How to report domain abuse to a registrar: find its abuse contact in ICANN Lookup, send actionable evidence and know what RAA section 3.18 requires.
Quick answer: To report domain abuse to a registrar, look up the domain in ICANN Lookup to find the registrar and its abuse contact, then send that contact the full URLs and evidence that the domain is used for phishing, malware or other abuse. For generic domains such as .com, .net or .shop, ICANN's Registrar Accreditation Agreement (RAA) requires the registrar to confirm receipt, investigate, and promptly act when it has actionable evidence of DNS abuse.
Registrars are worth reporting to because they control the domain name itself. A suspended domain stops working everywhere at once: every page, every subdomain and its email, whichever host or CDN serves the content. Here is how to find the right registrar, what the rules require of it, and what to do if it does not act.
Step 1: Find the registrar and its abuse contact
Domain registration data is published through RDAP, the protocol that replaced WHOIS for generic top-level domains (ICANN). The easiest way to read it:
- Open ICANN Lookup and enter only the domain name, such as example.com, not the full URL.
- Find the registrar section. It names the accredited registrar and its IANA ID.
- Note the registrar's abuse contact email and phone. They are published with the domain record even when the owner's details are hidden.
- Check the creation date. A lookalike domain registered a few days ago is useful context for your report.
Two things often confuse people. First, "REDACTED FOR PRIVACY" in the registrant field is normal and does not stop you from reporting, because you report to the registrar, not the owner. Second, many domains are sold through resellers or hosting companies. The accredited registrar in the lookup is the one bound by the ICANN contract, so report to it even if a reseller is also shown.
Our free abuse report generator finds the registrar's abuse address for you and drafts the report.
What ICANN requires: RAA section 3.18
Every ICANN-accredited registrar signs the RAA. Its section 3.18, "Registrar's Abuse Contact and Duty to Investigate Reports of Abuse", was rewritten by amendments that took effect on 5 April 2024 (ICANN). In summary:
| Section | What the registrar must do |
|---|---|
| 3.18.1 | Keep an abuse contact for reports of abuse, including DNS abuse and illegal activity; publish an email address or web form on, or easily reachable from, its home page; confirm receipt to the reporter; and take reasonable and prompt steps to investigate and respond appropriately. |
| 3.18.2 | When it has actionable evidence that a domain it sponsors is used for DNS abuse, promptly take the appropriate action needed to stop or disrupt that use. |
| 3.18.3 | Run a dedicated contact for law enforcement and similar authorities, monitored around the clock, and have well-founded reports reviewed within 24 hours. |
| 3.18.4 | Publish its procedures for handling abuse reports, document every report and response, and keep those records for two years, or less where the law requires. |
"DNS abuse" has a specific meaning in the contract: malware, botnets, phishing, pharming, and spam when it delivers one of those. ICANN's compliance advisory adds practical detail:
- A web form for abuse reports must not require you to log in.
- The confirmation of receipt must identify the registrar, the reported domain names and the date of the report.
- "Promptly" has no fixed deadline. The registrar must act with urgency in proportion to the harm and be able to explain its timing to ICANN.
- The right action depends on the case. In ICANN's example of a new domain that hosts only a fake login page, the registrar suspends it. For a long-established domain with one hacked page, a notice to the owner may be more proportionate.
These rules apply to generic top-level domains. Country-code domains such as .uk, .de or .com.tr follow their own registry's policies, and ICANN has no contractual authority over them (ICANN). For those, look for the abuse process on the registry's website.
Step 2: Send a report with actionable evidence
The mitigation duty starts when the registrar has actionable evidence, so your report should let a reviewer confirm the abuse without guesswork. ICANN's advisory names the complete URL and a screenshot showing the abuse and what it impersonates. A strong report includes:
- The domain and the type of abuse in the subject line, for example "Phishing: acmebank-secure[.]top".
- Every full URL where the abuse appears, and when you last saw it live.
- What the page impersonates and what it collects.
- Screenshots that include the address bar, plus the legitimate page for comparison.
- How to reproduce the page if it hides from some visitors, such as only on mobile or only in one country.
- If the domain copies a trademark, a note that it is a lookalike of the brand's real domain.
- Your name, organisation and, for brand representatives, your authority to act.
Send it to the address or form from the lookup, keep the confirmation of receipt and note its date. If the registrar asks for more, reply in the same thread.
Registrar or host: which one to report to?
Usually both, because they control different layers. The registrar can suspend the domain, and the hosting provider can remove the files. Registrar action works best when the domain was registered for abuse, such as a typosquat of a bank. When a legitimate site has been hacked, the host and the site owner are better placed to clean it up, and the registrar may notify them rather than suspend. If the site sits behind Cloudflare, see taking down a phishing site behind Cloudflare, but send the registrar report anyway: suspension works whatever CDN is in front.
If the registrar does not act
- Follow up in the same ticket with fresh evidence that the domain is still being used for abuse.
- Contact the registry operator for the top-level domain. Registries publish their own abuse contacts, and under their agreements with ICANN they must also act on actionable evidence of DNS abuse, which can mean referring it to the registrar.
- File a complaint with ICANN Contractual Compliance. Its complaint page has a form called "Abuse/DNS Abuse (Registrar)". Include your original report, the registrar's confirmation and evidence that the abuse continued. ICANN reviews the evidence and can require the registrar to explain its decisions and timing; complaints without enough evidence are closed.
- Keep the other routes running. Report the URL to Google Safe Browsing and other blocklists so visitors see a warning while the domain stays live.
For brands that face new lookalike domains every week, this cycle of lookups, reports and follow-ups adds up. Phishvoid sends registrar, host and blocklist reports in parallel under your letter of authorisation and tracks each one until the domain is suspended or the content is gone. Our overview of what a domain takedown service should do explains when outside help makes sense.
FAQ
How do I find a registrar's abuse contact?
Enter the domain in ICANN Lookup. The result shows the registrar and its abuse contact email and phone. For country-code domains, use the registry's own lookup if ICANN Lookup shows little.
Does a registrar have to suspend a phishing domain?
Not automatically. Under RAA section 3.18.2, it must promptly take appropriate action when it has actionable evidence of DNS abuse. For a domain registered only for phishing, that often means suspension; for a hacked legitimate domain, it may be a notice to the owner.
How long does a registrar have to respond?
The RAA sets no fixed deadline for reports from the public. It requires a confirmation of receipt and prompt action in proportion to the harm. The 24-hour review rule in section 3.18.3 applies to reports from law enforcement and similar authorities.
Can I report a domain if the owner's details are hidden?
Yes. Privacy redaction hides the owner, not the registrar. You report to the registrar, which knows who its customer is.
Is every scam website "DNS abuse"?
Not necessarily. The contract defines DNS abuse as malware, botnets, phishing, pharming and related spam. Registrars must still investigate other reports of abuse and illegal activity under section 3.18.1, but the specific mitigation duty in 3.18.2 covers DNS abuse.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.