The usual way this goes is that spamhaus has some further evidence available, which they don't expose publicly. They would make it available to vetted security contacts at RIPE, or LE that are interested, for example. The data point isn't unstructured beyond what you'd expect, and most abuse complaints you'd get are far less structured. Right now, it is simply a statement "CIDRs x, y and z are suspected to be hijacked". On Fri, Jul 29, 2011 at 12:54 PM, Florian Weimer <fw@deneb.enyo.de> wrote:
The Spamhaus report you referenced (rather indirectly) is not very illuminating, either. It says, "This block is to be returned to RIPE". What does this mean? Is it in the process of being returned? Has Spamhaus suggested (to whom?) that it should be returned? Is this some sort of demand?
-- Suresh Ramasubramanian (ops.lists@gmail.com)