How we handle abuse reports about our networks

Last updated: 4 November 2026

We operate our own network, so we are responsible for what comes out of it. If traffic, mail or content from our address space or our agent identities is causing you harm, tell us and we will act on it.

What we operate

  1. AS219419, and the IPv6 allocation 2a04:2a00::/31, routed as 2a04:2a00::/32 (our infrastructure) and 2a04:2a01::/32 (agent identities, one /128 per agent or workload). We hold no IPv4 address space.
  2. The whisper.security and whisper.online domains and their subdomains.
  3. Agent identities issued through whisper.online, each with its own reverse DNS name and its own RDAP record at https://rdap.whisper.online.

Every address in 2a04:2a01::/32 is assigned to one agent belonging to one customer, so a report about a single address reaches a single owner. You can see who it belongs to, as far as we publish it, with:

curl https://rdap.whisper.online/ip/<address>

For anything else, such as a phishing site hosted elsewhere that uses our name, please still tell us at abuse@whisper.security and we will take it to the right provider.

How to report

Email abuse@whisper.security. The abuse contact registered with the RIPE NCC for AS219419 and all our address space reaches the same team, so the RIPE database and RDAP lead to the same place.

Please include:

  1. the source address or addresses, and the destination if relevant;
  2. the date and time of each event, with the time zone (UTC preferred);
  3. what happened: the kind of abuse, protocol and port, and its volume;
  4. evidence such as log lines or full message headers, as plain text in the body or attached;
  5. how we can reach you if we need more.

We accept X-ARF and other machine-readable formats as well as plain email. Reports from feedback loops, honeypots and blocklist operators are welcome.

What happens next

  • Receipt: Every report gets an automatic reply with a reference number.
  • Assessment: A person reviews the report within 1 working day. Reports of an ongoing attack are handled as they arrive, during working hours and on a best-effort basis outside them.
  • Action: If the report is confirmed, we act within 1 working day of confirmation. For an agent identity this can mean limiting or suspending its egress, or revoking the identity; for our own infrastructure it means fixing the cause.
  • Outcome: We tell you what we did, unless doing so would expose a customer's confidential information or an investigation.

We contact the customer responsible and ask them to resolve it. Where the abuse is serious or continuing, we do not wait for them: we suspend first and talk afterwards.

Routing incidents

If you see a hijack of our prefixes, a route leak through AS219419, or an RPKI problem with our announcements, write to noc@whisper.security. Our announcements are 2a04:2a00::/32 and 2a04:2a01::/32, origin AS219419, each covered by a ROA with maxLength 32. Anything more specific, or with another origin, is not ours.

Law enforcement and legal requests

Requests from law enforcement and other authorities go to legal@whisper.security. We answer lawful requests that follow the applicable Dutch and European procedures, and we tell the affected customer unless the law prevents it.

What we do not do

We do not sell or share reporters' personal details. We share a report with the customer concerned only to the extent needed to stop the abuse, and we remove your contact details first if you ask us to.

Other contacts

  1. A vulnerability in our own products or networks: security@whisper.security, under our vulnerability disclosure policy.
  2. Findings, corrections and questions about our threat intelligence: see how we share threat intelligence and disclose findings about others.