Acceptable use policy.
Leased address space carries its history. These are the uses that damage it, and what happens when a report arrives about a block we hold.
Unsolicited bulk mail
Sending unsolicited bulk mail from the space, or providing the infrastructure someone else sends it from.
Scanning and intrusion
Port scanning networks that have not asked for it, credential stuffing, and any attempt to gain access to a system you do not run.
Malware and phishing
Hosting malware, command and control infrastructure, or pages that impersonate another party to collect credentials or payment details.
Traffic that damages the reputation of the block
Any pattern of traffic that gets the space listed on a public blocklist. A block carries its history to the next lessee, so its reputation is part of what is being leased.
Announcing from the wrong ASN
Announcing the prefix from any ASN other than the one named on the authorisation letter. A change of announcing ASN is a request to us, not a change you make upstream.
Deaggregating past the ROA
Announcing more specific routes than the maximum length on the route origin authorisation. The ROA is filed for the block as a whole unless a wider maximum length was agreed.
Resale and sublease
Reselling, subleasing or otherwise passing the space to another party without the operator agreeing to it first. The lease names one organisation.
The authorisation letter names the block, the announcing ASN and the term. It is the document an upstream reads, and the route origin authorisation filed at activation says the same thing in RPKI. Both have to match what is actually announced.
Where the block geolocates is published by us, from a request you file. Publishing a different location yourself, in a feed of your own or in a registry object, puts two answers in circulation and gets both distrusted.
A report about a leased block enters the support queue as a ticket in the abuse category, which routes it to the abuse mailbox rather than to sales or general.
We reply on the ticket, and that reply is mailed to every member of the lessee organisation. It says what was reported and asks the lessee to act. What we need back is the action taken, not an explanation of the report.
If it is not resolved, the operator may withdraw the block. The route origin authorisation is withdrawn, the block stops being announced by the lessee, and the lease ends on the grounds set out in the terms.
Write to [email protected] with the address or prefix involved, timestamps in UTC, and log lines or headers that show what happened. A report carrying that evidence can be acted on without a round trip for it.