So, you are trying to read the Abusix XARF report you received.

The details about the abuse are contained within the attached JSON file, so it may be automatically processed by parties configuring their abuse systems to do so, as opposed to a manual log review.

XARF is modeled after ARF, which requires an email report to use a Content-Type of multipart/report; report-type=feedback-report containing three MIME Parts. The three parts needed in an RFC-compliant abuse report are:

XARF differs from ARF in that it not only allows spam to be reported, but it permits all forms of abuse; spam messages, phishing, trademark, copyright, and counterfeit goods, as well as child exploitation, web crawler and log events, and other events (that do not involve email or do not have logged events), to be reported as abuse in a single unified format which makes it easy for human agents to quickly read reports and companies to automate the parsing of reports with minimal tooling.

In XARF, event information (logged and not logged) is presented in the third MIME part using an application/json format. This allows the same framework to report spam messages to be also used to report DDoS attacks, phishing, trademark, copyright and counterfeit goods, child exploitation, web crawlers, and many other types of abusive behavior, which may or may not have an email message or a log line associated with them.

Here is a link to the more common XARF v3 Schemas.

Also, see

RFC6522 ARF Spam/Abuse Report

RFC5965 XARF Extensible format

Still need help?

No problem; click the chat button in the bottom right-hand corner of the screen and send us your questions. Alternatively, you can email us at support@abusix.com

Also, follow our LinkedIn Channel for updates & subscribe to our YouTube Channel for the latest Abusix how-to-videos.