02%7Cweitongli%40vt.edu%7Cf3a09e1a79794edef86a08dea0ad27a5%7C6095688410ad40fa863d4f32c1e3a37a%7C0%7C0%7C639124862722028081%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=QpGMtkbCYOwiJ5z16o5ks2SydMPE%2BzRLlVHt6QKb3zA%3D&reserved=0
> <
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/26FSBQWIG7WGMEKEZCVJE5R566BMME7O/
> >
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/XQGSSGDJXXEHX37CX7COHVHIV6TIOKMU/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/7QH5Y4RNLW3PYXFZFWDFD5Z4SPSMZU7U/