# encoding: ascii
# api: powershell
# title: Get-WhoisAbuse
# description: A function to return the Abuse Email address from arin.net with IPv6 support.
# version: 0.1
# type: function
# author: Josh Wortz
# license: CC0
# function: get-whoisabuse
# x-poshcode-id: 4808
# x-archived: 2014-01-21T02:22:55
# x-published: 2014-01-17T15:42:00
#
#
function get-whoisabuse ([string][validatescript({ $ip = $null; [net.ipaddress]::tryparse($_, [ref]$ip); })]$ipaddress)
{

[xml]$a = (Invoke-WebRequest -Uri "http://whois.arin.net/rest/ip/$ipaddress" -ContentType "text/xml").content

[xml]$pocs = (Invoke-WebRequest -Uri (($a.net.orgRef).'#text' + "/pocs") -ContentType "text/xml").content

[xml]$abuse = (Invoke-WebRequest -Uri (($pocs.pocs.pocLinkRef | where {$_.function -eq "AB"}).'#text') -ContentType "text/xml").content

[array]$result = $abuse.poc.emails.email

$result

}
