Summary

  • The RIPE NCC validates the reachability of abuse-mailbox addresses, not how abuse reports are handled; its published policy and proposals state explicitly that it has no mandate to interfere with a resource holder's internal abuse handling.
  • Prevention and substantive remedy sit with member LIRs and resource holders; the registry's control runs through contractual escalation, ending in closure and deregistration (RIPE-858, published 7 May 2026).
  • In 2025 the registry ran 2,320 abuse-c validation investigations and validated 86,959 addresses, yet no public enforcement action for invalid abuse contacts is recorded; the 2018 follow-up trial showed 43% of invalid cases still needed manual staff chasing.
  • No independent, non-operator audit of abuse-handling outcomes or remedy durability was located; the durability picture rests largely on self-reporting.

The question of who controls abuse in the RIPE region looks, at first glance, like a question about the RIPE NCC. It is the institution with the database, the validation tooling and the annual report that quantifies both. But the documents the registry itself publishes draw a sharper line: the RIPE NCC controls the measurement surface of abuse-contact compliance, while the substantive work of prevention and remedy belongs to member LIRs and resource holders. That division is written into policy, into proposal history and into procedure — and it explains a great deal about what the enforcement record does and does not show.

The boundary written into the policy

RIPE-705, the policy of record for abuse-contact management in the RIPE Database, requires every internet number resource to carry an "abuse-c:" attribute referencing a role object with a single "abuse-mailbox:" attribute. That mailbox is defined as the contact for reports about abusive behaviour originating in the resource holder's network — which is to say, the policy places the obligation to receive and handle abuse reports on the resource holder, not the registry (https://www.ripe.net/publications/docs/ripe-705/).

The same document defines the RIPE NCC's role narrowly: to validate the abuse-mailbox attribute at least annually, and to follow up where the attribute is deemed incorrect, in line with RIPE policies and RIPE NCC procedures. Validation, not adjudication. The registry checks that the mailbox exists and can receive mail; it does not sit in judgement on how the reports landing in that mailbox are processed.

That limitation is not incidental. The policy proposal that produced RIPE-705, proposal 2017-02, states the boundary in plain language: "The RIPE NCC has no mandate to interfere with the internal abuse handling procedures of resource holders." A correctly configured mailbox that ignores every report it receives is out of scope for this validation regime (https://www.ripe.net/community/policies/proposals/2017-02/). A later proposal, 2019-04, which sought a stricter validation standard, made the same exclusion explicit even in its harder version: the validation process would not check how abuse cases are processed (https://www.ripe.net/community/policies/proposals/2019-04/).

The proposal history also assigns the operational responsibility downward. Failed validation tickets are grouped per LIR — and per sponsoring LIR for end users — making the LIR responsible for ensuring that its own and its end users' abuse mailboxes are validated. The community, not the registry, is the suggested channel for escalating reports about poorly handled abuse cases (https://www.ripe.net/community/policies/proposals/2019-04/).

What validation counts, and what it cannot count

The mechanics of the validation regime reinforce this division. The automated check is deliberately non-intrusive: it verifies syntax, DNS entries, detects bogus or honeypot addresses, and pings the mailbox to confirm it can accept mail — without sending any email (https://labs.ripe.net/author/angela_dallara/how-we-will-be-validating-abuse-c/). Escalation then runs through follow-up emails to LIR contacts and, if those go unanswered, phone attempts and other contact routes, before the case is handed to the existing procedure for LIRs that cannot be contacted at all (https://labs.ripe.net/author/angela_dallara/how-we-will-be-validating-abuse-c/).

What this apparatus measures is deliverability. A mailbox can pass every check and still be a box that nobody reads. The 2017-02 impact analysis noted a preliminary test suggesting 10–25% of abuse-mailbox attributes might be incorrect or inactive; the automated technical check at the time passed 92.5% of addresses (https://www.ripe.net/community/policies/proposals/2019-04/). Those two figures are not a contradiction — they are the reachability-versus-responsiveness gap rendered in numbers.

The registry's own 2025 numbers show the regime running at volume. The Annual Report 2025, published 17 April 2026 as a supporting document for the General Meeting of 20–22 May 2026, records 2,320 abuse-c validation investigations (801 LIR accounts, 764 LIR resources, 755 end users), 86,959 validated abuse-c addresses — 85,696 via the automated process and 899 requiring manual intervention — up from 83,509 in 2024, alongside 2,825 Assisted Registry Checks against a target of 2,400 (https://www.ripe.net/media/documents/ripe-855.pdf; https://www.ripe.net/media/documents/ripe-850.pdf). Membership ended 2025 at 20,647 active LIR accounts, with 1,218 closed and 874 opened during the year, and monitoring extended to roughly 20,000 independent resource holders (https://www.ripe.net/media/documents/ripe-855.pdf).

The report also states that the registry "successfully validated all abuse-c addresses to comply with RIPE-705." Taken with the 899 addresses that required manual intervention and the continuing 2026 cycle, the more precise reading is that validation is an ongoing operation, not a completed repair (https://www.ripe.net/about-us/news/ripe-ncc-annual-report-2025-and-ripe-ncc-financial-report-2025-published/).

The ladder that resolves complaints without reaching its last rung

The enforcement lever for persistent non-compliance is contractual, not supervisory. RIPE-858 — "Closure of Members, Deregistration of Internet Resources and Legacy Internet Resources", published 7 May 2026 as the current replacement for ripe-833 of 18 October 2024 — treats an invalid abuse-mailbox attribute as grounds relating to improper registration, requires registration data to be valid and contactable within a reasonable time, and links persistent failure to termination of the service agreement and deregistration of resources (https://www.ripe.net/publications/docs/ripe-858/).

The registry has framed this as a last resort. Proposal 2017-02's own documentation records that the RIPE NCC resolved more than 1,000 external reports of incorrect abuse-mailbox attributes over five years without ever triggering the closure procedure, and that a resource holder facing it has a further three months to resolve the problem before actual closure (https://www.ripe.net/community/policies/proposals/2017-02/).

Here the boundary between measurement and remedy becomes visible in enforcement data. Detection is centralised: thousands of investigations a year, run by one institution, quantified in a public annual report. Prevention and repair are decentralised: the LIR fixes its own mailbox, the sponsoring LIR chases its end users, and the registry's only hard power is the closure mechanism at the end of the ladder. Between the two sits the great majority of the 2025 record — thousands of tickets resolved by follow-up emails and phone calls, never reaching the final rung.

Who actually fixes a bad abuse contact, and how durable the fix is

The closest available evidence on durability is a RIPE NCC trial from late 2018, published on RIPE Labs. Testing the automated process on the abuse contacts of 900 LIR organisation objects produced 187 tickets — roughly 21% of the emails either invalid or false positives. After four weeks, 106 tickets had been resolved without staff intervention, leaving 81 cases — 43% of the invalid emails, or 9% of the total — requiring manual staff follow-up (https://labs.ripe.net/author/angela_dallara/how-we-will-be-following-up-with-invalid-abuse-contacts/).

The registry drew its own conclusion: a significant portion of abuse contacts would require labour-intensive manual follow-up. Members are "obligated to respond, as they can eventually be closed for unresponsiveness" — which is to say, the only durable backstop is the contractual one, and even the 'easiest' category of contact needed substantial chasing (https://labs.ripe.net/author/angela_dallara/how-we-will-be-following-up-with-invalid-abuse-contacts/).

The trial is operator-reported and predates the current validation regime and volumes. It is the best available, not the only desirable, evidence. A community mailing-list discussion on abuse handling at RIPE 87's Anti-Abuse Working Group shows the working group continuing to examine the mechanics of abuse reporting and contact quality, but no independent audit of abuse-handling outcomes was located in the public record inspected for this report (https://ripe87.ripe.net/wp-content/uploads/presentations/72-RIPE87-AAWG-final.pdf).

Bounded conclusion

The division of control in the RIPE region is real and documented: the registry measures and can escalate; members must prevent and repair. The measurement surface is mature and quantified. The remedy surface is contractually defined, procedurally documented — and, on the public record, never exercised to its limit for the conduct the abuse-contact regime polices. Whether that reflects a healthy regime that resolves problems early, or an accountability gap where the documented sanction is structurally hard to reach, cannot be settled from self-reporting alone.

The public record contains no independent verification either way, and until one exists, the honest answer to "who controls abuse in the RIPE region?" is: many hands, one measurer, and no external referee.