Summary

  • RIPE NCC's abuse-mailbox validation establishes that a published contact exists and can receive mail. It is not a measure of what happens to a report once it arrives.
  • The escalation path is documented in unusual detail: ticket, weekly emails, telephone contact, then the unresponsive-LIR procedure that can end a Standard Service Agreement and deregister resources.
  • The only quantified baseline is dated. Preliminary tests in 2017 suggested 10 to 25 per cent of roughly 70,000 abuse-mailbox attributes might be incorrect or inactive; by May 2019 the register held about 93,000 attributes, and more than 32,000 validation tickets were anticipated per round against roughly 6,000 opened that year.
  • No compliance, failure, removal or closure figure for 2025 or 2026 could be located in retrievable RIPE NCC material, which leaves the effective reach of the remedy unauditable from outside.

The public record for RIPE ABUSE shows a control with two distinct halves. One half is a technical check with a published specification. The other is a remedy pathway that can strip a member of its registration rights. The first half is described precisely. The second half is described procedurally, and its use is not counted in any material retrieved for this briefing.

What the validation actually tests

RIPE NCC validates the abuse-mailbox attribute held in the RIPE Database. Retrieved registry material describes an automated check that confirms the attribute is present and correctly formatted, verifies DNS entries, flags addresses that look like bogus or honeypot mailboxes, and confirms that the mail server will accept messages. The initial automated pass sends no email at all (RIPE NCC validation material).

The distinction between a mailbox that accepts mail and a holder that answers it is structural, not incidental. Validation tests reachability. Reachability is a precondition for a report to arrive; it is not evidence that anyone acted on it. Neither the ticket flow nor the published validation description reviewed for this briefing reports whether a report delivered to a validated mailbox was read, investigated or resolved (RIPE NCC).

The obligation does not cover everything in the registry. It attaches to resources covered by the abuse-contact requirement; legacy IP addresses and autonomous system numbers distributed before RIPE NCC existed sit outside the validation process.

The ladder, step by step

The escalation sequence for a failing mailbox is documented and sequential.

  1. The attribute fails automated validation. It is marked invalid and a ticket is created.
  2. The Local Internet Registry responsible is emailed an explanation and a validation link.
  3. If there is no response, follow-up emails go to all LIR contacts. This repeats at one-week intervals, twice more.
  4. After a third email without a response, a RIPE NCC staff member intervenes by telephone or through other available addresses.
  5. If contact still fails, the case is escalated under the established procedure for unresponsive LIRs.

Follow-up is also triggered by a different kind of policy violation, for example an abuse-mailbox that accepts only web-form submissions rather than mail (RIPE NCC).

The final rung is not advisory. The procedural document "Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources" sets out the grounds and the process for terminating a member's RIPE NCC Standard Service Agreement and for deregistering Internet number resources; retrieved material places its last update at 7 May 2026. Grounds for registry-initiated termination include non-compliance with RIPE NCC audits, such as unresponsiveness or failure to cooperate, and the provision of falsified, misleading or repeatedly incorrect data, including inaccurate contact details. Termination can follow a three-month notice period, or take effect immediately in specified cases. Once the agreement ends, the former member loses the right to maintain Internet number resource records in the RIPE Database (RIPE NCC procedure).

One boundary should be stated plainly: the closure route is a general compliance instrument, not an abuse-specific penalty. Inaccurate contact data is one ground among several, and no retrieved document attributes a specific closure to a failing abuse mailbox.

What the registry counted, and when

The published numbers are specific and old.

  • In 2017, preliminary tests suggested that 10 to 25 per cent of approximately 70,000 distinct abuse-mailbox attributes might be incorrect or inactive.
  • Tests reported in 2018 indicated that around 20 to 25 per cent of resource holders might need to validate or update their abuse contacts.
  • As of May 2019, the RIPE Database contained approximately 93,000 distinct abuse-mailbox attributes. RIPE NCC anticipated that each validation round would generate more than 32,000 tickets, potentially 64,000 in a year. About 6,000 tickets were opened in 2019.
  • Also in 2017, RIPE NCC said it had resolved over 1,000 external reports about incorrect abuse-mailbox attributes without needing to trigger the full closure and deregistration procedure.

The gap between the anticipated 32,000-plus tickets per round and the roughly 6,000 opened in 2019 is the most informative figure in the set, and it is also the one most in need of a stated denominator. Tickets are generated by failures, not by resource holders; a lower count in a given year can mean better data, a shorter validation cycle, or a differently counted workflow. None of the retrieved material settles which (RIPE NCC).

Policy status, and where the trail ends

The policy that mandates and defines validation, "Abuse Contact Management in the RIPE Database" (ripe-705), was accepted in June 2018 and is in force. The Abuse Contact Management Task Force, established after RIPE 61, examined policy proposals on managing abuse contacts and fed into that policy. Retrieved references describe the validation cadence differently, at least annually in one place and at least every six months in another, the latter reflecting an earlier discussion, so the cadence is best treated as annual or more frequent rather than fixed.

No published compliance rate, validation-failure count, contact-removal count or member-closure count attributable to abuse-contact non-compliance for 2025 or 2026 was located in the material retrieved for this briefing. RIPE NCC's statistics page was removed during a website upgrade; a new statistics framework is pending, and core IP address and ASN data remain available through RIPEstat (RIPE NCC).

That absence is not proof that escalation never happens, and it should not be read as one. It is a limit on what an outside party can verify. A registry that publishes its escalation ladder but not the number of cases that climbed it leaves the question of durable remedy to be answered by assumption. The directory entry for this subject is RIPE ABUSE.