# encoding: ascii
# api: powershell
# title: Get-WhoisAbuse
# description: A function to return the Abuse Email address from arin.net.
# version: 0.1
# type: function
# author: Josh Wortz
# license: CC0
# function: get-whoisabuse
# x-poshcode-id: 4807
# x-derived-from-id: 4808
# x-archived: 2015-03-23T12:35:36
# x-published: 2015-01-17T15:12:00
#
#
function get-whoisabuse ([string][ValidatePattern("^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$")]$ipaddress)
{
[xml]$a = (Invoke-WebRequest -Uri "http://whois.arin.net/rest/ip/$ipaddress" -ContentType "text/xml").content
[xml]$pocs = (Invoke-WebRequest -Uri (($a.net.orgRef).'#text' + "/pocs") -ContentType "text/xml").content
[xml]$abuse = (Invoke-WebRequest -Uri (($pocs.pocs.pocLinkRef | where {$_.function -eq "AB"}).'#text') -ContentType "text/xml").content
[array]$result = $abuse.poc.emails.email
$result
}