How AbuseRoute works
Every lookup is a live query against the authoritative sources, assembled into one answer. This page explains each step, where the data comes from, what the service covers and where it stops.
The pipeline
- Normalise the domain. Lowercased, trailing dot removed, Unicode converted to punycode.
почта.рфandxn--80a1acny.xn--p1aiare the same lookup. - Resolve DNS. A, AAAA, MX, NS, TXT and the CNAME chain, using our own recursive resolver. The CNAME target is often the clearest CDN signal (for example a name ending in
cloudfront.net). - Registration data. The IANA bootstrap file tells us which RDAP server is authoritative for the TLD. We query it for registrar name, IANA ID, status, dates, nameservers and the registrar's abuse contact. Where a ccTLD publishes no RDAP we fall back to port-43 WHOIS and parse the common formats.
- Network ownership. For each resolved IP, the IANA IPv4/IPv6 bootstrap routes us to the responsible RIR (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC). One RDAP request per IP returns the network range, the organisation and the abuse role contact. Redirects between RIRs for transferred space are followed.
- Classification. From the CNAME chain, nameservers, mail exchangers and network organisation names we identify the CDN or reverse proxy (if any), the hosting provider, the mail provider and the DNS provider, with a confidence level based on how many independent signals agree.
- Routing. Contacts are deduplicated by address and ordered. If the origin is visible: hosting network first, then registrar. If a CDN hides the origin: registrar first, then the CDN labelled as a forwarding channel, then any origin network that is still visible.
Data sources
All sources are public and authoritative. Each response carries provenance internally so we can trace any field to the source that produced it.
| Source | What we take | Cache |
|---|---|---|
| IANA RDAP bootstrap | Which server is authoritative for a TLD or IP range | Daily |
| Own DNS resolution | A, AAAA, MX, NS, TXT, CNAME | 5 minutes |
| Registry and registrar RDAP (WHOIS fallback) | Registrar, IANA ID, status, dates, nameservers, registrar abuse contact | 1 hour |
| RIR RDAP | Network range, organisation, country, abuse role contact | 24 hours |
We retain only the fields needed for abuse routing. Person objects and administrative or technical contacts returned by registries are discarded. Results live in memory for the cache period and are not written to disk.
Politeness towards the sources
Registries publish this data so that abuse can be reported to the right party. Keeping their goodwill matters more to us than raw speed. Requests to each registry are serialised over a persistent connection with a fixed, identifying User-Agent, identical domains from different customers are served from the shared cache, and every customer key is rate limited. We have asked ARIN and RIPE NCC in writing to confirm the use, and our customer terms carry the same purpose restrictions their terms require.
Coverage
- gTLDs (.com, .net, .org, new gTLDs): full registration data via RDAP.
- ccTLDs: most return registration data via RDAP or WHOIS. Depth varies by registry; some publish only registrar and dates.
- Network data: all five RIRs, worldwide.
- Internationalised domain names: accepted in Unicode or punycode, in any script.
Limits you should know about
.uk registration data is not currently returned. Nominet's terms restrict commercial use of registration data without permission. DNS, network and classification data for .uk domains are unaffected; the registration field is null.
- Registration data reflects what the registry publishes. Contacts may be stale or unmonitored; the service reports them, it cannot validate them.
- Classification is an inference. A confidence of
mediumorlowmeans fewer signals agreed and the analyst should look at the rawnetworkdata too. - The service returns current state only. Historical resolution ("what did this domain point to last week") is not available.
- One domain per request. Bulk endpoints are planned for paid plans.
What AbuseRoute does not do
- It does not return registrant identity data. That is redacted at source almost everywhere and is not what abuse routing needs.
- It does not send reports or take down anything. It tells you where to send the report.
- It does not build or sell a database. Every answer is a live query plus a short cache.
- It does not offer a web lookup form or anonymous access. This is a private API for teams with a workflow, issued on request, not a public search tool. If you need to check a single domain by hand, the RrSG's ACID Tool is free for individual use.