Abuse report

An abuse report is a complaint sent to the company whose service is being misused, asking it to investigate and take action. For phishing, the recipients are usually the domain registrar, the hosting provider, any CDN or proxy in front of the site, and sometimes the domain registry. A clear, well-evidenced report is the basic building block of every phishing takedown.

How it works

First you identify who is responsible for each layer of the site. Registration data lookups, for example through ICANN Lookup, show the registrar and its abuse contact, while IP lookups show the network that hosts the server. Since 2024, ICANN's contracts with registrars and gTLD registries require them to take reasonable action when they receive actionable evidence of DNS abuse, which includes phishing. A good report typically contains:

• the full URL, written in defanged form so it cannot be clicked by accident;
• what the site is doing and which brand it impersonates;
• evidence such as screenshots, timestamps, page source and how to reproduce any cloaking;
• who you are and, if you are acting for a brand, proof of authority;
• the action you are asking for, such as suspending the domain or removing the content.

Example

As an illustration, a brand finds a fake login page at examplebank-login[.]com. The analyst sends one report to the registrar's abuse address and another to the hosting provider, each with screenshots, the defanged URL, the time of capture and a short explanation that the page collects online banking passwords. The registrar confirms receipt, reviews the evidence and suspends the domain.

When to use it

• A site, account or server is actively used for phishing, malware or fraud.
• A domain impersonates your brand and is pointed at harmful content.
• You need a provider to preserve or act on evidence of abuse on its network.
• Other routes, such as contacting the site owner, are not realistic or safe.

What brands can do

Use each provider's preferred channel, whether an abuse form or email, and keep reports short, factual and complete. Send reports to several layers in parallel instead of waiting for one to answer. Record ticket numbers and follow up when a site is still live. A letter of authorization makes reports from a partner more credible. Phishvoid prepares and files these reports for brands every day; contact us if you want this handled.

Read more: How to Report a Scam Website (and Get It Taken Down)