# encoding: ascii # api: powershell # title: # description: A function to return the Abuse Email address from arin.net. # version: 0.1 # type: function # license: CC0 # function: get-whoisabuse # x-poshcode-id: 4793 # x-archived: 2015-03-23T19:22:49 # # function get-whoisabuse ([string]$ipaddress) { [xml]$a = (Invoke-WebRequest -Uri "http://whois.arin.net/rest/ip/$ip" -ContentType "text/xml").content [xml]$pocs = (Invoke-WebRequest -Uri ("http://whois.arin.net/rest/net/" + $a.net.handle + "/pocs") -ContentType "text/xml").content [xml]$abuse = (Invoke-WebRequest -Uri (($pocs.pocs.pocLinkRef | where {$_.function -eq "AB"}).'#text') -ContentType "text/xml").content [array]$result = $abuse.poc.emails.email $result }