How to find the abuse contact for any domain

The registrar sold the domain name and controls whether it resolves. A registrar suspension removes every page on that name at once, which is the right lever when the whole domain exists for abuse — a lookalike bank name, a fake shop, a phishing domain registered last week.

The hosting network runs the server. It can remove content without touching the name, which is the right lever when a legitimate site has been hacked and a phishing kit sits in one folder. Suspending that domain would punish the victim.

When in doubt, contact both. They act independently and neither one waits for the other.

Enter the domain at ICANN Lookup or any RDAP client. Ignore the registrant block — it is almost always redacted — and look for:

• Registrar — the company name and its IANA ID.
• Registrar Abuse Contact Email and Phone — in RDAP this is an entity with the role abuse, nested under the registrar entity.
• Creation date — a domain created days before the abuse started is strong evidence it was registered for that purpose. Put it in your report.
• Name servers — these hint at the DNS or CDN provider, which may be a third party worth contacting.

Country-code domains (.uk, .de, .au and so on) are governed by their own registries rather than ICANN contracts, and some show far less. For those, the registry's own lookup and complaint page is the next stop.

Every registrar accredited by ICANN signs the Registrar Accreditation Agreement. Section 3.18 of the 2013 version obliges the registrar to maintain an abuse contact to receive reports of illegal activity, publish it on its homepage and in registration data, take reasonable and prompt steps to investigate and respond appropriately to reports, and have a dedicated contact for law enforcement whose reports are reviewed within 24 hours.

That is why the registrar is such a dependable recipient for generic top-level domains: the address must exist and must be read. It does not mean every report leads to a suspension — "respond appropriately" leaves the registrar room to decide — so the quality of your evidence still decides the outcome.

1. Resolve the domain. Use dig example.com A, nslookup, or any online DNS lookup, and note the IPv4 and IPv6 addresses.
2. Find the registry for that IP. IP space is allocated by five regional internet registries: ARIN (North America), RIPE NCC (Europe, Middle East, Central Asia), APNIC (Asia-Pacific), LACNIC (Latin America) and AFRINIC (Africa). RDAP bootstrap services route your query automatically.
3. Read the network record. Look for the organisation holding the range and the entity with the abuse role. RIPE records often expose it as abuse-c or an abuse-mailbox attribute.
4. Check for a reseller. Small hosts rent space from larger networks. If the record names a large carrier, the actual host may be a customer of it. Report to the listed network; it will either act or forward to its customer.

Our free abuse contact lookup runs both queries and shows the registrar and network addresses side by side, with the source of each.

Many large hosts, CDNs and social platforms route abuse reports through a web form and send email replies to a no-reply address. That is legitimate, and often faster than email because the form feeds their ticket system directly. A few practical points:

• Paste the same facts you would send by email; the form fields map to them.
• Upload screenshots rather than linking to them.
• Save the ticket number and a copy of what you submitted — forms rarely send a full receipt.
• If the form rejects your category ("we only accept copyright reports"), choose the closest option and state the actual abuse in the first sentence.

• The address bounces. Check the registrar's website for a current abuse page; the RDAP record may be stale. As a last resort, the registry for the domain ending can be contacted.
• Automated reply, ticket closed. Reply to the ticket with any missing evidence and ask for it to be reopened.
• No response at all. Escalate as described in reporting abuse to a hosting provider: upstream network, registrar, and browser blocklists.

Once you have the addresses, use the template in how to report abuse to a hosting provider, or read how to report a phishing site to the registrar for a worked example. If you would rather not run the process yourself, report the site to Fraudpol.